Overview

overview

7

Static

static

3

2026-09-10...om.exe

windows10-2004-x64

7

2026-09-10...om.exe

windows11-ltsc_2024-x64

7

Resubmissions

10/09/2026, 12:55

260910-p5775atepd3

10/09/2026, 12:54

260910-p5p2jstepb7

10/09/2026, 12:51

260910-p3q6tstemb7

Analysis

  • max time kernel
    29s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 12:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 5.4MB
  • Sample260910-p3q6tstemb
  • SHA256 28c708c285006d7661dc48594e70524e8dc37cba0f9dabbb48d0e52405403a3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationpyinstaller

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 44 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 44 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 22 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 40 IoCs
    defense_evasion
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 39 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6020
    • C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-10_9ef4c0108769f7cb92a906b6ebd70aa7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4768
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7b6kp8nn\l7m1z9o5.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7b6kp8nn\l7m1z9o5.exe"
          4⤵
          • Views/modifies file attributes
          PID:3620
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7b6kp8nn\l7m1z9o5.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7b6kp8nn\l7m1z9o5.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7b6kp8nn\l7m1z9o5.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7b6kp8nn\l7m1z9o5.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ahs3t33e\5uaefoj6.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ahs3t33e\5uaefoj6.exe"
          4⤵
          • Views/modifies file attributes
          PID:3728
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ahs3t33e\5uaefoj6.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ahs3t33e\5uaefoj6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:5832
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ahs3t33e\5uaefoj6.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ahs3t33e\5uaefoj6.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\riwrcoy5\p3shpve8.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\riwrcoy5\p3shpve8.exe"
          4⤵
          • Views/modifies file attributes
          PID:5076
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\riwrcoy5\p3shpve8.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\riwrcoy5\p3shpve8.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\riwrcoy5\p3shpve8.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\riwrcoy5\p3shpve8.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmhcx3rx\y9tnzxhx.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5380
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmhcx3rx\y9tnzxhx.exe"
          4⤵
          • Views/modifies file attributes
          PID:5964
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmhcx3rx\y9tnzxhx.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmhcx3rx\y9tnzxhx.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmhcx3rx\y9tnzxhx.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmhcx3rx\y9tnzxhx.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\asypqu3i\bfso9kub.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1304
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\asypqu3i\bfso9kub.exe"
          4⤵
          • Views/modifies file attributes
          PID:940
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\asypqu3i\bfso9kub.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\asypqu3i\bfso9kub.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\asypqu3i\bfso9kub.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\asypqu3i\bfso9kub.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs4su53o\hjf29qoa.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:6052
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs4su53o\hjf29qoa.exe"
          4⤵
          • Views/modifies file attributes
          PID:1568
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs4su53o\hjf29qoa.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs4su53o\hjf29qoa.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3600
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs4su53o\hjf29qoa.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs4su53o\hjf29qoa.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\529kqqyt\pr5f5lmj.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\529kqqyt\pr5f5lmj.exe"
          4⤵
          • Views/modifies file attributes
          PID:2560
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\529kqqyt\pr5f5lmj.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\529kqqyt\pr5f5lmj.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\529kqqyt\pr5f5lmj.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\529kqqyt\pr5f5lmj.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d89mflqb\z2t979sz.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d89mflqb\z2t979sz.exe"
          4⤵
          • Views/modifies file attributes
          PID:5692
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d89mflqb\z2t979sz.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d89mflqb\z2t979sz.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d89mflqb\z2t979sz.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d89mflqb\z2t979sz.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb6wgwjc\54hcet8k.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:6044
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb6wgwjc\54hcet8k.exe"
          4⤵
          • Views/modifies file attributes
          PID:5992
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb6wgwjc\54hcet8k.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb6wgwjc\54hcet8k.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb6wgwjc\54hcet8k.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cb6wgwjc\54hcet8k.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk61mbwb\t65h993f.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5704
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk61mbwb\t65h993f.exe"
          4⤵
          • Views/modifies file attributes
          PID:2640
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk61mbwb\t65h993f.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk61mbwb\t65h993f.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk61mbwb\t65h993f.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gk61mbwb\t65h993f.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m6m29mvg\vudft9qg.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3776
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m6m29mvg\vudft9qg.exe"
          4⤵
          • Views/modifies file attributes
          PID:5952
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m6m29mvg\vudft9qg.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m6m29mvg\vudft9qg.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:5744
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m6m29mvg\vudft9qg.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m6m29mvg\vudft9qg.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5716
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\thpii40z\whyzsjqy.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5300
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\thpii40z\whyzsjqy.exe"
          4⤵
          • Views/modifies file attributes
          PID:1092
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\thpii40z\whyzsjqy.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\thpii40z\whyzsjqy.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\thpii40z\whyzsjqy.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\thpii40z\whyzsjqy.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lptunakn\qb4vu2xl.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lptunakn\qb4vu2xl.exe"
          4⤵
          • Views/modifies file attributes
          PID:2408
