Resubmissions
29/07/2026, 09:27
260729-le461adl4y1025/07/2026, 16:39
260725-t563aaag871008/11/2025, 17:35
251108-v5363acv5d1002/11/2025, 23:51
251102-3wgwgadl7x1001/11/2025, 12:53
251101-p4t9wasnhm1001/11/2025, 12:49
251101-p2d5wasnhj1001/11/2025, 04:57
251101-fk849a1ncn1031/10/2025, 18:11
251031-wspnksak2v10Analysis
- max time kernel
20s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/07/2026, 16:39
General
- Target Synaptics.exe
- Size 764KB
- Sample260725-t563aaag87
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
44caliber
-
https://discord.com/api/webhooks/1146486791835230260/bE9QI2eAT_dyqn0dm7VljbMDjUklfKOXxq3ua0HOtKeG6TIgizThvorpCYQf2NEkabwH
Extracted
-
phorphiex
-
http://178.16.54.109
Extracted
-
njrat
-
im523
-
TrupAshot
-
documents-elegant.at.ply.gg:54835
-
4a87b5397a2736773782f50e108b2da4
-
reg_key
4a87b5397a2736773782f50e108b2da4
-
splitter
|'|'|
Extracted
-
C:\Windows\SysWOW64\Files\!Please Read Me!.txt
-
wannacry
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1309109349976772669/btEqlDM2ocrsuktKkKj31Gmh1CdwZzJyC0Kemkugf6P7NQd4BBhHTJ1dF0IUeMDACNjF
Extracted
-
needle_stealer
-
http://130.12.180.135:3000/api/v2
-
api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
-
base_extension
false
-
self_destruct
false
Extracted
-
phorphiex
-
http://178.16.55.240/nmixx/
-
gaegaegeg
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36
Extracted
-
xworm
-
5.0
-
police-turkish.gl.at.ply.gg:46359
-
98LKJ8osZWR75pSw
-
install_file
USB.exe
Extracted
-
blackmatter
-
25.239
Extracted
-
njrat
-
v2.0
-
Crash
-
late-lil.at.ply.gg:35022
-
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
- Family: 44Caliber
An open source infostealer written in C#.
- Family: BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
- Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Family: RustMe Keylogger
RustMe is a keylogger written in C++.
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Family: Wannacry
WannaCry is a ransomware cryptoworm.
- Family: Xred
Xred is backdoor written in Delphi.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Detect Xworm Payload 1 IoCs
- Detects NeedleStealer payload 1 IoCs
- Detects RustMe Keylogger 1 IoCs
- Detects Umbral payload 4 IoCs
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Downloads MZ/PE file 24 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Signed with revoked ConnectWise certificate 8 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 14 IoCs
- Loads dropped DLL 52 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 9 IoCs
- Enumerates processes with tasklist 1 TTPs 24 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 30 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 7 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show interfaces5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fnmojthzfg.exe"C:\Users\Admin\AppData\Local\Temp\fnmojthzfg.exe" "C:\Users\Admin\AppData\Local\Temp\elgojdcrjp.exe" "C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\kbcqrrzeqj.exeC:\Users\Admin\AppData\Local\Temp\kbcqrrzeqj.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\cmd.exe/c sc config msdtc obj= LocalSystem5⤵
-
C:\Windows\system32\sc.exesc config msdtc obj= LocalSystem6⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VtEgDwVK.bat"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\bindsvc.exe"C:\Windows\System32\bindsvc.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\f4681ebe237d1f51f641774ff4c44c61fcf278a1.exe"C:\Users\Admin\AppData\Local\Temp\Files\f4681ebe237d1f51f641774ff4c44c61fcf278a1.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\64.exe"C:\Users\Admin\AppData\Local\Temp\Files\64.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ChatLife.exe"C:\Users\Admin\AppData\Local\Temp\Files\ChatLife.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Confirmed Confirmed.cmd & Confirmed.cmd4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\8ab80aa4601ecd91b16725d92046a7f1b106aa7e.exe"C:\Users\Admin\AppData\Local\Temp\Files\8ab80aa4601ecd91b16725d92046a7f1b106aa7e.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe"C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"C:\Users\Admin\AppData\Local\Temp\Files\compiled.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\cummersMG.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\uac_bypass.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\haozip_v6.5.2.11245.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\c19193f9b8ebf07bda15b04ed86a41cdf826d083.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\QuizPokemon.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\pdf.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\e1e914bc687acd6a66a0dd937bbb012d661b0487.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\MDClient.