e82b6462686a61642a3eee7bb3477b45772e8d768592a575ec16d5e798d49180

Analysis

max time kernel
89s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Soundpadcrack.exe
Size 12.5MB
Sample260702-xpdycacy3y
SHA256 e82b6462686a61642a3eee7bb3477b45772e8d768592a575ec16d5e798d49180
MD5 c7401a887706a9e2431906c6fa396063
SHA1 b9e05e36ad6fbfc0fb03cad32b30a9b966794d1f
SHA512 bd63a96655ffada2fdb7b6e9dd3e39432a570e98be79b06e56206204f5e19a666097123fc14fa85978f0d64e6bee8832f2840eb8adff14e38a59ad75ed1f3c6e
SSDEEP 196608:eDRlger67uOemwy1LR/XU3gmsRM0wWM+wC89ooEv6:9erSwAVE3XsRMiJps3
TLSH
T111D67C1B76A647DAE063C03C8A964502EFB27CC10F3157FB1112757E1EB69E88D3E266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub32"	y45msk06kr09wbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Search.exe"	zs47uanj4zka6fqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Search.exe"	Search.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c526-289.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c528-308.dat	aspack_v212_v242

Executes dropped EXE 22 IoCs

pid	Process
2160	Soundpad.exe
2232	y45msk06kr09wbkc.exe
712	zs47uanj4zka6fqe.exe
2356	Search.exe
3240	Search.exe
1628	Searcher.exe
4280	Sub32
4952	Search.exe
1012	tmp3C6E.tmp.exe
572	Мухи.exe
3724	BALDI.exe
1400	Glitcher.exe
5948	Avada.exe
2092	AgA.exe
1512	УбратьМух.exe
1076	казино фулл.exe
3792	Курсор - писюн.exe
1424	copycursor.exe
1904	clickstart.exe
1884	headache.exe
4840	Search.exe
4168	Sub32

Loads dropped DLL 23 IoCs

pid	Process
2356	Search.exe
5868	Process not Found
5640	Process not Found
3240	Search.exe
1628	Searcher.exe
5444	Process not Found
4140	Process not Found
4280	Sub32
4952	Search.exe
2236	Process not Found
2476	Process not Found
4832	powershell.exe
1012	tmp3C6E.tmp.exe
4392	Process not Found
3724	BALDI.exe
1400	Glitcher.exe
5820	AUDIODG.EXE
5948	Avada.exe
2092	AgA.exe
5456	Process not Found
2228	Process not Found
4840	Search.exe
4168	Sub32

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	WScript.exe
File opened (read-only)	\??\H:	WScript.exe
File opened (read-only)	\??\I:	WScript.exe
File opened (read-only)	\??\J:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\W:	WScript.exe
File opened (read-only)	\??\Z:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\Y:	WScript.exe
File opened (read-only)	\??\A:	WScript.exe
File opened (read-only)	\??\K:	WScript.exe
File opened (read-only)	\??\O:	WScript.exe
File opened (read-only)	\??\D:	WScript.exe
File opened (read-only)	\??\M:	WScript.exe
File opened (read-only)	\??\N:	WScript.exe
File opened (read-only)	\??\P:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\B:	WScript.exe