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lptunakn\qb4vu2xl.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lptunakn\qb4vu2xl.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:6032
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lptunakn\qb4vu2xl.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lptunakn\qb4vu2xl.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\22pij9tr\tcc0f7s4.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4832
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\22pij9tr\tcc0f7s4.exe"
          4⤵
          • Views/modifies file attributes
          PID:5872
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\22pij9tr\tcc0f7s4.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\22pij9tr\tcc0f7s4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\22pij9tr\tcc0f7s4.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\22pij9tr\tcc0f7s4.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3444
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stx3aoaw\oh3dbnq6.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5748
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stx3aoaw\oh3dbnq6.exe"
          4⤵
          • Views/modifies file attributes
          PID:5312
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stx3aoaw\oh3dbnq6.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stx3aoaw\oh3dbnq6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stx3aoaw\oh3dbnq6.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stx3aoaw\oh3dbnq6.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5692
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pphxlo8v\x7fc5yq9.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pphxlo8v\x7fc5yq9.exe"
          4⤵
          • Views/modifies file attributes
          PID:4992
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pphxlo8v\x7fc5yq9.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pphxlo8v\x7fc5yq9.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pphxlo8v\x7fc5yq9.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pphxlo8v\x7fc5yq9.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5848
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr31yxqe\1hskvjfh.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3400
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr31yxqe\1hskvjfh.exe"
          4⤵
          • Views/modifies file attributes
          PID:5064
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr31yxqe\1hskvjfh.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr31yxqe\1hskvjfh.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr31yxqe\1hskvjfh.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr31yxqe\1hskvjfh.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lxc0f9dv\98grb32s.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lxc0f9dv\98grb32s.exe"
          4⤵
          • Views/modifies file attributes
          PID:4408
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lxc0f9dv\98grb32s.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lxc0f9dv\98grb32s.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lxc0f9dv\98grb32s.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lxc0f9dv\98grb32s.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\macsau3n\qmghoo2m.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\macsau3n\qmghoo2m.exe"
          4⤵
          • Views/modifies file attributes
          PID:5328
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\macsau3n\qmghoo2m.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\macsau3n\qmghoo2m.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\macsau3n\qmghoo2m.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\macsau3n\qmghoo2m.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmji9k6h\taegb6mi.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5764
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmji9k6h\taegb6mi.exe"
          4⤵
          • Views/modifies file attributes
          PID:6188
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmji9k6h\taegb6mi.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmji9k6h\taegb6mi.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:6288
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmji9k6h\taegb6mi.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmji9k6h\taegb6mi.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:6360
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k4tux7eu\fikpxh3q.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:6388
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k4tux7eu\fikpxh3q.exe"
          4⤵
          • Views/modifies file attributes
          PID:6444
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k4tux7eu\fikpxh3q.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k4tux7eu\fikpxh3q.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:6548
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k4tux7eu\fikpxh3q.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k4tux7eu\fikpxh3q.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      PID:6620
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pggec6s4\jbge0nc2.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:6652
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pggec6s4\jbge0nc2.exe"
          4⤵
          • Views/modifies file attributes
          PID:6704
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pggec6s4\jbge0nc2.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pggec6s4\jbge0nc2.exe
    1⤵
    • Executes dropped EXE
    PID:6804
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pggec6s4\jbge0nc2.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pggec6s4\jbge0nc2.exe
      2⤵
      • Executes dropped EXE
      PID:6876
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toyxwlz0\fjjtnyir.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        PID:6904
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toyxwlz0\fjjtnyir.exe"
          4⤵
          • Views/modifies file attributes
          PID:6960
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toyxwlz0\fjjtnyir.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toyxwlz0\fjjtnyir.exe
    1⤵
      PID:7108
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toyxwlz0\fjjtnyir.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toyxwlz0\fjjtnyir.exe
        2⤵
          PID:6148
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvmb82jk\3wmvb2vs.exe"
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            PID:6164
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvmb82jk\3wmvb2vs.exe"
              4⤵
              • Views/modifies file attributes
              PID:6308
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        1⤵
          PID:6444
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvmb82jk\3wmvb2vs.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvmb82jk\3wmvb2vs.exe
          1⤵
            PID:6396
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvmb82jk\3wmvb2vs.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mvmb82jk\3wmvb2vs.exe
              2⤵
                PID:5804
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ng7ipms\apts5egn.exe"
                  3⤵
                  • Hide Artifacts: Hidden Files and Directories
                  PID:6700
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ng7ipms\apts5egn.exe"
                    4⤵
                    • Views/modifies file attributes
                    PID:6732
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ng7ipms\apts5egn.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ng7ipms\apts5egn.exe
              1⤵
                PID:6944
                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ng7ipms\apts5egn.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ng7ipms\apts5egn.exe
                  2⤵
                    PID:7016
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\59zhjf3i\0j1m4m33.exe"
                      3⤵
                      • Hide Artifacts: Hidden Files and Directories
                      PID:7124
                      • C:\Windows\system32\attrib.exe