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\be9d27849c4c302b4dfe65b2709988e0c352896f.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\qcoin133.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\EagleJetClient4.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\UNP%20Setup.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\q-AMD64-Windows.exe"3⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\XW_Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\XW_Setup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tlp.exe"C:\Users\Admin\AppData\Local\Temp\Files\tlp.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\update.exe"C:\Users\Admin\AppData\Local\Temp\Files\update.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\380a00f40fd3f56d9d7005182b19891841f10002.exe"C:\Users\Admin\AppData\Local\Temp\Files\380a00f40fd3f56d9d7005182b19891841f10002.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hack.exe"C:\Users\Admin\AppData\Local\Temp\Files\hack.exe"4⤵
-
C:\windows\system32\mspaint.exeC:\windows\system32\mspaint.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\crypted_c360a5b7.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\9ff8f73f6e5f0b09659251f57d9de6cf0231353d.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\nmixx.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\DragonBalls76Ace.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\164a5ecd2b08a29e453600d9378a941e0ee939a8.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\hailhydra.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\640.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\Meredrop.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\builder.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\pvp.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\Files\39d5a541cdab7baa1778a3fcd6998770cb233524.exe"4⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Files\bypass.exe"C:\Windows\System32\Files\bypass.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\444.exe"C:\Windows\System32\Files\444.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE5⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\SysWOW64\Files\WannaCry.exe"C:\Windows\System32\Files\WannaCry.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 228171784997627.bat4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe f4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe c4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe v5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete7⤵
-
-
-
-
-
C:\Windows\SysWOW64\Files\!WannaDecryptor!.exe!WannaDecryptor!.exe4⤵
-
-
-
C:\Windows\SysWOW64\Files\XClient.exe"C:\Windows\System32\Files\XClient.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\downloader.exe"C:\Windows\System32\Files\downloader.exe"3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D58B.tmp\D5BB.tmp\D5BC.bat C:\Windows\SysWOW64\Files\downloader.exe"4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\SysWOW64\Files\ScreenConnect.ClientSetup.exe"C:\Windows\System32\Files\ScreenConnect.ClientSetup.exe"3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\cae7115510449f18\ScreenConnect.ClientSetup.msi"4⤵
-
-
-
C:\Windows\SysWOW64\Files\FreeYoutubeDownloader.exe"C:\Windows\System32\Files\FreeYoutubeDownloader.exe"3⤵
-
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\donut.exe"C:\Windows\System32\Files\donut.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\pkexU0YtxaR3.exe"C:\Windows\System32\Files\pkexU0YtxaR3.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\319f1b3495cd02507644bc7598f6566db3e8e7ee.exe"C:\Windows\System32\Files\319f1b3495cd02507644bc7598f6566db3e8e7ee.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\support.client.exe"C:\Windows\System32\Files\support.client.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Apps\2.0\12K9G2J7.WKD\Z8NTK3JE.3YB\scre..tion_25b0fbb6ef7eb094_0019.0002_35005e76b9539001\ScreenConnect.WindowsClient.exe"5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\payload.exe"C:\Windows\System32\Files\payload.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\self-injection.exe"C:\Windows\System32\Files\self-injection.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\grab.exe"C:\Windows\System32\Files\grab.exe"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T4⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\Files\860178f2aa5d45f012531f67045c42264f1986c8.exe"C:\Windows\System32\Files\860178f2aa5d45f012531f67045c42264f1986c8.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\Axam.a.exe"C:\Windows\System32\Files\Axam.a.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\gallery-dl.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\sound.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\TianSys(XP%E4%B8%93%E7%94%A8).exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\bnoaprihjatuasss.