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	icanhazip.com
4	api.ipify.org
6	api.ipify.org
17	api.ipify.org
18	api.ipify.org
48	api.ipify.org
3	api.ipify.org
5	api.ipify.org
10	icanhazip.com
50	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
4832	powershell.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Staem	y45msk06kr09wbkc.exe
File created	C:\Program Files\Staem	y45msk06kr09wbkc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwd.dll	zs47uanj4zka6fqe.exe
File created	C:\Windows\Sub32	y45msk06kr09wbkc.exe
File opened for modification	C:\Windows\Sub32	y45msk06kr09wbkc.exe
File created	C:\Windows\xdwd.dll	zs47uanj4zka6fqe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clickstart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Мухи.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	УбратьМух.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	казино фулл.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	copycursor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Курсор - писюн.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	headache.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	УбратьМух.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	УбратьМух.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	УбратьМух.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	УбратьМух.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	УбратьМух.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	УбратьМух.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	казино фулл.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2780	schtasks.exe
508	schtasks.exe
4572	schtasks.exe
2448	schtasks.exe
2280	schtasks.exe
2488	schtasks.exe
5720	schtasks.exe
3732	schtasks.exe
936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2232	y45msk06kr09wbkc.exe
2232	y45msk06kr09wbkc.exe
2356	Search.exe
2356	Search.exe
3240	Search.exe
3240	Search.exe
1628	Searcher.exe
1628	Searcher.exe
2232	y45msk06kr09wbkc.exe
2232	y45msk06kr09wbkc.exe
2232	y45msk06kr09wbkc.exe
4280	Sub32
4280	Sub32
4952	Search.exe
4952	Search.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
1012	tmp3C6E.tmp.exe
1012	tmp3C6E.tmp.exe
3724	BALDI.exe
3724	BALDI.exe
1400	Glitcher.exe
1400	Glitcher.exe
5820	AUDIODG.EXE
5820	AUDIODG.EXE
5948	Avada.exe
5948	Avada.exe
2092	AgA.exe
2092	AgA.exe
4840	Search.exe
4840	Search.exe
4168	Sub32
4168	Sub32

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	y45msk06kr09wbkc.exe
Token: SeDebugPrivilege	712	zs47uanj4zka6fqe.exe
Token: SeDebugPrivilege	2356	Search.exe
Token: SeDebugPrivilege	3240	Search.exe
Token: SeDebugPrivilege	1628	Searcher.exe
Token: SeIncBasePriorityPrivilege	2356	Search.exe
Token: SeDebugPrivilege	4280	Sub32
Token: SeDebugPrivilege	4952	Search.exe
Token: SeIncBasePriorityPrivilege	4280	Sub32
Token: SeDebugPrivilege	4832	powershell.exe
Token: 33	5820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5820	AUDIODG.EXE
Token: SeShutdownPrivilege	5296	WScript.exe
Token: SeCreatePagefilePrivilege	5296	WScript.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
572	Мухи.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
572	Мухи.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2160	4564	Soundpadcrack.exe	88
PID 4564 wrote to memory of 2232	4564	Soundpadcrack.exe	89
PID 4564 wrote to memory of 712	4564	Soundpadcrack.exe	90
PID 2232 wrote to memory of 4440	2232	y45msk06kr09wbkc.exe	93
PID 2232 wrote to memory of 4304	2232	y45msk06kr09wbkc.exe	94
PID 712 wrote to memory of 3080	712	zs47uanj4zka6fqe.exe	97
PID 712 wrote to memory of 2996	712	zs47uanj4zka6fqe.exe	98
PID 4304 wrote to memory of 2780	4304	cmd.exe	101
PID 2996 wrote to memory of 5720	2996	cmd.exe	102
PID 712 wrote to memory of 3136	712	zs47uanj4zka6fqe.exe	103
PID 2232 wrote to memory of 5304	2232	y45msk06kr09wbkc.exe	104
PID 5304 wrote to memory of 3732	5304	cmd.exe	107
PID 3136 wrote to memory of 508	3136	cmd.exe	108
PID 712 wrote to memory of 2356	712	zs47uanj4zka6fqe.exe	109
PID 2232 wrote to memory of 1832	2232	y45msk06kr09wbkc.exe	114
PID 1832 wrote to memory of 4572	1832	cmd.exe	116
PID 2232 wrote to memory of 2428	2232	y45msk06kr09wbkc.exe	117
PID 2428 wrote to memory of 936	2428	cmd.exe	119
PID 4280 wrote to memory of 4996	4280	Sub32	123
PID 4996 wrote to memory of 2448	4996	cmd.exe	125
PID 4280 wrote to memory of 4712	4280	Sub32	126
PID 4712 wrote to memory of 4832	4712	cmd.exe	128
PID 4832 wrote to memory of 1012	4832	powershell.exe	129
PID 1012 wrote to memory of 572	1012	tmp3C6E.tmp.exe	130
PID 4280 wrote to memory of 2776	4280	Sub32	131
PID 2776 wrote to memory of 2280	2776	cmd.exe	133
PID 1012 wrote to memory of 3724	1012	tmp3C6E.tmp.exe	134
PID 1012 wrote to memory of 1400	1012	tmp3C6E.tmp.exe	135
PID 1012 wrote to memory of 5948	1012	tmp3C6E.tmp.exe	137
PID 1012 wrote to memory of 2092	1012	tmp3C6E.tmp.exe	138
PID 1012 wrote to memory of 1512	1012	tmp3C6E.tmp.exe	139
PID 1012 wrote to memory of 1076	1012	tmp3C6E.tmp.exe	140
PID 1512 wrote to memory of 3792	1512	УбратьМух.exe	141
PID 1012 wrote to memory of 1424	1012	tmp3C6E.tmp.exe	143
PID 1076 wrote to memory of 5296	1076	казино фулл.exe	144
PID 1012 wrote to memory of 1904	1012	tmp3C6E.tmp.exe	145
PID 1012 wrote to memory of 1884	1012	tmp3C6E.tmp.exe	146

