dracula_stealer | e66638929161dc2b7f43722bf03c49ccd9f8693dbc321dc18776c142f458f416

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeltaCrack.exe
Size 21.9MB
Sample260703-ecg55aa18w
SHA256 e66638929161dc2b7f43722bf03c49ccd9f8693dbc321dc18776c142f458f416
MD5 26d6e158aa3ca35087b4e4c0fd0f5e3d
SHA1 fb9f04efd112d634ec4eb3f21119e0e6286e952d
SHA512 4ca002d0393055b540f3ecea1f8a2e248505855800eb4d04413b49e3d923130956ebd59ad8d9298ff95f0f741b37ac85780c5d1b075b835bada20587afbb1338
SSDEEP 393216:RYm0X8j1kDLeQ1NMG5E/OqYbR/9uQ7gnOUWWVAnv142QLHZbISqnr/x6kZ:Rbdxkm6NMG5EWlbVUQ7MfWvnv1QL2S23
TLSH
T1DD3733092F91CAC4E0415BFD545B0914CB9BA9E266F2E303371AFB21DC468ADDE2C7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet rat collection discovery execution dracula_stealer sheetrat persistence privilege_escalation pyinstaller spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.4

Campaign

Sheet Rat

tcp.cloudpub.ru:58137

Signatures

Family: Dracula, Samurai
Dracula aka Samurai is a stealer written in C#.
stealer dracula_stealer
Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Dracula aka Samurai Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/5740-2574-0x00000000032A0000-0x00000000032CA000-memory.dmp	family_dracula_stealer

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x0004000000016cf4-1069.dat	family_sheetrat_v4
behavioral2/memory/4524-1161-0x0000000000A30000-0x0000000000A94000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\Defender.exe"	rr113mo5a4oz6ifa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdMicrosoft Visual Studio.exe"	DeltaCrack.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\Defender.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\Defender.exe"	Defender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\Defender.exe"	Defender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdMicrosoft Visual Studio.exe"	xdwdMicrosoft Visual Studio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\Defender.exe"	Defender.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
32	1352	Defender.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rr113mo5a4oz6ifa.exe	nurik.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nurik.exe	DeltaCrack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeltaCrack.exe	DeltaCrack.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CollapseLoader_1.2.1_x64-setup.exe	nurik.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rr113mo5a4oz6ifa.exe	nurik.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nurik.exe	DeltaCrack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeltaCrack.exe	DeltaCrack.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CollapseLoader_1.2.1_x64-setup.exe	nurik.exe

Executes dropped EXE 21 IoCs

pid	Process
2856	nurik.exe
2708	CollapseLoader_1.2.1_x64-setup.exe
3104	rr113mo5a4oz6ifa.exe
4272	DeltaCrack.exe
5056	nurik.exe
5536	CollapseLoader_1.2.1_x64-setup.exe
3624	TgWsProxy_windows_7_64bit.exe
2740	rr113mo5a4oz6ifa.exe
1616	DeltaCrack.exe
4524	DeltaCrack.exe
5628	TgWsProxy_windows_7_64bit.exe
3412	TgWsProxy_windows_7_64bit.exe
832	MalwareDef.exe
1996	Defender.exe
5740	Defender.exe
4480	TgWsProxy_windows_7_64bit.exe
1352	Defender.exe
924	xdwdMicrosoft Cortana.exe
3924	xdwdMicrosoft Visual Studio.exe
1564	Defender.exe
3340	Defender.exe

Loads dropped DLL 64 IoCs

pid	Process
2708	CollapseLoader_1.2.1_x64-setup.exe
2708	CollapseLoader_1.2.1_x64-setup.exe
5536	CollapseLoader_1.2.1_x64-setup.exe
5536	CollapseLoader_1.2.1_x64-setup.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
4480	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
5628	TgWsProxy_windows_7_64bit.exe
3640	Process not Found
5732	Process not Found
5536	CollapseLoader_1.2.1_x64-setup.exe
5536	CollapseLoader_1.2.1_x64-setup.exe
5536	CollapseLoader_1.2.1_x64-setup.exe
5536	CollapseLoader_1.2.1_x64-setup.exe
1592	Process not Found
2708	CollapseLoader_1.2.1_x64-setup.exe
2708	CollapseLoader_1.2.1_x64-setup.exe
2708	CollapseLoader_1.2.1_x64-setup.exe
2708	CollapseLoader_1.2.1_x64-setup.exe
2876	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker.exe = "C:\\Users\\Admin\\Music\\xdwdMicrosoft Cortana.exe"	DeltaCrack.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	raw.githubusercontent.com