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\1488.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\svchost.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\foobar2000_v1.6.7_beta_17@1704_129472.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\LicenseMalwareBytes.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\2832dfd71d903d0ed74679a360a7295eaecaa7d4.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\app.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\LOIC.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\NanoCore_Portable.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\EagleJetClient4.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\kikikmoralibrary.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\383ce1a249b3e89fe79521c81cee9325118eb49f.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\52b9bbb9026165e0593c1791e9e7c3babdde55fd.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\online.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\Files\Update.exe"3⤵
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 7842⤵
-
-
C:\Windows\SysWOW64\Files\WannaCry.exe"C:\Windows\SysWOW64\Files\WannaCry.exe" /r1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6CF128987CE81911E697EA5A6D53017D C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF400.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240710984 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E474449E24A61FBC6E0FF729C410BAB52⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe" ..1⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exeC:\Users\Admin\AppData\Roaming\Axam.exe1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1File Deletion
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
!WannaDecryptor!.exe.lnk
Autoexec.bat
e596a98.rbs
Synaptics.exe
Process.txt
Process.txt
Process.txt
scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
ScreenConnect.ClientService.exe
ScreenConnect.WindowsClient.exe:Zone.Identifier
860178f2aa5d45f012531f67045c42264f1986c8.exe.log
._cache_Synaptics.exe
5D885E00
8rFnDT7I.xlsm
Confirmed.cmd
ScreenConnect.Client.dll
ScreenConnect.Client.dll.genman
ScreenConnect.ClientService.dll
ScreenConnect.ClientService.dll.genman
ScreenConnect.Core.dll
ScreenConnect.Core.dll.genman
ScreenConnect.Windows.dll
ScreenConnect.Windows.dll.genman
ScreenConnect.WindowsBackstageShell.exe
ScreenConnect.WindowsClient.exe
ScreenConnect.WindowsClient.exe.config
ScreenConnect.WindowsClient.exe.genman
ScreenConnect.WindowsClient.exe.manifest
ScreenConnect.WindowsFileManager.exe
VQ26NBWK.7TE.application
02.08.2022.exe
64.exe
640.exe
CFXBypass.exe
ChatLife.exe
CryptoWall.exe
DragonBalls76Ace.exe
Fast%20Download.exe
MDClient.exe
Meredrop.exe
Petya.A.exe
PrivacyPolicy.exe
QuizPokemon.exe
RedLineStealer.exe
RustMeDebyg.exe
TempSpoofer.exe
UNP%20Setup.exe
Vector-fixer-v1.4.2.exe
XClient.exe
XW_Setup.exe
builder.exe
cabal.exe
cabal.exe
cards_db
cards_db
compiled.exe
cookie_db
crypted_c360a5b7.exe
cummersMG.exe
downloads_db
downloads_db
f4681ebe237d1f51f641774ff4c44c61fcf278a1.exe
hack.exe
hailhydra.exe
haozip_v6.5.2.11245.exe
login_db
login_db
nmixx.exe
pdf.exe
pkexU0YtxaR3.exe
pvp.exe
q-AMD64-Windows.exe
qcoin133.exe
qt51crk.exe
support.client.exe
svchost.exe
tlp.exe
uac_bypass.exe
update.exe
MSVCP140.dll
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp39-win32.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_zoneinfo.pyd
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
top_level.txt
pyexpat.pyd
python3.dll
python39.dll
pythoncom39.dll
pywintypes39.dll
select.pyd
sqlite3.dll
unicodedata.pyd
win32api.pyd
fnmojthzfg.exe
y2a3u0p0.xfs.hrz
trnmg.sdb
Free YouTube Downloader.exe
e596a99.msi
!Please Read Me!.txt
1488.exe
444.exe
Axam.a.exe
Client-built.exe
EagleJetClient4.exe
FreeYoutubeDownloader.exe
LOIC.exe
LicenseMalwareBytes.exe
NanoCore_Portable.exe
ScreenConnect.ClientSetup.exe
TianSys(XP%E4%B8%93%E7%94%A8).exe
Update.exe
WannaCry.exe
app.exe
bnoaprihjatuasss.exe
bypass.exe
donut.exe
downloader.exe
foobar2000_v1.6.7_beta_17@1704_129472.exe
gallery-dl.exe
grab.exe
kikikmoralibrary.exe
online.exe
payload.exe
self-injection.exe
sound.exe
support.client.exe
svchost.exe
u.wry
memory/224-596-0x0000000002F70000-0x0000000002FE6000-memory.dmp
memory/224-602-0x00000000058D0000-0x00000000059C8000-memory.dmp
memory/224-603-0x0000000005B30000-0x0000000005B96000-memory.dmp
memory/564-3354-0x0000000000400000-0x0000000000411000-memory.dmp
memory/704-2072-0x0000000000400000-0x000000000043C000-memory.dmp
