Resubmissions
10/09/2026, 12:55
260910-p5775atepd310/09/2026, 12:54
260910-p5p2jstepb710/09/2026, 12:51
260910-p3q6tstemb7Analysis
- max time kernel
27s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 12:51
General
- Target 2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 5.4MB
- Sample260910-p3q6tstemb
- SHA256 28c708c285006d7661dc48594e70524e8dc37cba0f9dabbb48d0e52405403a3b
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 38 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 38 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 19 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Looks up external IP address via web service 1 TTPs 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 60 IoCs
- Detects Pyinstaller 1 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
- Views/modifies file attributes 1 TTPs 59 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nas9xegf\x3esxh92.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nas9xegf\x3esxh92.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nas9xegf\x3esxh92.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nas9xegf\x3esxh92.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nas9xegf\x3esxh92.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nas9xegf\x3esxh92.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19dkjd8l\ym905ih7.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19dkjd8l\ym905ih7.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19dkjd8l\ym905ih7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19dkjd8l\ym905ih7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19dkjd8l\ym905ih7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19dkjd8l\ym905ih7.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n55xxik0\lmfmalf8.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n55xxik0\lmfmalf8.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n55xxik0\lmfmalf8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n55xxik0\lmfmalf8.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n55xxik0\lmfmalf8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n55xxik0\lmfmalf8.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqc8gpgp\d7gocngz.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqc8gpgp\d7gocngz.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqc8gpgp\d7gocngz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqc8gpgp\d7gocngz.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqc8gpgp\d7gocngz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqc8gpgp\d7gocngz.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3smqg0f\jof7ico3.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3smqg0f\jof7ico3.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3smqg0f\jof7ico3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3smqg0f\jof7ico3.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3smqg0f\jof7ico3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i3smqg0f\jof7ico3.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtr5eqdq\bua85yc0.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtr5eqdq\bua85yc0.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtr5eqdq\bua85yc0.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtr5eqdq\bua85yc0.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtr5eqdq\bua85yc0.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtr5eqdq\bua85yc0.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7qje7rf9\8hqi7wxx.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7qje7rf9\8hqi7wxx.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7qje7rf9\8hqi7wxx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7qje7rf9\8hqi7wxx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7qje7rf9\8hqi7wxx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7qje7rf9\8hqi7wxx.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5y9ja4e\0y3bv26a.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5y9ja4e\0y3bv26a.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5y9ja4e\0y3bv26a.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5y9ja4e\0y3bv26a.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5y9ja4e\0y3bv26a.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h5y9ja4e\0y3bv26a.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cepenc0\n6mgklbe.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cepenc0\n6mgklbe.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cepenc0\n6mgklbe.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cepenc0\n6mgklbe.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cepenc0\n6mgklbe.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cepenc0\n6mgklbe.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4xaj9xtd\ak85w4w1.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4xaj9xtd\ak85w4w1.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4xaj9xtd\ak85w4w1.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4xaj9xtd\ak85w4w1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4xaj9xtd\ak85w4w1.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4xaj9xtd\ak85w4w1.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03ik8zub\4r0b2xw3.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03ik8zub\4r0b2xw3.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03ik8zub\4r0b2xw3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03ik8zub\4r0b2xw3.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03ik8zub\4r0b2xw3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03ik8zub\4r0b2xw3.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yoqud2xl\tyrg2wde.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yoqud2xl\tyrg2wde.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yoqud2xl\tyrg2wde.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yoqud2xl\tyrg2wde.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yoqud2xl\tyrg2wde.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yoqud2xl\tyrg2wde.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxs4vji6\mbfssjil.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxs4vji6\mbfssjil.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxs4vji6\mbfssjil.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxs4vji6\mbfssjil.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxs4vji6\mbfssjil.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxs4vji6\mbfssjil.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ugidjyp\5k07vl3a.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ugidjyp\5k07vl3a.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ugidjyp\5k07vl3a.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ugidjyp\5k07vl3a.