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	WScript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Soundpadcrack.exe
"C:\Users\Admin\AppData\Local\Temp\Soundpadcrack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\Soundpad.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\Soundpad.exe"
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\y45msk06kr09wbkc.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\y45msk06kr09wbkc.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="bQC+*"^d*Ck@*Y" dir=in action=allow program="C:\Windows\Sub32" enable=yes & exit
    3⤵
    PID:4440
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub32" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub32" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub32" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub32" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4572
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:936
- C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\zs47uanj4zka6fqe.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\zs47uanj4zka6fqe.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="A>[7zy9Nz["%zW" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Search.exe" enable=yes & exit
    3⤵
    PID:3080
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Users\Admin\AppData\Roaming\Search.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Users\Admin\AppData\Roaming\Search.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5720
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Searcher.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Searcher.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:508
- - C:\Users\Admin\AppData\Roaming\Search.exe
    "C:\Users\Admin\AppData\Roaming\Search.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2356

C:\Users\Admin\AppData\Roaming\Search.exe
C:\Users\Admin\AppData\Roaming\Search.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Users\Admin\AppData\Local\Searcher.exe
C:\Users\Admin\AppData\Local\Searcher.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\Sub32
"C:\Windows\Sub32"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp3C6E.tmp.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp3C6E.tmp.exe"'
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\tmp3C6E.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp3C6E.tmp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Мухи.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Мухи.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:572
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\BALDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\BALDI.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Glitcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Glitcher.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Avada.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Avada.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\AgA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\AgA.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\УбратьМух.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\УбратьМух.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Курсор - писюн.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Курсор - писюн.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\казино фулл.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\казино фулл.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1076
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\loll.VBS"
        6⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\copycursor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\copycursor.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\clickstart.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\clickstart.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\headache.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\headache.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1884
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2280
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST & exit
  2⤵
  PID:5612
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Program Files\Staem" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2488

C:\Users\Admin\AppData\Roaming\Search.exe
"C:\Users\Admin\AppData\Roaming\Search.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D4
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5820

C:\Users\Admin\AppData\Roaming\Search.exe
"C:\Users\Admin\AppData\Roaming\Search.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4840

C:\Windows\Sub32
"C:\Windows\Sub32"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xui2.cur

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\xui2.cur
Size 4KB
SHA256 de7c8bd93cc576d719805835099ae0f2cb88d797fe71585e2f7eb56b67a8fb72
MD5 c1fd2feb9e2b56be00082dd06c2b9658
SHA1 6e9272d5d53272f901ebb75ea556e250d4fc54aa
SHA512 7530ad40f0adc93d5166b2b4741ba66bc5792ca1882be658b86b290feaa3ccf08f15ef0d55cc40494c6f3fedb78ecc5dab2a5342e0bdc85a068a3a0ffdc6e79a
SSDEEP 24:DeoFGmUIE7rhudgnvG256A+4Fu86wtBR/lFKJXi07QtfsrbjRnK6I6yK:CoF2nhRnvG25r+41BRlu0tfs/jlK6I3K
TLSH
T1D6919B36F642F91AD1C83E7226143FDB04CE8EE161154742CAF5393E2DEA30695ED2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Курсор - писюн.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Курсор - писюн.exe
Size 5KB
SHA256 e60353b37f785c77e1063ac44cba792e9ec69f27b1dc9f3b719280d5ce015cc0
MD5 17b935ed6066732a76bed69867702e4b
SHA1 23f28e3374f9d0e03d45843b28468aace138e71c
SHA512 774ea047cdc5f008df03ad67242df04d630bb962bc99f1ea8974a21baf6a902c7a5d8b8d09d9e5c7d7e46b0378c7baf33bf80fb3e34777cd0958b8fc740d0318
SSDEEP 96:2AY3+z86Wt3VGEwMO54w802Sug8kiBzNt:FYe86WGhMO54w81jJD
TLSH
T134C10A29C3C80A76DD720F325A7743025378E1968E6FAFAEB79401572D2D3145E233E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