                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\59zhjf3i\0j1m4m33.exe"
                        4⤵
                        • Views/modifies file attributes
                        PID:6184
                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\59zhjf3i\0j1m4m33.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\59zhjf3i\0j1m4m33.exe
                  1⤵
                    PID:6440
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\59zhjf3i\0j1m4m33.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\59zhjf3i\0j1m4m33.exe
                      2⤵
                        PID:4220
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0igavy0\qfrcrs5n.exe"
                          3⤵
                          • Hide Artifacts: Hidden Files and Directories
                          PID:6828
                          • C:\Windows\system32\attrib.exe
                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0igavy0\qfrcrs5n.exe"
                            4⤵
                            • Views/modifies file attributes
                            PID:6840
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0igavy0\qfrcrs5n.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0igavy0\qfrcrs5n.exe
                      1⤵
                        PID:4308
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0igavy0\qfrcrs5n.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a0igavy0\qfrcrs5n.exe
                          2⤵
                            PID:7152
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qo3rs38m\e3px0yzq.exe"
                              3⤵
                              • Hide Artifacts: Hidden Files and Directories
                              PID:6504
                              • C:\Windows\system32\attrib.exe
                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qo3rs38m\e3px0yzq.exe"
                                4⤵
                                • Views/modifies file attributes
                                PID:6608
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qo3rs38m\e3px0yzq.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qo3rs38m\e3px0yzq.exe
                          1⤵
                            PID:6728
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qo3rs38m\e3px0yzq.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qo3rs38m\e3px0yzq.exe
                              2⤵
                                PID:6732
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ilos4yq\bsv0v2oa.exe"
                                  3⤵
                                  • Hide Artifacts: Hidden Files and Directories
                                  PID:8172
                                  • C:\Windows\system32\attrib.exe
                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ilos4yq\bsv0v2oa.exe"
                                    4⤵
                                    • Views/modifies file attributes
                                    PID:7172
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ilos4yq\bsv0v2oa.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ilos4yq\bsv0v2oa.exe
                              1⤵
                                PID:13084
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ilos4yq\bsv0v2oa.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7ilos4yq\bsv0v2oa.exe
                                  2⤵
                                    PID:10672
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jk6v5qof\22bnu7fs.exe"
                                      3⤵
                                      • Hide Artifacts: Hidden Files and Directories
                                      PID:10000
                                      • C:\Windows\system32\attrib.exe
                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jk6v5qof\22bnu7fs.exe"
                                        4⤵
                                        • Views/modifies file attributes
                                        PID:10292
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jk6v5qof\22bnu7fs.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jk6v5qof\22bnu7fs.exe
                                  1⤵
                                    PID:10440
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jk6v5qof\22bnu7fs.exe
                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jk6v5qof\22bnu7fs.exe
                                      2⤵
                                        PID:10536
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g8sez4ti\d0jypaaf.exe"
                                          3⤵
                                          • Hide Artifacts: Hidden Files and Directories
                                          PID:9432
                                          • C:\Windows\system32\attrib.exe
                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g8sez4ti\d0jypaaf.exe"
                                            4⤵
                                            • Views/modifies file attributes
                                            PID:7400
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g8sez4ti\d0jypaaf.exe
                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g8sez4ti\d0jypaaf.exe
                                      1⤵
                                        PID:7640
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g8sez4ti\d0jypaaf.exe
                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g8sez4ti\d0jypaaf.exe
                                          2⤵
                                            PID:8656
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov3k3ylt\hm5hmq52.exe"
                                              3⤵
                                              • Hide Artifacts: Hidden Files and Directories
                                              PID:12080
                                              • C:\Windows\system32\attrib.exe
                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov3k3ylt\hm5hmq52.exe"
                                                4⤵
                                                • Views/modifies file attributes
                                                PID:14008
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov3k3ylt\hm5hmq52.exe
                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov3k3ylt\hm5hmq52.exe
                                          1⤵
                                            PID:7848
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov3k3ylt\hm5hmq52.exe
                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov3k3ylt\hm5hmq52.exe
                                              2⤵
                                                PID:17264
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zn2ctjrv\0c5dxyrq.exe"
                                                  3⤵
                                                  • Hide Artifacts: Hidden Files and Directories
                                                  PID:15860
                                                  • C:\Windows\system32\attrib.exe
                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zn2ctjrv\0c5dxyrq.exe"
                                                    4⤵
                                                    • Views/modifies file attributes
                                                    PID:15432
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zn2ctjrv\0c5dxyrq.exe
                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zn2ctjrv\0c5dxyrq.exe
                                              1⤵
                                                PID:15072
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zn2ctjrv\0c5dxyrq.exe
                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zn2ctjrv\0c5dxyrq.exe
                                                  2⤵
                                                    PID:7740
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f8nij9e2\fu8hrbhr.exe"
                                                      3⤵