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ugidjyp\5k07vl3a.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ugidjyp\5k07vl3a.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pxgfdc5\f0diwxud.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pxgfdc5\f0diwxud.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pxgfdc5\f0diwxud.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pxgfdc5\f0diwxud.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pxgfdc5\f0diwxud.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2pxgfdc5\f0diwxud.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\75355f7n\hbf47lwe.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\75355f7n\hbf47lwe.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\75355f7n\hbf47lwe.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\75355f7n\hbf47lwe.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\75355f7n\hbf47lwe.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\75355f7n\hbf47lwe.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qai3rmy3\vzsbsbmp.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qai3rmy3\vzsbsbmp.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qai3rmy3\vzsbsbmp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qai3rmy3\vzsbsbmp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qai3rmy3\vzsbsbmp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qai3rmy3\vzsbsbmp.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1vnm5br\9p8a7gem.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1vnm5br\9p8a7gem.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1vnm5br\9p8a7gem.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1vnm5br\9p8a7gem.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1vnm5br\9p8a7gem.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1vnm5br\9p8a7gem.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ft03pfyg\0ixcxjxa.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ft03pfyg\0ixcxjxa.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ft03pfyg\0ixcxjxa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ft03pfyg\0ixcxjxa.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ft03pfyg\0ixcxjxa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ft03pfyg\0ixcxjxa.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mkrrfc07\72ihtff8.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mkrrfc07\72ihtff8.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mkrrfc07\72ihtff8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mkrrfc07\72ihtff8.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mkrrfc07\72ihtff8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mkrrfc07\72ihtff8.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ngmgorts\h95v6ejx.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ngmgorts\h95v6ejx.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ngmgorts\h95v6ejx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ngmgorts\h95v6ejx.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ngmgorts\h95v6ejx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ngmgorts\h95v6ejx.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h059iajc\pmh70gl7.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h059iajc\pmh70gl7.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h059iajc\pmh70gl7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h059iajc\pmh70gl7.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h059iajc\pmh70gl7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h059iajc\pmh70gl7.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bzan9cad\lv2put0j.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bzan9cad\lv2put0j.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bzan9cad\lv2put0j.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bzan9cad\lv2put0j.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bzan9cad\lv2put0j.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bzan9cad\lv2put0j.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\veq6mqfb\qafsohdb.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\veq6mqfb\qafsohdb.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\veq6mqfb\qafsohdb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\veq6mqfb\qafsohdb.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\veq6mqfb\qafsohdb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\veq6mqfb\qafsohdb.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i6btpnex\l62lp4ae.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i6btpnex\l62lp4ae.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i6btpnex\l62lp4ae.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i6btpnex\l62lp4ae.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i6btpnex\l62lp4ae.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i6btpnex\l62lp4ae.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgpg0fr8\esx77bym.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgpg0fr8\esx77bym.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgpg0fr8\esx77bym.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgpg0fr8\esx77bym.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgpg0fr8\esx77bym.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgpg0fr8\esx77bym.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb2ymx29\i4dyj3z6.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb2ymx29\i4dyj3z6.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb2ymx29\i4dyj3z6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb2ymx29\i4dyj3z6.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb2ymx29\i4dyj3z6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb2ymx29\i4dyj3z6.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ie39gtuo\ykp0k66n.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ie39gtuo\ykp0k66n.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ie39gtuo\ykp0k66n.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ie39gtuo\ykp0k66n.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ie39gtuo\ykp0k66n.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ie39gtuo\ykp0k66n.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp06ulsp\i8081iz1.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp06ulsp\i8081iz1.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp06ulsp\i8081iz1.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp06ulsp\i8081iz1.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp06ulsp\i8081iz1.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hp06ulsp\i8081iz1.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yucrjm4t\zl544qe3.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yucrjm4t\zl544qe3.