joy.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\joy.mp3
Size 569KB
SHA256 eeb1b825d658d2a44372cc27f1434e1eff80a356ae1d5c3b372bac5228c24dac
MD5 654a579acd8d90ac373b6ac7e9048824
SHA1 d3132daa82cd7d78dec91ea3ad6844264d663aec
SHA512 b348403369eabecfe354941ee276a005176b3885128f06825b7f5e410b72ee6d004a13614a96b07c6c4ca344c7f08923568c7bf1419774e08412444d414c2709
SSDEEP 12288:2gNj57InoFvBaM4YLTzp8r+t8WMfaslUYtnobM9:1Nj53FvX4YLpf8nlbJob6
TLSH
T1FEC4F1050B060885A189AF3D008FD2B9B8126F5D6CADFCD8671D73692DBFDA07B7591C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loll.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\loll.VBS
Size 116B
SHA256 342c7537fe0f452156691c1c4ff4e30819371e842e4845cdfda15ce6d0388977
MD5 2bb020e635a47af273b5b3169d40f308
SHA1 2b8bc32861b61b2bf7858f0f2f44b88dd66ab70a
SHA512 fad3f32ab0b4a8040b92b1b511177a997c9c038593af3d9c8eb70dd727cede4fed8ee24877d6c3ef3df89ef3e8448df8c3f338419c69f83765e0a5d085bd62bd
TLSH
T18AB0922AD86AD8AB8054982B79B3DAD956E0F472A6429A0B9208E84E20242488D58C97
MD5 SHA1 SHA512 TLSH