                                                      • Hide Artifacts: Hidden Files and Directories
                                                      PID:10584
                                                      • C:\Windows\system32\attrib.exe
                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f8nij9e2\fu8hrbhr.exe"
                                                        4⤵
                                                        • Views/modifies file attributes
                                                        PID:16388
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f8nij9e2\fu8hrbhr.exe
                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f8nij9e2\fu8hrbhr.exe
                                                  1⤵
                                                    PID:6888
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f8nij9e2\fu8hrbhr.exe
                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f8nij9e2\fu8hrbhr.exe
                                                      2⤵
                                                        PID:17488
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i6stev3\5i8o9ycx.exe"
                                                          3⤵
                                                          • Hide Artifacts: Hidden Files and Directories
                                                          PID:16188
                                                          • C:\Windows\system32\attrib.exe
                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i6stev3\5i8o9ycx.exe"
                                                            4⤵
                                                            • Views/modifies file attributes
                                                            PID:14712
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i6stev3\5i8o9ycx.exe
                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i6stev3\5i8o9ycx.exe
                                                      1⤵
                                                        PID:14624
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i6stev3\5i8o9ycx.exe
                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i6stev3\5i8o9ycx.exe
                                                          2⤵
                                                            PID:9884
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xmnyfypc\691bqidn.exe"
                                                              3⤵
                                                              • Hide Artifacts: Hidden Files and Directories
                                                              PID:9824
                                                              • C:\Windows\system32\attrib.exe
                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xmnyfypc\691bqidn.exe"
                                                                4⤵
                                                                • Views/modifies file attributes
                                                                PID:5068
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xmnyfypc\691bqidn.exe
                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xmnyfypc\691bqidn.exe
                                                          1⤵
                                                            PID:13980
                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xmnyfypc\691bqidn.exe
                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xmnyfypc\691bqidn.exe
                                                              2⤵
                                                                PID:13904
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4tn3vao\j4dhmw6t.exe"
                                                                  3⤵
                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                  PID:4216
                                                                  • C:\Windows\system32\attrib.exe
                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4tn3vao\j4dhmw6t.exe"
                                                                    4⤵
                                                                    • Views/modifies file attributes
                                                                    PID:12840
                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4tn3vao\j4dhmw6t.exe
                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4tn3vao\j4dhmw6t.exe
                                                              1⤵
                                                                PID:13376
                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4tn3vao\j4dhmw6t.exe
                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u4tn3vao\j4dhmw6t.exe
                                                                  2⤵
                                                                    PID:11924
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\swzma5kv\noajyrca.exe"
                                                                      3⤵
                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                      PID:11704
                                                                      • C:\Windows\system32\attrib.exe
                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\swzma5kv\noajyrca.exe"
                                                                        4⤵
                                                                        • Views/modifies file attributes
                                                                        PID:6508
                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\swzma5kv\noajyrca.exe
                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\swzma5kv\noajyrca.exe
                                                                  1⤵
                                                                    PID:18492
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\swzma5kv\noajyrca.exe
                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\swzma5kv\noajyrca.exe
                                                                      2⤵
                                                                        PID:16488
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vliqcg55\cs5c4hqz.exe"
                                                                          3⤵
                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                          PID:19400
                                                                          • C:\Windows\system32\attrib.exe
                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vliqcg55\cs5c4hqz.exe"
                                                                            4⤵
                                                                            • Views/modifies file attributes
                                                                            PID:17608
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vliqcg55\cs5c4hqz.exe
                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vliqcg55\cs5c4hqz.exe
                                                                      1⤵
                                                                        PID:14744
                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vliqcg55\cs5c4hqz.exe
                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vliqcg55\cs5c4hqz.exe
                                                                          2⤵
                                                                            PID:19308
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mftnrwy8\sda33wiv.exe"
                                                                              3⤵
                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                              PID:8812