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yucrjm4t\zl544qe3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yucrjm4t\zl544qe3.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yucrjm4t\zl544qe3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yucrjm4t\zl544qe3.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ba2ank0z\qjiv6hip.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ba2ank0z\qjiv6hip.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ba2ank0z\qjiv6hip.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ba2ank0z\qjiv6hip.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ba2ank0z\qjiv6hip.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ba2ank0z\qjiv6hip.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nl5g63hl\x1suxc06.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nl5g63hl\x1suxc06.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nl5g63hl\x1suxc06.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nl5g63hl\x1suxc06.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nl5g63hl\x1suxc06.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nl5g63hl\x1suxc06.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\usvwkora\xjg0nb15.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\usvwkora\xjg0nb15.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\usvwkora\xjg0nb15.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\usvwkora\xjg0nb15.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\usvwkora\xjg0nb15.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\usvwkora\xjg0nb15.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co3vhe26\zf1cgj9g.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co3vhe26\zf1cgj9g.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co3vhe26\zf1cgj9g.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co3vhe26\zf1cgj9g.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co3vhe26\zf1cgj9g.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co3vhe26\zf1cgj9g.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jo0ht868\gdvlrq96.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jo0ht868\gdvlrq96.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jo0ht868\gdvlrq96.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jo0ht868\gdvlrq96.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jo0ht868\gdvlrq96.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jo0ht868\gdvlrq96.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\01c3ij4y\lnmjy7o7.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\01c3ij4y\lnmjy7o7.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\01c3ij4y\lnmjy7o7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\01c3ij4y\lnmjy7o7.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\01c3ij4y\lnmjy7o7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\01c3ij4y\lnmjy7o7.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsv23zwn\2xppa1ma.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsv23zwn\2xppa1ma.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsv23zwn\2xppa1ma.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsv23zwn\2xppa1ma.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsv23zwn\2xppa1ma.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nsv23zwn\2xppa1ma.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jb34khr7\qp4x72d3.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jb34khr7\qp4x72d3.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jb34khr7\qp4x72d3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jb34khr7\qp4x72d3.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jb34khr7\qp4x72d3.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jb34khr7\qp4x72d3.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f7rpkwd9\1k0s4jdh.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f7rpkwd9\1k0s4jdh.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f7rpkwd9\1k0s4jdh.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f7rpkwd9\1k0s4jdh.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f7rpkwd9\1k0s4jdh.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f7rpkwd9\1k0s4jdh.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f38kdswp\naq7swzv.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f38kdswp\naq7swzv.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f38kdswp\naq7swzv.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f38kdswp\naq7swzv.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f38kdswp\naq7swzv.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f38kdswp\naq7swzv.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7z0epauk\hevp1qz7.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7z0epauk\hevp1qz7.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7z0epauk\hevp1qz7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7z0epauk\hevp1qz7.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7z0epauk\hevp1qz7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7z0epauk\hevp1qz7.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppqwvl66\1e7ob9pt.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppqwvl66\1e7ob9pt.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppqwvl66\1e7ob9pt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppqwvl66\1e7ob9pt.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppqwvl66\1e7ob9pt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppqwvl66\1e7ob9pt.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2xy01pwv\zi9qcb27.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2xy01pwv\zi9qcb27.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2xy01pwv\zi9qcb27.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2xy01pwv\zi9qcb27.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2xy01pwv\zi9qcb27.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2xy01pwv\zi9qcb27.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5j0ueztd\4peaissa.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5j0ueztd\4peaissa.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5j0ueztd\4peaissa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5j0ueztd\4peaissa.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5j0ueztd\4peaissa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5j0ueztd\4peaissa.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k3sywzmt\f3djabxk.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k3sywzmt\f3djabxk.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k3sywzmt\f3djabxk.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k3sywzmt\f3djabxk.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k3sywzmt\f3djabxk.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k3sywzmt\f3djabxk.