Submit Download

AgA.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\AgA.exe
Size 31KB
SHA256 f903df41dca1b26dc46ae2853e33fc3b50d0759dbd41e12710eb428b38c9d736
MD5 6197fa3e6736ed4b313eba2366eed535
SHA1 ee7aa68908e7e1411282a32b5c1ef854842ef1eb
SHA512 13eaea92ca4f5177e2db0ab5f63d9dd4d099e8e74c86eb1cebe21191dc0c54ed822b60c514c4e187a82aa40d9b5ea3bf406309c0cd106642edbc5134e0607622
SSDEEP 384:OfeHXdx3yg89LItprN1pHzRjSlDCmuokwlwAorKNwj3gZaFjnsMMQy7dW4+gLVm1:z3dZAhkzhSlDChaOsMC44hQ88LPCc55
TLSH
T102E2C01D17DAC3F9F87E1AB545B3D70047F5DA4684A3C32D9AE8325A1EA33494AA3313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Avada.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Avada.exe
Size 862KB
SHA256 f66c5e729c9d511e2249c1da94e0347516874a748982d055181119c39b836c99
MD5 d46f30d50dd99eb0f59779c1f6dcb52a
SHA1 bd059cea2ab84d1037f295e7ae7acc91040e2f51
SHA512 e6a4cf3cb3c3751618d539a6f6454afda222a8e8c72cca4484c8db0c4aa93751f4e46499879c5333e42d89390e65026ad20205cee4cbb095466d2312b1f452a7
SSDEEP 12288:kuYCljnUgMHYk0qZJsm5V3kKnvCQhhqr4N4+Mjr3nGcXLL3rvu0pv7o+YgNW:7Vpa45qg7KdhhS4NJMjTtru0pTob
TLSH
T1A31529D2F5419E40C81A5F394673EFB54337AD26FF4B9B563084BA067E732C26A216C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BALDI.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\BALDI.exe
Size 5.6MB
SHA256 0091be76fcfaadfb4d45f22ce3cb5189fd919ee89cfb901c9eed7f6a6aa61c6a
MD5 8235f398b63cb2b0926edf528a56ad35
SHA1 668ff71112d6bf289b70659d063d524481c19b0f
SHA512 51cf7794ea120ebaad6d53b2722f35e57b1d28b5365e53a74d945f45d180d6a5bfe3b27f963485c53079103947e552c88631485ba49a160a4b09c9afd4a66674
SSDEEP 98304:3rd/2Kf8MIhWIcn1111DIgzO9QeMfXTjig8nuluLlKUORY+6Mrv:3rR2KfBIc1j1J8sfXvpQlHfE
TLSH
T1C456BFD2E0439E50CE974E3A8E63AD6007727C2AFE5A591A3088BE1575F33C27631797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Glitcher.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Glitcher.exe
Size 13KB
SHA256 20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c
MD5 e7304abaea601b10c1fd25f73643b8b2
SHA1 d6310b99c1f7819071f1a6e24e06c3178ebc3f0b
SHA512 969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c
SSDEEP 384:EjS2lwe8kMXfQodHHHHHHHHHHHHHBEfGFbq9mWE2Cp:EjSI5qHHHHHHHHHHHHHBE62E
TLSH
T14B52F61AE7A8DB33C1BE4B796CA782501778E51C4505EF9A2CEC50CFEA7B70042817A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clickstart.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\clickstart.exe
Size 193KB
SHA256 a733adb4faf937b7d0327834b38f1a693b7605a3b755b62419d6c86120245c7f
MD5 a20f370b94af1ea9a9a5187d49400f90
SHA1 4a1b96e4f4806ff6fc71dfe8b199700c285ca018
SHA512 7d3c4b002c4b3ae8afbbe1d8d741260cb1173efc91d1d0d532231b058c1c439e3f0bd9c3f17cc111f44c9c8042e5fac436b48681730867166941d50935408c6f
SSDEEP 3072:yllIvv4HjQy+gl2eglZ+yPXm85XCOpGfTCFdGfuLgXPNHWHo8fQwqRNZKtkDIz:ywvv4p+glPuZ+yPiOiuFdGfKIozqFD
TLSH
T1AA14124B639A0FE3F0C467F16ADDC76E8360E571986F97279B40D01ECC668D19E08693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

copycursor.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\copycursor.exe
Size 148KB
SHA256 bf9e05a7cbb43af19b7edbacf6d34169059da305af61dd1caf85dd8320550058
MD5 0784695e388001223c2676ed1d0c7654
SHA1 2c785889ded4aae1752415f9dcef88ca9918ce9b
SHA512 e929096ace85c174f750c7c92c61064777d039ce4c8a1744f62ef66864eafc91b787032e40f73117dc6548292868cbf9f225d23db4f6243ece67e20910e81781
SSDEEP 3072:lo94+BqlPpWQKfmhZj0kQEGgofuNXyIek8Ely8HFu81yHl/VtzZ:+e+M+rC7Q/fudbQUlFxY
TLSH
T169E3128DEBA9C6D1F0D56CB5CE1F8ABB4703FD8FA458D50970A192AF3C41982CE60D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

headache.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\headache.exe
Size 115KB
SHA256 ccdab9996202e3f192c67c1d1d720a5f9b1de063193f5c52eaf97d669a8e6e32
MD5 be76d75db792b7e1c44205aeef5c39a2
SHA1 2da0da5cc1dbf277e15d64bc18edf93fb2b161c3
SHA512 d9a1c8d96ab43818add9f51e0c4cc3a4dabcd00059eed3e477bfa2ac398399a21fe6a0714c783c6ac4ac843a383af3cc9912fe1d7df03853db6cfeab10ac0945
SSDEEP 3072:puHRAWe7M9hasmo4OfwDWxZsIWUuPrEl5OSTGrqgo5wm0TF/:puHR9EMffmn8kWzu46STGrqp5wFTN
TLSH
T111C30290CF34CAA4D253C0B688494E7D67E1FDB9D5118B970AF298187E35449AF83BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Мухи.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\Мухи.exe
Size 1.0MB
SHA256 75cca561fd994676c8925dc592a324739c15e834deae2e0c26cd09519c2f84d7
MD5 ae250258012727720a7be047f3a551bb
SHA1 a605d60d81c6002c8a67c8770c6a7133a281359c
SHA512 9c3e2e449270a74be1af746752946c77dcdff677f4d38767f4eac65b292dca18d5e6935e2c134e625d762af7dd7e3a35ba01ade3c34cc9ae1c66e28d6506ad62
SSDEEP 24576:vZkZJy+iI3gfqF27I5jkDcERwVnBB1dG7:hkRQiGGlERwVnBBHG7
TLSH
T14125C012F3D05833D1A25A395CAF927A9C36BE406E58F48A7EDD5C0C8F353A139292D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