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v16

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              VCRUNTIME140.dll
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\VCRUNTIME140.dll
                                                                              • Size 94KB
                                                                              • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              _bz2.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\_bz2.pyd
                                                                              • Size 84KB
                                                                              • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              _decimal.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\_decimal.pyd
                                                                              • Size 265KB
                                                                              • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              _hashlib.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\_hashlib.pyd
                                                                              • Size 64KB
                                                                              • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              _lzma.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\_lzma.pyd
                                                                              • Size 159KB
                                                                              • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              _socket.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\_socket.pyd
                                                                              • Size 78KB
                                                                              • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              _ssl.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\_ssl.pyd
                                                                              • Size 151KB
                                                                              • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              _uuid.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\_uuid.pyd
                                                                              • Size 23KB
                                                                              • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              base_library.zip
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\base_library.zip
                                                                              • Size 711KB
                                                                              • SHA256 8a7cc7c1d62322d784d76ff0d0a687e852d78e5a9574d28836faf74a338ade97
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              libcrypto-1_1.dll
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\libcrypto-1_1.dll
                                                                              • Size 3.3MB
                                                                              • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              libssl-1_1.dll
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\libssl-1_1.dll
                                                                              • Size 678KB
                                                                              • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              python39.dll
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\python39.dll
                                                                              • Size 4.3MB
                                                                              • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              select.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\select.pyd
                                                                              • Size 28KB
                                                                              • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              unicodedata.pyd
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI60202\unicodedata.pyd
                                                                              • Size 1.1MB
                                                                              • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              l7m1z9o5.exe
                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7b6kp8nn\l7m1z9o5.exe
                                                                              • Size 5.4MB
                                                                              • SHA256 28c708c285006d7661dc48594e70524e8dc37cba0f9dabbb48d0e52405403a3b
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              README_DECRYPT.txt
                                                                              • Path C:\Users\Admin\Contacts\README_DECRYPT.txt
                                                                              • Size 1KB
                                                                              • SHA256 352f33c5ab05e8b6f4dfdf26859469dfd9ea358b795f4cd3e306979c0dcc6b8e
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              memory/4768-158-0x000002F2E7190000-0x000002F2E74DD000-memory.dmp
                                                                              Download