memory/808-525-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1084-604-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1084-3910-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1084-448-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1084-1357-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1084-783-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1084-131-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1084-3802-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1084-3095-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1320-3880-0x00007FFC17250000-0x00007FFC180FA000-memory.dmp
memory/1320-3760-0x00007FFC17250000-0x00007FFC180FA000-memory.dmp
memory/1540-133-0x0000000005300000-0x000000000539C000-memory.dmp
memory/1540-132-0x0000000000B10000-0x0000000000B18000-memory.dmp
memory/1784-965-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/1784-1371-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/1784-971-0x000000006FB10000-0x000000006FB20000-memory.dmp
memory/1944-1008-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1944-1850-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2392-623-0x000001F5F46E0000-0x000001F5F472A000-memory.dmp
memory/2468-3301-0x00007FFC0D030000-0x00007FFC0D040000-memory.dmp
memory/2468-3307-0x00007FFC0D030000-0x00007FFC0D040000-memory.dmp
memory/2504-535-0x00000000004A0000-0x000000000061A000-memory.dmp
memory/2504-773-0x00000000004A0000-0x000000000061A000-memory.dmp
memory/2776-611-0x0000000005F80000-0x0000000005F8E000-memory.dmp
memory/2776-606-0x0000000007A50000-0x0000000007A58000-memory.dmp
memory/2776-601-0x0000000000070000-0x00000000007DE000-memory.dmp
memory/2776-610-0x0000000005FB0000-0x0000000005FE8000-memory.dmp
memory/2824-642-0x0000017C2BDB0000-0x0000017C2BDB8000-memory.dmp
memory/2824-568-0x0000017C2A720000-0x0000017C2A728000-memory.dmp
memory/2824-536-0x0000017C22130000-0x0000017C22140000-memory.dmp
memory/2824-552-0x0000017C22360000-0x0000017C22370000-memory.dmp
memory/3056-128-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3056-0-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/3056-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/3200-3814-0x0000000000400000-0x000000000040C000-memory.dmp
memory/3200-3157-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/3200-3733-0x0000000000400000-0x000000000040C000-memory.dmp
memory/3540-3929-0x00007FFC17250000-0x00007FFC180FA000-memory.dmp
memory/3540-3823-0x00007FFC17250000-0x00007FFC180FA000-memory.dmp
memory/3556-3112-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/3556-3177-0x0000000000400000-0x00000000004EC000-memory.dmp
memory/3620-4190-0x0000000000400000-0x000000000040C000-memory.dmp
memory/4284-375-0x00000158D7930000-0x00000158D793C000-memory.dmp
memory/4284-1875-0x00007FFC20920000-0x00007FFC217CA000-memory.dmp
memory/4284-788-0x00007FFC20920000-0x00007FFC217CA000-memory.dmp
memory/4308-4173-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4055-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4177-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4170-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4175-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4054-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4178-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4179-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4172-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4056-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4180-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4059-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4058-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4176-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4057-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4171-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4068-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4070-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4069-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4184-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4182-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4067-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4066-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4065-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4064-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4063-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4174-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4181-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4062-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4061-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4308-4183-0x00000274F1C00000-0x00000274F1C10000-memory.dmp
memory/4428-189-0x00007FFC0F210000-0x00007FFC0F220000-memory.dmp
memory/4428-202-0x00007FFC0D030000-0x00007FFC0D040000-memory.dmp
memory/4428-186-0x00007FFC0F210000-0x00007FFC0F220000-memory.dmp
memory/4428-188-0x00007FFC0F210000-0x00007FFC0F220000-memory.dmp
memory/4428-187-0x00007FFC0F210000-0x00007FFC0F220000-memory.dmp