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
25	api.ipify.org
27	api.ipify.org
30	api.ipify.org
32	api.ipify.org
74	api.ipify.org
1	api.ipify.org
1	icanhazip.com
3	api.ipify.org
53	api.ipify.org

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Defender.exe	rr113mo5a4oz6ifa.exe
File opened for modification	C:\Windows\System32\Defender.exe	MalwareDef.exe
File opened for modification	C:\Windows\System32\Defender.exe	Defender.exe
File opened for modification	C:\Windows\System32\Defender.exe	Defender.exe
File opened for modification	C:\Windows\System32\Defender.exe	Defender.exe
File created	C:\Windows\System32\Defender.exe	rr113mo5a4oz6ifa.exe
File opened for modification	C:\Windows\System32\Defender.exe	rr113mo5a4oz6ifa.exe
File opened for modification	C:\Windows\System32\Defender.exe	Defender.exe
File opened for modification	C:\Windows\System32\Defender.exe	Defender.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Web\MalwareDef.exe	Defender.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	Defender.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	rr113mo5a4oz6ifa.exe
File created	C:\Windows\xdwd.dll	DeltaCrack.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	Defender.exe
File created	C:\Windows\Web\MalwareDef.exe	rr113mo5a4oz6ifa.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	rr113mo5a4oz6ifa.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	Defender.exe
File opened for modification	C:\Windows\Web\MalwareDef.exe	Defender.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c514-76.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CollapseLoader_1.2.1_x64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CollapseLoader_1.2.1_x64-setup.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3932	cmd.exe
5840	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Defender.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Defender.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader	CollapseLoader_1.2.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader\URL Protocol	CollapseLoader_1.2.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\CollapseLoader\\collapseloader.exe\",0"	CollapseLoader_1.2.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader\shell\open\command	CollapseLoader_1.2.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader\shell	CollapseLoader_1.2.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\CollapseLoader\\collapseloader.exe\" \"%1\""	CollapseLoader_1.2.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader\ = "URL:org.collapseloader protocol"	CollapseLoader_1.2.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader\DefaultIcon	CollapseLoader_1.2.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\collapseloader\shell\open	CollapseLoader_1.2.1_x64-setup.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
980	schtasks.exe
4128	schtasks.exe
4000	schtasks.exe
3232	schtasks.exe
5440	schtasks.exe
4460	schtasks.exe
5776	schtasks.exe
2252	schtasks.exe
2444	schtasks.exe
3032	schtasks.exe
1564	schtasks.exe
5964	schtasks.exe
1552	schtasks.exe
4792	schtasks.exe
2724	schtasks.exe
5360	schtasks.exe
3216	schtasks.exe
200	schtasks.exe
1996	schtasks.exe
1560	schtasks.exe
1908	schtasks.exe
1924	schtasks.exe
4492	schtasks.exe
2736	schtasks.exe
1228	schtasks.exe
6056	schtasks.exe
5020	schtasks.exe
2576	schtasks.exe
420	schtasks.exe
3232	schtasks.exe
3632	schtasks.exe
4924	schtasks.exe
1380	schtasks.exe
4604	schtasks.exe
1164	schtasks.exe
2604	schtasks.exe
1360	schtasks.exe
1928	schtasks.exe
4712	schtasks.exe
2056	schtasks.exe
1232	schtasks.exe
6108	schtasks.exe
4640	schtasks.exe
3008	schtasks.exe
764	schtasks.exe
2140	schtasks.exe
2612	schtasks.exe
5464	schtasks.exe
4744	schtasks.exe
2108	schtasks.exe
5880	schtasks.exe
572	schtasks.exe
5620	schtasks.exe
2620	schtasks.exe
4756	schtasks.exe
2480	schtasks.exe
2920	schtasks.exe
3416	schtasks.exe
4996	schtasks.exe
1256	schtasks.exe
1352	schtasks.exe
2404	schtasks.exe
2284	schtasks.exe
3900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4524	DeltaCrack.exe
4524	DeltaCrack.exe
5536	CollapseLoader_1.2.1_x64-setup.exe
5536	CollapseLoader_1.2.1_x64-setup.exe
2708	CollapseLoader_1.2.1_x64-setup.exe
2708	CollapseLoader_1.2.1_x64-setup.exe
1352	Defender.exe
1352	Defender.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
5740	Defender.exe
2564	findstr.exe
2564	findstr.exe
5840	netsh.exe