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49hftorr\8myuez8b.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49hftorr\8myuez8b.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49hftorr\8myuez8b.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49hftorr\8myuez8b.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49hftorr\8myuez8b.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49hftorr\8myuez8b.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smpgmazr\f4ej62xu.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smpgmazr\f4ej62xu.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smpgmazr\f4ej62xu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smpgmazr\f4ej62xu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smpgmazr\f4ej62xu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smpgmazr\f4ej62xu.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l38oq10b\cvye3qjt.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l38oq10b\cvye3qjt.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l38oq10b\cvye3qjt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l38oq10b\cvye3qjt.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l38oq10b\cvye3qjt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l38oq10b\cvye3qjt.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1i3z0289\owi4t9ms.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1i3z0289\owi4t9ms.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1i3z0289\owi4t9ms.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1i3z0289\owi4t9ms.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1i3z0289\owi4t9ms.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1i3z0289\owi4t9ms.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4hzeva0\lfvbvo3d.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4hzeva0\lfvbvo3d.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4hzeva0\lfvbvo3d.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4hzeva0\lfvbvo3d.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4hzeva0\lfvbvo3d.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4hzeva0\lfvbvo3d.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hkcfik21\yowk8wvk.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hkcfik21\yowk8wvk.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hkcfik21\yowk8wvk.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hkcfik21\yowk8wvk.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hkcfik21\yowk8wvk.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hkcfik21\yowk8wvk.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\klgv23w5\g9ul6efv.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\klgv23w5\g9ul6efv.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\klgv23w5\g9ul6efv.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\klgv23w5\g9ul6efv.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\klgv23w5\g9ul6efv.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\klgv23w5\g9ul6efv.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fkec531l\7tmizl6x.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fkec531l\7tmizl6x.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fkec531l\7tmizl6x.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fkec531l\7tmizl6x.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fkec531l\7tmizl6x.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fkec531l\7tmizl6x.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmizy0ee\mh7ftvv1.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmizy0ee\mh7ftvv1.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmizy0ee\mh7ftvv1.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmizy0ee\mh7ftvv1.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmizy0ee\mh7ftvv1.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gmizy0ee\mh7ftvv1.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bverwy6w\qe6cawql.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bverwy6w\qe6cawql.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bverwy6w\qe6cawql.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bverwy6w\qe6cawql.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bverwy6w\qe6cawql.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bverwy6w\qe6cawql.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ak0e5rpu\dacfyhqr.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ak0e5rpu\dacfyhqr.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ak0e5rpu\dacfyhqr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ak0e5rpu\dacfyhqr.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ak0e5rpu\dacfyhqr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ak0e5rpu\dacfyhqr.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fpexxmwt\mlf76cyo.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fpexxmwt\mlf76cyo.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fpexxmwt\mlf76cyo.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fpexxmwt\mlf76cyo.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fpexxmwt\mlf76cyo.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fpexxmwt\mlf76cyo.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wyih86d\m1tvr464.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wyih86d\m1tvr464.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wyih86d\m1tvr464.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wyih86d\m1tvr464.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wyih86d\m1tvr464.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7wyih86d\m1tvr464.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27075uiy\c6l1s6bb.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27075uiy\c6l1s6bb.exe"4⤵
- Views/modifies file attributes
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27075uiy\c6l1s6bb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27075uiy\c6l1s6bb.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27075uiy\c6l1s6bb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\27075uiy\c6l1s6bb.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7efnksbq\dehrdgrc.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
README_DECRYPT.txt
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libssl-1_1.dll
python39.dll
select.pyd
unicodedata.pyd
x3esxh92.exe
TestRepair.doc.enc
UnregisterInstall.xlsx.enc
CloseGet.ods.enc
MergeAdd.xlsx.enc
ClearRedo.txt.enc
ExpandOut.png.enc
ProtectMount.7z.enc
ReadSkip.odp.enc
StopRegister.pptx.enc
ConvertRevoke.jpg.enc
FindComplete.jpg.enc
NewExit.jpg.enc
TestCompare.png.enc
memory/3568-442-0x00000212CC390000-0x00000212CC4A4000-memory.dmp
memory/4412-404-0x000001B606380000-0x000001B60642D000-memory.dmp