memory/4428-190-0x00007FFC0F210000-0x00007FFC0F220000-memory.dmp
memory/4428-191-0x00007FFC0D030000-0x00007FFC0D040000-memory.dmp
memory/4572-4160-0x0000000000400000-0x000000000040C000-memory.dmp
memory/4600-1257-0x0000000005430000-0x00000000055DC000-memory.dmp
memory/4600-1315-0x0000000005ED0000-0x0000000006474000-memory.dmp
memory/4600-1223-0x0000000001350000-0x0000000001358000-memory.dmp
memory/4600-1256-0x00000000052D0000-0x00000000052F2000-memory.dmp
memory/4600-1225-0x00000000053A0000-0x000000000542C000-memory.dmp
memory/4600-1224-0x0000000005630000-0x0000000005922000-memory.dmp
memory/4860-3686-0x0000000000400000-0x000000000040C000-memory.dmp
memory/4928-922-0x0000000010000000-0x0000000010012000-memory.dmp
memory/4948-4209-0x0000000000400000-0x000000000040C000-memory.dmp
memory/4992-201-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/5032-607-0x0000000000400000-0x00000000005E5000-memory.dmp
memory/5216-3758-0x00007FFC17250000-0x00007FFC180FA000-memory.dmp
memory/5216-3377-0x00007FFC17250000-0x00007FFC180FA000-memory.dmp
memory/5300-3779-0x00007FFC17250000-0x00007FFC180FA000-memory.dmp
memory/5428-3286-0x0000000000400000-0x000000000040C000-memory.dmp
memory/5428-3187-0x0000000000400000-0x000000000040C000-memory.dmp
memory/5624-1199-0x00000000005E0000-0x00000000005F0000-memory.dmp
memory/5624-2142-0x000001E8CA9F0000-0x000001E8CAA1E000-memory.dmp
memory/6044-1379-0x0000000000400000-0x00000000005E5000-memory.dmp
memory/6272-4123-0x0000000000400000-0x000000000040C000-memory.dmp
memory/6332-3387-0x00000196225E0000-0x00000196225F8000-memory.dmp
memory/6332-3365-0x0000019624940000-0x00000196249CC000-memory.dmp
memory/6332-3139-0x00000196214C0000-0x0000019621646000-memory.dmp
memory/6332-3396-0x0000019624C10000-0x0000019624DBC000-memory.dmp
memory/6332-3357-0x0000019624950000-0x00000196249E8000-memory.dmp
memory/6332-3379-0x00000196248B0000-0x00000196248E6000-memory.dmp
memory/6332-3133-0x0000019606EB0000-0x0000019606EB8000-memory.dmp
memory/6332-3193-0x0000019622860000-0x00000196228B0000-memory.dmp
memory/6544-3141-0x000001A0742A0000-0x000001A0742EC000-memory.dmp
memory/6864-4086-0x0000000000400000-0x000000000040C000-memory.dmp
memory/6908-2626-0x00000000032B0000-0x00000000032BA000-memory.dmp
memory/6908-2642-0x0000000005930000-0x0000000005ADC000-memory.dmp
memory/6908-2631-0x00000000056F0000-0x000000000577C000-memory.dmp
memory/6908-2624-0x00000000032C0000-0x00000000032EE000-memory.dmp
memory/6928-4077-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7080-3819-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7212-3351-0x000001C7699B0000-0x000001C7699B1000-memory.dmp
memory/7284-4015-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7340-3309-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7364-3655-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7460-3318-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7480-4187-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7528-3332-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7536-3812-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7540-3732-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7580-4036-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7632-3898-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7664-3341-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7692-3688-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7756-4037-0x0000000000400000-0x000000000040C000-memory.dmp
memory/7868-3353-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8000-4166-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8012-3360-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8096-3371-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8120-3372-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8324-4072-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8416-4107-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8436-4114-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8468-4129-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8532-4146-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8608-3918-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8668-3926-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8708-4168-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8776-3937-0x0000000000400000-0x000000000040C000-memory.dmp
memory/8988-3950-0x0000000000400000-0x000000000040C000-memory.dmp
memory/9040-3787-0x0000000000400000-0x000000000040C000-memory.dmp
memory/9048-3789-0x0000000000400000-0x000000000040C000-memory.dmp
memory/9048-3687-0x0000000000400000-0x000000000040C000-memory.dmp
memory/9104-3962-0x0000000000400000-0x000000000040C000-memory.dmp
memory/9208-3919-0x0000000000400000-0x000000000040C000-memory.dmp
memory/9208-3997-0x0000000000400000-0x000000000040C000-memory.dmp