5840	netsh.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe
4524	DeltaCrack.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3104	rr113mo5a4oz6ifa.exe
Token: SeDebugPrivilege	2740	rr113mo5a4oz6ifa.exe
Token: SeDebugPrivilege	4524	DeltaCrack.exe
Token: SeDebugPrivilege	832	MalwareDef.exe
Token: SeDebugPrivilege	5740	Defender.exe
Token: SeDebugPrivilege	1996	Defender.exe
Token: SeDebugPrivilege	4480	TgWsProxy_windows_7_64bit.exe
Token: SeDebugPrivilege	5628	TgWsProxy_windows_7_64bit.exe
Token: SeDebugPrivilege	1352	Defender.exe
Token: SeIncBasePriorityPrivilege	5740	Defender.exe
Token: SeDebugPrivilege	924	xdwdMicrosoft Cortana.exe
Token: SeDebugPrivilege	3924	xdwdMicrosoft Visual Studio.exe
Token: SeDebugPrivilege	1564	Defender.exe
Token: SeDebugPrivilege	3340	Defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 2856	5280	DeltaCrack.exe	88
PID 2856 wrote to memory of 2708	2856	nurik.exe	89
PID 2856 wrote to memory of 3104	2856	nurik.exe	90
PID 5280 wrote to memory of 4272	5280	DeltaCrack.exe	91
PID 4272 wrote to memory of 3060	4272	DeltaCrack.exe	93
PID 3060 wrote to memory of 5056	3060	DeltaCrack.exe	94
PID 5056 wrote to memory of 5536	5056	nurik.exe	95
PID 4272 wrote to memory of 3624	4272	DeltaCrack.exe	96
PID 5056 wrote to memory of 2740	5056	nurik.exe	97
PID 3060 wrote to memory of 1616	3060	DeltaCrack.exe	98
PID 3104 wrote to memory of 3396	3104	rr113mo5a4oz6ifa.exe	100
PID 3104 wrote to memory of 4404	3104	rr113mo5a4oz6ifa.exe	101
PID 4404 wrote to memory of 2576	4404	cmd.exe	104
PID 1616 wrote to memory of 4524	1616	DeltaCrack.exe	105
PID 3104 wrote to memory of 4948	3104	rr113mo5a4oz6ifa.exe	106
PID 3624 wrote to memory of 5628	3624	TgWsProxy_windows_7_64bit.exe	109
PID 4948 wrote to memory of 3232	4948	cmd.exe	110
PID 1616 wrote to memory of 3412	1616	DeltaCrack.exe	111
PID 3104 wrote to memory of 1996	3104	rr113mo5a4oz6ifa.exe	115
PID 5628 wrote to memory of 4720	5628	TgWsProxy_windows_7_64bit.exe	116
PID 4524 wrote to memory of 5064	4524	DeltaCrack.exe	118
PID 5064 wrote to memory of 1360	5064	CMD.exe	120
PID 3412 wrote to memory of 4480	3412	TgWsProxy_windows_7_64bit.exe	121
PID 4480 wrote to memory of 592	4480	TgWsProxy_windows_7_64bit.exe	122
PID 4524 wrote to memory of 1168	4524	DeltaCrack.exe	124
PID 1168 wrote to memory of 4996	1168	CMD.exe	127
PID 4524 wrote to memory of 4600	4524	DeltaCrack.exe	128
PID 4524 wrote to memory of 424	4524	DeltaCrack.exe	131
PID 4524 wrote to memory of 4780	4524	DeltaCrack.exe	133
PID 2740 wrote to memory of 1352	2740	rr113mo5a4oz6ifa.exe	180
PID 4600 wrote to memory of 1552	4600	CMD.exe	136
PID 424 wrote to memory of 420	424	CMD.exe	137
PID 4780 wrote to memory of 4640	4780	CMD.exe	138
PID 4524 wrote to memory of 2784	4524	DeltaCrack.exe	141
PID 2784 wrote to memory of 4792	2784	CMD.exe	143
PID 5740 wrote to memory of 3932	5740	Defender.exe	144
PID 3932 wrote to memory of 1964	3932	cmd.exe	146
PID 3932 wrote to memory of 5840	3932	cmd.exe	147
PID 3932 wrote to memory of 2564	3932	cmd.exe	148
PID 4524 wrote to memory of 1748	4524	DeltaCrack.exe	149
PID 1748 wrote to memory of 5784	1748	CMD.exe	151
PID 4524 wrote to memory of 6100	4524	DeltaCrack.exe	152
PID 6100 wrote to memory of 1928	6100	CMD.exe	154
PID 4524 wrote to memory of 1408	4524	DeltaCrack.exe	155
PID 1408 wrote to memory of 1908	1408	CMD.exe	157
PID 4524 wrote to memory of 4416	4524	DeltaCrack.exe	159
PID 4416 wrote to memory of 5440	4416	CMD.exe	161
PID 924 wrote to memory of 3980	924	xdwdMicrosoft Cortana.exe	162
PID 3980 wrote to memory of 1256	3980	CMD.exe	164
PID 4524 wrote to memory of 384	4524	DeltaCrack.exe	165
PID 384 wrote to memory of 4460	384	CMD.exe	167
PID 4524 wrote to memory of 4732	4524	DeltaCrack.exe	168
PID 4732 wrote to memory of 2108	4732	CMD.exe	170
PID 4524 wrote to memory of 2640	4524	DeltaCrack.exe	171
PID 2640 wrote to memory of 3008	2640	CMD.exe	173
PID 4524 wrote to memory of 1388	4524	DeltaCrack.exe	174
PID 1388 wrote to memory of 3232	1388	CMD.exe	176
PID 924 wrote to memory of 3924	924	xdwdMicrosoft Cortana.exe	177
PID 4524 wrote to memory of 124	4524	DeltaCrack.exe	178
PID 124 wrote to memory of 1352	124	CMD.exe	180
PID 3924 wrote to memory of 5648	3924	xdwdMicrosoft Visual Studio.exe	181
PID 5648 wrote to memory of 3632	5648	CMD.exe	183
PID 3924 wrote to memory of 4560	3924	xdwdMicrosoft Visual Studio.exe	184
PID 4560 wrote to memory of 6056	4560	CMD.exe	186

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Defender.exe

C:\Users\Admin\AppData\Local\Temp\DeltaCrack.exe
"C:\Users\Admin\AppData\Local\Temp\DeltaCrack.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Users\Admin\AppData\Local\Temp\bnd_0346a518\nurik.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_0346a518\nurik.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\bnd_197003ff\CollapseLoader_1.2.1_x64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\bnd_197003ff\CollapseLoader_1.2.1_x64-setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\bnd_197003ff\rr113mo5a4oz6ifa.exe
    "C:\Users\Admin\AppData\Local\Temp\bnd_197003ff\rr113mo5a4oz6ifa.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" netsh advfirewall firewall add rule name="it{yfcGUf{FTf`" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit
      4⤵
      PID:3396
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2576
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3232
  - - C:\Windows\System32\Defender.exe
      "C:\Windows\System32\Defender.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:1996
- C:\Users\Admin\AppData\Local\Temp\bnd_0346a518\DeltaCrack.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_0346a518\DeltaCrack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Admin\AppData\Local\Temp\DeltaCrack.exe
    "C:\Users\Admin\AppData\Local\Temp\DeltaCrack.exe"
    3⤵
    - Drops startup file
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\bnd_110328de\nurik.exe
      "C:\Users\Admin\AppData\Local\Temp\bnd_110328de\nurik.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\bnd_384bc72d\CollapseLoader_1.2.1_x64-setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_384bc72d\CollapseLoader_1.2.1_x64-setup.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\bnd_384bc72d\rr113mo5a4oz6ifa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bnd_384bc72d\rr113mo5a4oz6ifa.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2740
      - C:\Windows\System32\Defender.exe
        