УбратьМух.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\УбратьМух.exe
Size 317KB
SHA256 507895a5170319193ced89311753529812a26b344213d44c92a988e3b4c99c06
MD5 00e82a1db301ab77338b0a4863e2e1ad
SHA1 7a4a23a285eb1c4ef1b39124ff125eb095c73bc4
SHA512 745c1f07f194c48938a77c3879b05eec566f8a1a15a75099e31782faeea087a4c488ef3693de08f66735f464784b22b3c14ff0ac85284e412c35e4e0741ce8ef
SSDEEP 3072:/nWSR+jounK7NAKDjiBmKbOUEuQvS/bcwWE2wup3vMRU6RLvHEd9VhMCyqKbv83G:+TouKrWBEu3/Z2lpGDHU3ykJyT+tjs/n
TLSH
T18364CF03BDC1D8B2C46208335B696B61B57DBE202F658EDBA3D42E1DE9311D0E7317A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

казино фулл.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_59881f65\казино фулл.exe
Size 861KB
SHA256 bc030c9e3417ccc5e0974dc1b907615d731a9e5129298d0969828d22142b5fb2
MD5 6c054b9c32ac3fae8d3f3dd324295156
SHA1 3f8deda274d16b872dc4d38dd0b2ef03132651fa
SHA512 35faaf7a76f00e2081dc296e3534b0cbcefbb4629b5e1365d71b1674eb22b6a8fdb379f7b8c733c061d3cc0565c2c997f0d3426ef014fb00cbe755a5d368d1a2
SSDEEP 24576:mtH5sAdXEIFsnv3EMv7aXiBKtF3rq5f5dFdCuSxhkAJ:gdyvUZiotFbq/VC5k+
TLSH
T18B150203B6C489B2C52314331A659F11B67DBD301F358ED793D4296EE9321E0AB36BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp3C6E.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3C6E.tmp.exe
Size 9.2MB
SHA256 bf75a6109eee863a98e266b0d988f0f799b43c9dcbc07958423ab7f2b08a8aa4
MD5 6b6cecce6fec31b225dffd8d6ae734c1
SHA1 49da5c6a7bb87788a54239979e7f9352b700acae
SHA512 8b3effde071cfef4b3adc54ee5ee1498f2e7192d19a9d2331ffbd51b26dea9ddff499305f67dac463b1b3db37bcbbfaf0020efe463cf04f2e8007bcb2eb57aa5
SSDEEP 196608:yHmgErR2KfBIc1j1J8sfXvpQlHfEB0qbvUnpQS+i:yHGEKpIc9v8B1xqjMKM
TLSH
T167A6CFD2F1429D21CA970E3A4D63AE6107367C25FE5A9A1B31C4BE0969B33C276317D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Soundpad.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\Soundpad.exe
Size 10.9MB
SHA256 ed3371229647ef876b45cb5940e48b461df58d4e68ad4932f5877eba90c8d379
MD5 0ae4f60d72e0d1c159505500b8a08ebb
SHA1 bb352dafd3c3ebebb4414b799010fe5ebddbef44
SHA512 88495911df544a04a4e09828ae10b57d3d945c41d6e28964c2d4d077afa43fec1c82a8ff6dcce57a3c7b9e5d02d1e47f800f557b022866f5f7be4a2db9b07536
SSDEEP 196608:fDRlger67uOemwy1LR/XU3gmsRM0wWM+wC89ooEvu:UerSwAVE3XsRMiJpsf
TLSH
T176B68C1A76A655ECE073C1788E978543EBF3B4850B3557FB0062095E1F3BAE48E3E612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y45msk06kr09wbkc.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\y45msk06kr09wbkc.exe
Size 703KB
SHA256 1fc332799a79390653c9390f37d57144f2c271ad268a411a27a38decf6e27a7b
MD5 a1db44d133102313518cec4a5d4a3e1a
SHA1 181f70ea9fc61f5d98888ec2e35e383afc8af8af
SHA512 34416a8d2587d9b1f3f682e126351ee698fefca156238b47c3140418b3cbf12929a21f1c3b75eb5a3c9100af14f27b8d1dd592c13f7de89071a8fdce923e774b
SSDEEP 6144:iwPbT3Pq/Mg+94R2OgQtqM0HNIKppaXK4K7i/WL5yT3b7I8i4mmCyaMSJ3VROPLK:isT3PmDB1BVoWRStfD4DE3vbe9g6A
TLSH
T100E4B4257B959E01E540163E82BE2A18D73264F32313AB47370AF7615D44AFEED2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zs47uanj4zka6fqe.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\2ffa1cf4\zs47uanj4zka6fqe.exe
Size 550KB
SHA256 b40e19ad12a679b558f01492911f82537e37de45db65eae7f15fa505ae13f73d
MD5 b6c1202dde1c4c7ff4f85d2e07621f78
SHA1 61522386fa3f6beede51849460db54b10d169df5
SHA512 8f6f5ec673703623ecbe3fc154f2ab0502b499fd2acd25bf2b2adca3732d1e645943dbdca7ab80ed188d9ef76f326d8aac3eda04bb1b12c5cd1a298258c964f4
SSDEEP 12288:1jZu2BuZaztVeP0R5sXDnsUs+FEqKJznlj:jJZFADnds+FEqKJl
TLSH
T1EEC44C143F998608E5912A7E425E1A01C7EE91F21632B303371AFF611D899DEDE2D3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-323-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/572-342-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/572-348-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/572-351-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/572-356-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/712-20-0x0000012092A50000-0x0000012092ADE000-memory.dmp