        "C:\Windows\System32\Defender.exe"
        6⤵
        Badlisted process makes network request
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\bnd_110328de\DeltaCrack.exe
      "C:\Users\Admin\AppData\Local\Temp\bnd_110328de\DeltaCrack.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\DeltaCrack.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DeltaCrack.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4524
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1360
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4996
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Citrix Receiver" /tr "C:\Users\Admin\Music\xdwdMicrosoft Cortana.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Citrix Receiver" /tr "C:\Users\Admin\Music\xdwdMicrosoft Cortana.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1552
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:424
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:420
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Citrix Receiver" /tr "C:\Users\Admin\Music\xdwdMicrosoft Cortana.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "Citrix Receiver" /tr "C:\Users\Admin\Music\xdwdMicrosoft Cortana.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4640
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4792
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        
        PID:5784
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:6100
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1928
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1908
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5440
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4460
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2108
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3008
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3232
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:124
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1352
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5136
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1924
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:6048
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:764
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1552
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        
        PID:420
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5792
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2604
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1484
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5020
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:4284
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:980
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:6044
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2444
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:4856
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4000
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:4256
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5880
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:3408
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:572
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1360
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        
        PID:4232
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:2924
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        
        PID:2540
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:544
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2140
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:3760
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2404
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:3380
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3032
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5160
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3216
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1212
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        
        PID:4128
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:5372
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2612
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:2052
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1564
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:264
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2284
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:2428
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1560
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:3632
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5964
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:4232
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2620
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1104
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6108
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:4704
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4756
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:1412
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4744
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:4620
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        
        PID:5788
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
        6⤵
        
        PID:6008
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:592
- - C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe
    "C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe
      "C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:4720

C:\Windows\Web\MalwareDef.exe
C:\Windows\Web\MalwareDef.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Windows\System32\Defender.exe
C:\Windows\System32\Defender.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5740
- C:\Windows\System32\cmd.exe
  "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\System32\chcp.com
    chcp 65001
    3⤵
    PID:1964
- - C:\Windows\System32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5840
- - C:\Windows\System32\findstr.exe
    findstr All
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2564

C:\Users\Admin\Music\xdwdMicrosoft Cortana.exe
"C:\Users\Admin\Music\xdwdMicrosoft Cortana.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1256
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3632
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6056
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:6128
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5776
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:3140
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2724
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:3640
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4712
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:3620
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4924
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:944
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1380
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:1948
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4128
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:1880
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4492
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:712
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2736
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:2028
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2480
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:4944
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4604
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:2684
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      PID:2032
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:1268
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2056
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:5820
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2252
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:5688
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      PID:5424
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:3164
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5360
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:4300
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      PID:2976
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:5072
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5620
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:4492
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:200
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:5032
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1996
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:2352
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3900
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:4252
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1164
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:3616
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1232
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:5596
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5464
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:3348
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2920
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:3320
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      PID:3036
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:1568
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      PID:4296
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:2404
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3416
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
    3⤵
    PID:4724
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Malwarebytes Update" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
      4⤵
      PID:2844

C:\Windows\System32\Defender.exe
"C:\Windows\System32\Defender.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\System32\Defender.exe
"C:\Windows\System32\Defender.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeltaCrack.exe

Path C:\Users\Admin\AppData\Local\Temp\DeltaCrack.exe
Size 373KB
SHA256 1724431a4b6dc06716775377cd35c9db1af9d2822c2dbe2cf99feaad134c31bf
MD5 c29fe15366f2a2e72cf5f595b075af99
SHA1 85211262c1abe7321014270a3c0393227cd0f9a1
SHA512 ac1034b738a4eb2dfb7f8f16deca61dd88254c5be0f95f20b02402fe2ebfd7824ce3cc53a0eed9d7e93c37d1d6d83451fe969a69f63c35774785e4c3d9da4531
SSDEEP 6144:TB8RKbnHnMltN2DwuWL33r209Cl7bEoCib8qzI+gURp:1lbnHMtH33GwIL
TLSH
T10F84D60CBE51F801CE6E3DB3CBE691611B7151C23E129216370A6EFA4B593B65DA31BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TgWsProxy_windows_7_64bit.exe

Path C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit.exe
Size 16.5MB
SHA256 1624e5bb840c6192fafe695de9db5713685917bfb3c197cb279d535b3caac03a
MD5 cf6c90e81192fdc822989438e6c6b640
SHA1 b234eddaca7ced15f948d6cb72c28313ffc18356
SHA512 b6acf3cc9d657f332082d6b6ebcca71e64e4b08c5ad8ede97428f1859f43a58373cfe33b9777ed4905d9522a4e9bc6129ee04ef7e2ab349abe5ed9cd8f5d3763
SSDEEP 393216:clLSssFVL7pUTLfhJiCEDjJ83a10RtN3ZWqaxks/0Ud7TtjfZ:yLSssFVBUTLJUCEDFEa6tN3PaxkU0+5Z
TLSH
T1E70733CACB521915FC33933EB9E6843AC49374FD8364A71B1D381593299B2B99D78F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\VCRUNTIME140.dll
Size 93KB
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
SSDEEP 1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
TLSH
T123937C4A7BA442BBD06AC178C1E34A16F771B844873053CF13B54AAA5F63BE05E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_bz2.pyd
Size 85KB
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae
SSDEEP 1536:eKpLuz7t0fjOUSKdvOKJbdV/qj1M9D8WAPpP3JuFIIMVRy7:VizTTmbJJV/qj1M6WAPpP3JuFIIMVI
TLSH
T1A6839E92F3A056F6F09BF27596614347E731B8094390D3BFA2A8424F2F02B917D6971E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_ctypes.pyd
Size 124KB
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09
SSDEEP 3072:psrzScwzPzuoUxXVxQXKIAqoFQufLTA/1mj9AItH5IIBPmQl:a//wWX8XKIABfLTcmXlyk
TLSH
T130C35B1B735800EAE6674178C5B35E0BDBB2B411072087CF0264C6AA2F637E67E7E745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_hashlib.pyd
Size 46KB
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd
SSDEEP 768:E0mbG0HUxzB7992zIyYsw3jYXjV4h6HgevWASdIIYIASDG4ybhMD:Tma00xVMn08x4EBvAdIIYIA2ymD
TLSH
T16B235B05A34104E2D87781B8E4A24F57DA71B5505311A3EF93A8C19E5FA37D333BAF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_lzma.pyd
Size 159KB
SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
MD5 cf9fd17b1706f3044a8f74f6d398d5f1
SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a
SSDEEP 3072:LIVa3V86CLON9lUm+/3i4p9qZqznfY9mNovvFOhYIlLvyFIID15x:LIVa3V81LwlC//q+gYOvPIBvy7
TLSH
T1A5F33996B390F4E6E7328C39D6624F17E7F578190320929A01CD836D2B1F7659A2E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_queue.pyd
Size 28KB
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c
SSDEEP 768:UbErqQu06rhuOUrRm4MH5IImUVDG4yaC97hP:wuqXhuOC84a5IImUfydL
TLSH
T19CD27C81A7A858D2E833C179A4E25E27ED71B9115321C3FF1228825D1F36783727BB6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_socket.pyd
Size 78KB
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a
SSDEEP 1536:OnzkyYf2r+ciQG5fF3/1NmaA189/s+7+pMXFxRjD3mh5IIBwlyin:Zy62r+P7VnfA189/se+pYxRPK5IIBw7
TLSH
T188735A02A7A051FAD677C07AC2638F23F770F4D41394A39F4564C95A1F23782AE7AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_ssl.pyd
Size 152KB
SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
MD5 d4dfd8c2894670e9f8d6302c09997300
SHA1 c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
SHA512 1422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048
SSDEEP 3072:PBgil+Nig7FXVxb/8lwiaibUixhk980VUuOazbAOXLkdWXxZIIkjVD6XFIIM7y:PBgi8iWXVxbI/Xhk9gazbRqo3
TLSH
T107E36C03F2441AF7D813E4BDC6634902E7A9F1052311979E85D6DA4A0F07B06BE6BF6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\base_library.zip
Size 1008KB
SHA256 d98f24433f56c21f108b91bc67f004151de666a164a5b7ecc19414fc1c7ec1d7
MD5 d07f6513e369e3665bd3163180c5834d
SHA1 bb3658eab8003c2e86c67944ef729c9bafa62832
SHA512 b28f25eb57311b5fab293cbf8271b4da8f8589a1e0ff7114d081bd3743762897d654c5dbad0aa1edbbcc7c3892878e894cc8b07114afb67e13c886f29805c664
SSDEEP 24576:dhidKrtosQNRs54PK4IMvVw59bfCEzX5nESWGR32K1:dhidKrtosQNRs54PK4IV9BnjWM71
TLSH
T1E42518407AB16ED7FD0AF3B9402A861C4A2A9339DB49D103794FC35C3F4A3E41E75A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\libcrypto-1_1.dll
Size 3.2MB
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668
SSDEEP 98304:ZX+SicVMcqx5q6ypQ821CPwDv3uFfJwwzS:1FicVMcqx5q6yX21CPwDv3uFfJwwz
TLSH
T1AEF58C5AA3AC1194E5BAC07CC9574727E3B1B85A87B05BCF08A681780F27BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\libssl-1_1.dll
Size 674KB
SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
MD5 50bcfb04328fec1a22c31c0e39286470
SHA1 3a1b78faf34125c7b8d684419fa715c367db3daa
SHA512 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685
SSDEEP 12288:XXnznrSRNaJkxbpdM2QJCCMHxtfz8Irj0R6wQHPRv8Fl4tekY2U2lvz:vSTxbpd/Rrj0R6nd+SJnU2lvz
TLSH
T192E43995ABB514A9E9E6C17C86534A37E376F4142330AFCF0661853D0F1BBC92B3A358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\pyexpat.pyd
Size 187KB
SHA256 5caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
MD5 2ae23047648257afa90d0ca96811979f
SHA1 0833cf7ccae477faa4656c74d593d0f59844cadd
SHA512 13052eb183bb7eb8bb2740ff39f63805b69e920f2e21b482657a9995aa002579a88296b81ec415942511d2ed146689d1868b446f7e698e72da22f5c182706030
SSDEEP 3072:s/aC72KSgM/ehOrwkSW8chDNcKNOxywSXaFUAKLnVzPOvNRyfIvfTZvZ3OFVnVvU:QaQX/UehaTSW8chOFTiLndkyfiTJ0VvU
TLSH
T172145B577155C0EAE9538038D696CE07DAB2B861070197CF12A4E7BDAF27B923E2C319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\python3.DLL
Size 58KB
SHA256 074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
MD5 c9f0b55fce50c904dff9276014cef6d8
SHA1 9f9ae27df619b695827a5af29414b592fc584e43
SHA512 8dd188003d8419a25de7fbb37b29a4bc57a6fd93f2d79b5327ad2897d4ae626d7427f4e6ac84463c158bcb18b6c1e02e83ed49f347389252477bbeeb864ac799
SSDEEP 768:bS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSxD0:M9xiEAnUvdy5IIB0/ya7
TLSH
T15D433D525BD4FCA3D6E625FF38D19D89F42912C08D15949CA8799293FE1A233AE3730C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python38.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\python38.dll
Size 4.0MB
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080
SSDEEP 49152:7szv0pyfz43jjWo2tAfHkhPAXCZT8nyhhA2i2hLX5CSwkINazHO+MJnjPabxTdOF:7P/kuARjoNYH5MJubFiH
TLSH
T1EE167B32A79401A4DAB79476C5138706CBF2FC513B20E34A91A4BAD52F73BA316EF705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\select.pyd
Size 27KB
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f
SSDEEP 384:T2XLk/FcA2CTeHkXvwhMMHqS5C6l1tPe0cEJXa5IImGPDG4y8iD0hS:T2qXIkXvwhRHqSRtmKq5IImGPDG4y+hS
TLSH
T131C27D87D75468D6EC73C171B8E18F17E932B6104325C3EF226882694F677C231BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeltaCrack.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_0346a518\DeltaCrack.exe
Size 16.4MB
SHA256 e3094f5ce47ba3bcc74503d8a85d63bce7c48c182b082eac5ce1677dd5663b6c
MD5 3799a73f7f3e20eddfe7033c513f8b2b
SHA1 77aff32b86c8e4288d11d6b070365c7b88ebbf1e
SHA512 6197d3a9e2dde584d0e20521a7f8235f2c54fd6900cd481336e666f35bc5e3b3ec7121c09aaffbc3fb6e9082ec372d4145aee373505b02455929fb239090863b
SSDEEP 393216:61NMG5E/OqYbR/9uQ7gnOUWWVAnv142QLHZbISqnr/x6kZ:sNMG5EWlbVUQ7MfWvnv1QL2S2FZ
TLSH
T14E0733CE49037D01F026EEB5385B08789E45B92AE6521347283EBFA275CB13C5E78DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nurik.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_0346a518\nurik.exe
Size 5.5MB
SHA256 154a4365050abcca9c6958cde8ccfb578a5d0641bf29bdb8af462b83add4f26a
MD5 8eaa05f89eb13df84b7806daefe12922
SHA1 938c59cbfd6516d585b5516b900683fcb5e9c874
SHA512 4e1b4ffc3b27481831cedb3ac6c79edff1db51df4e282612bf592a9cb1ae0d2c48720c0f7e61f7fa3435a4b94c62da5e945b89b43935ee4689ac8e97d1177caa
SSDEEP 98304:lYpgzChqMLL8UbTAa/rYUh+ONeOJS720+o11kkGIx78D3nWzcBLwEr:lYmGTwchFNG2g1kDL5cEr
TLSH
T1004612143BA5CAD4E0401BFD855A1504C7AB9AE226F2E303770AFB21DD458DEDE2D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CollapseLoader_1.2.1_x64-setup.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_197003ff\CollapseLoader_1.2.1_x64-setup.exe
Size 5.0MB
SHA256 78a4f444b66ac4c3cadd2df380ea0fb0f9a73d6d86859c7e14fa7f4fb2f09b77
MD5 5a1f34f71d9ab5fe901a1d9145c0e55e
SHA1 3a3ab68da48bc38515f9bcae8cf537e8cb98ea30
SHA512 e935d63400f48e95dc5bd2300ab202c6d7bf685ebc50c0f63188ee81234c7e0560e90b565f1e1d26a6866a2af12909e8c5b1ef27959f7cd03774351f80b5e62c
SSDEEP 98304:tYpgzChqMLL8UbTAa/rYUh+ONeOJS720+o11kkGIx78D3nWzcBLwErz:tYmGTwchFNG2g1kDL5cErz
TLSH
T1B936330968F7C762D52E4F74F97BB9C2C5581B527BFBC109D30AD90839A940B69BA3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rr113mo5a4oz6ifa.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_197003ff\rr113mo5a4oz6ifa.exe
Size 507KB
SHA256 b31ae1c8c25fc459941b403352a6d79b08f0f283b6a441089a40b35e17f981d6
MD5 a51ae89899aa42e009b4033edc563a29
SHA1 6f6e8bf5a8f2a14ed91a901c8b30ca566dd88498
SHA512 7f28d6bd5e7d860b0d3d468d4f31dc079fb57c4c81d790a166a5704c1afc14496462d862df60512d5a5fa858ca5bdae807ed69594c84562ad7e086f2f4919692
SSDEEP 6144:HNDJMvR7p4c5Ud3H8hk8RiCC54CFd8pxn+RTIWvtsWpzIn5/HGqfd47um2wn54Xn:tfcCEsR2wOXg1y9Nwtl
TLSH
T1C9B46F143B95CAC8E0801BFE455A1504DBAB99E166F2E303370AFB61CD059DDDE2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl2C19.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl2C19.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsm5FCC.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm5FCC.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-2674-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/924-2672-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/924-2658-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/1352-2539-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/1352-2605-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/1564-2677-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/2564-2604-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/2564-2576-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/2856-64-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/2856-19-0x0000000000780000-0x0000000000D00000-memory.dmp

Download

memory/2856-2210-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/3104-56-0x0000000000790000-0x0000000000814000-memory.dmp

Download

memory/3340-2678-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/3924-2673-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/3924-2675-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download

memory/4272-63-0x0000000000380000-0x00000000013EE000-memory.dmp

Download

memory/4524-1161-0x0000000000A30000-0x0000000000A94000-memory.dmp

Download

memory/5280-44-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/5280-1-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/5280-2-0x00000000008D0000-0x0000000001EB8000-memory.dmp

Download

memory/5280-4-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/5280-6-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/5280-11-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/5280-41-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/5280-0-0x00007FFD527AF000-0x00007FFD527B0000-memory.dmp

Download

memory/5280-53-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/5280-65-0x00007FFD52620000-0x00007FFD52FC4000-memory.dmp

Download

memory/5740-2574-0x00000000032A0000-0x00000000032CA000-memory.dmp

Download

memory/5740-2575-0x000000001CC60000-0x000000001CCB0000-memory.dmp

Download

memory/5840-2603-0x00007FFD4C0B0000-0x00007FFD4C0D2000-memory.dmp

Download