Download

memory/1012-205-0x0000000000B90000-0x00000000014D2000-memory.dmp

Download

memory/1400-242-0x00000000007F0000-0x00000000007FA000-memory.dmp

Download

memory/1424-344-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1424-339-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1424-349-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1424-353-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1884-341-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1884-347-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1904-340-0x0000000000400000-0x0000000000489000-memory.dmp

Download

memory/2092-261-0x0000000000210000-0x000000000021E000-memory.dmp

Download

memory/2232-157-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/2232-21-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/2232-192-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/2232-16-0x0000024A71EF0000-0x0000024A71FA2000-memory.dmp

Download

memory/3724-237-0x0000000000780000-0x0000000000D28000-memory.dmp

Download

memory/3792-318-0x0000000000340000-0x0000000000348000-memory.dmp

Download

memory/4280-232-0x00000177DB2C0000-0x00000177DB346000-memory.dmp

Download

memory/4280-357-0x00000177DAA80000-0x00000177DAA8E000-memory.dmp

Download

memory/4280-194-0x00000177DA820000-0x00000177DA82C000-memory.dmp

Download

memory/4280-193-0x00000177C1B90000-0x00000177C1C5A000-memory.dmp

Download

memory/4564-11-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/4564-2-0x0000000000320000-0x0000000000FAC000-memory.dmp

Download

memory/4564-1-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/4564-3-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/4564-5-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/4564-0-0x00007FFA77F9F000-0x00007FFA77FA0000-memory.dmp

Download

memory/4564-22-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/4564-6-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/4564-7-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp

Download

memory/4832-200-0x000001D1EFF00000-0x000001D1EFF22000-memory.dmp

Download

memory/5296-335-0x0000000005F30000-0x0000000005F40000-memory.dmp

Download

memory/5296-334-0x0000000005F30000-0x0000000005F40000-memory.dmp

Download

memory/5296-338-0x0000000005F30000-0x0000000005F40000-memory.dmp

Download

memory/5296-332-0x0000000005F30000-0x0000000005F40000-memory.dmp

Download

memory/5296-337-0x0000000005F30000-0x0000000005F40000-memory.dmp

Download

memory/5296-333-0x0000000005F30000-0x0000000005F40000-memory.dmp

Download

memory/5948-256-0x0000000000BE0000-0x0000000000CC0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads