e42d8580e193b484d85f5fd17e7e16e1afd18aca70278a635279b4620afbb11f

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ToDesk_x64_5.exe
Size 122.6MB
Sample261110-v8e9eahd76
SHA256 e42d8580e193b484d85f5fd17e7e16e1afd18aca70278a635279b4620afbb11f
MD5 1bc37b70ca2c76608717e83f6619e68b
SHA1 addeb76b032bec535981edfe73a481d1d49707bb
SHA512 69a3e71f4a77170eb8da3117fec2b241fa082cf51fe3e0ddb4d8d04255052f7d1abe27022d70171e9a3505ac298fb9a78ef3e6dbc013a4d18da7acf53ab40416
SSDEEP 3145728:tdvGTxpP59WydHJw3hNT129VuU5VaB2XDom6jg:tYTxV59H8hNxg5hxB
TLSH
T18E583321E351C074F15602B0E4AA1BBF4E3E7E748B2990D35BF07E1AB9316C1AB39759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3264 created 3224	3264	elevation_service.exe	56

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2204	attrib.exe
816	attrib.exe

Executes dropped EXE 7 IoCs

pid	Process
740	ToDesk_x64_5.tmp
4860	Swearflesh6239.exe
3060	installer.exe
3056	Swearflesh6239.exe
4500	Swearflesh6239.exe
3240	Swearflesh6239.exe
1976	Swearflesh6239.exe

Loads dropped DLL 5 IoCs

pid	Process
4860	Swearflesh6239.exe
3056	Swearflesh6239.exe
4500	Swearflesh6239.exe
3240	Swearflesh6239.exe
1976	Swearflesh6239.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3348	icacls.exe
3144	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1716	cmd.exe
1408	cmd.exe
2716	cmd.exe
2748	cmd.exe
612	cmd.exe
1876	cmd.exe
4756	cmd.exe
5036	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDesk_x64_5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToDesk_x64_5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2260-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral1/memory/2260-77-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	75	Go-http-client/1.1
HTTP User-Agent header	269	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3368	taskkill.exe
4964	taskkill.exe
4292	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
740	ToDesk_x64_5.tmp
740	ToDesk_x64_5.tmp
4860	Swearflesh6239.exe
4860	Swearflesh6239.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
1460	waitfor.exe
1460	waitfor.exe
3056	Swearflesh6239.exe
3056	Swearflesh6239.exe
3264	elevation_service.exe
3264	elevation_service.exe
4500	Swearflesh6239.exe
4500	Swearflesh6239.exe
3240	Swearflesh6239.exe
3240	Swearflesh6239.exe

Suspicious behavior: MapViewOfSection 1 TTPs 7 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4860	Swearflesh6239.exe
3264	elevation_service.exe
3264	elevation_service.exe
3056	Swearflesh6239.exe
3264	elevation_service.exe
4500	Swearflesh6239.exe
3240	Swearflesh6239.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	4964	taskkill.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	4860	Swearflesh6239.exe
Token: SeShutdownPrivilege	3264	elevation_service.exe
Token: SeShutdownPrivilege	1460	waitfor.exe
Token: SeDebugPrivilege	1460	waitfor.exe
Token: SeDebugPrivilege	1460	waitfor.exe
Token: SeDebugPrivilege	3544	whoami.exe
Token: SeBackupPrivilege	2032	vssvc.exe
Token: SeRestorePrivilege	2032	vssvc.exe
Token: SeAuditPrivilege	2032	vssvc.exe
Token: SeDebugPrivilege	3056	Swearflesh6239.exe
Token: SeDebugPrivilege	4500	Swearflesh6239.exe
Token: SeDebugPrivilege	3240	Swearflesh6239.exe
Token: SeDebugPrivilege	1976	Swearflesh6239.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
740	ToDesk_x64_5.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1460	waitfor.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 740	2260	ToDesk_x64_5.exe	85
PID 740 wrote to memory of 3368	740	ToDesk_x64_5.tmp	86
PID 740 wrote to memory of 4964	740	ToDesk_x64_5.tmp	89
PID 740 wrote to memory of 4292	740	ToDesk_x64_5.tmp	91
PID 740 wrote to memory of 4860	740	ToDesk_x64_5.tmp	93
PID 740 wrote to memory of 3060	740	ToDesk_x64_5.tmp	94
PID 3264 wrote to memory of 1716	3264	elevation_service.exe	101
PID 1716 wrote to memory of 1460	1716	cmd.exe	103
PID 3264 wrote to memory of 1408	3264	elevation_service.exe	104
PID 1408 wrote to memory of 3144	1408	cmd.exe	106
PID 3264 wrote to memory of 2716	3264	elevation_service.exe	107
PID 2716 wrote to memory of 3348	2716	cmd.exe	109
PID 3264 wrote to memory of 2204	3264	elevation_service.exe	110
PID 3264 wrote to memory of 816	3264	elevation_service.exe	113
PID 1460 wrote to memory of 2980	1460	waitfor.exe	115
PID 3264 wrote to memory of 4288	3264	elevation_service.exe	116
PID 1460 wrote to memory of 5092	1460	waitfor.exe	118
PID 1460 wrote to memory of 2748	1460	waitfor.exe	123
PID 2748 wrote to memory of 212	2748	cmd.exe	124
PID 2748 wrote to memory of 3544	2748	cmd.exe	125
PID 612 wrote to memory of 3056	612	cmd.exe	130
PID 1876 wrote to memory of 4500	1876	cmd.exe	134
PID 4756 wrote to memory of 3240	4756	cmd.exe	137
PID 5036 wrote to memory of 1976	5036	cmd.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2204	attrib.exe
816	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3224
- C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_5.exe
  "C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_5.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\is-7JAEO.tmp\ToDesk_x64_5.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-7JAEO.tmp\ToDesk_x64_5.tmp" /SL5="$40248,128188387,119296,C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Swearflesh6239.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3368
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Swearflesh6239.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4964
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Swearflesh6239.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4292
  - - C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
      "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4860
  - - C:\Drivers\Horriblegraded4873\installer.exe
      "C:\Drivers\Horriblegraded4873\installer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3060
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:2980
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:5092
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:212
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:3144
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:3348
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2204
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:816
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn DVOnVLhRIDpyqSFFFzLxxfyG /tr "cmd /c cd /d \"C:\Drivers\RecipesConfirmed\" && start \"\" \"C:\Drivers\RecipesConfirmed\Swearflesh6239.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4288

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:1252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\RecipesConfirmed" && start "" "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:612
- C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
  "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3056

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\RecipesConfirmed" && start "" "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
  "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4500

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\RecipesConfirmed" && start "" "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
  "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3240

C:\Windows\system32\schtasks.exe
schtasks /query /tn DVOnVLhRIDpyqSFFFzLxxfyG
1⤵
PID:1568

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\RecipesConfirmed" && start "" "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
  "C:\Drivers\RecipesConfirmed\Swearflesh6239.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Process Injection

T1055

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Owner/User Discovery

T1033

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

analiz.mp4

Path C:\Drivers\Horriblegraded4873\analiz.mp4
Size 34.7MB
SHA256 e2707ac041c08da9904c2dfae282acbaf3f9597b37ebbde2363d87248ce7b06d
MD5 4a9b6121bee654f961b66080ca8851c2
SHA1 0736783d9c4ee2ae1dcd9d7ab1c6067dea64db6e
SHA512 1f7a6668b2e8a44c1d6bb89a7d48e883946e0bc6e6abff16c88c3a41107efde6564cb14cde340a2a94e5af7395970cb017049154c61cb84de7865ad97cbb87b3
SSDEEP 786432:Joz1X3u3uq1pLJoxf4bJsSX+U7v7DFpPL9HNXFJPDdQffZb9j:JoZX3u+qyGsSX/rFpPJHNHLiZb9j
TLSH
T1A3873378D2B49645E221B3B0BDC9325F0F3F2BC2851D62D859B6F34BE168840DAF5D29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gruppirovka.png

Path C:\Drivers\Horriblegraded4873\gruppirovka.png
Size 17.5MB
SHA256 448a0d9eb786ea1a3b39c9a250f69104dea61471bae77ea4c24a239293697c35
MD5 dc87bbd830b4a868b37bc791b962f667
SHA1 215f6767e5fccb66bb19b954ec0d8ec1f57e2c97
SHA512 2e1802d97aaaa796db27f1304c802aa3e297703961b033d079f4817e02dd38385daefd951d88cfbe9ac70e59dc56082cf853fd4004760e79bc6abb69033b30c2
SSDEEP 393216:XjpLum1hKA5FUqTgKnt1pwIFyt23UB7vUW3Hxq6isNJSUD6Kd2Ntc:zBu6B5FUqjnNuB7R3R2QJl07c
TLSH
T16E073338C4E45644F4371D07506F2314B4BEF3D6AA61843ABCEBE1416BA2D5CA9BF9C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Drivers\Horriblegraded4873\installer.exe
Size 3.9MB
SHA256 96e3691705e719a96abfc429ccde507321ac0c17534d54171fe0ce47a186e7cd
MD5 e77228a3deaa73ce637d81fcb8140bf0
SHA1 bc0ca62a89e66a38e159bf5d75514a6d1b905532
SHA512 4921ed7b29bc7b6851d097883db7b7756d29ed244542ce29c8d63a52630d221f4321dba2b6ade455b21bc62d22a3d4198bd449c4397d55861c2afb4137f8f05d
SSDEEP 98304:1kvcCPsKRH3AV1qtMDC7/b1VkK655XqJ3eJeVylAEI:qcCkmvpJVkRWJ3eJKH
TLSH
T14616CF12F641C0B1E48201B1D17A9BFB8A3E9D34D73A99C3D7D03D65B9312C2673A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-66EIO.tmp

Path C:\Drivers\Horriblegraded4873\is-66EIO.tmp
Size 32.9MB
SHA256 934c01231fa7ce1889be5f7d27fd1a7581f9a59de0989a8fbe2a3175abc4a757
MD5 5021c78e0d222262e75bcdb5caf7db04
SHA1 f9b894bc8835e2a35141841822e7777430e38890
SHA512 c664eecc3ceeced33f58574a5c8171fdf7d906b68b791a405bd2f61bf7bb78f3dfc0b4313f5e328778230e5d67ebcaf749d0a21e465d8778ddd75c7fd0966a92
SSDEEP 786432:GrmMOL6EXVU5NfxYaJQQvT2DlZxH/8CG5XCR+D1mFvCKvpd12U1gJv:GI6WyDxtJQQKldL5FvNT129v
TLSH
T13877336C43B1720DF27963B564C6276E462E33EE4E1D71A414783382E2AE650F7F8279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skript.mp3

Path C:\Drivers\Horriblegraded4873\skript.mp3
Size 2.1MB
SHA256 2195d02466fdaaefd9edcb02e9721e98f4923efb93646ae55357a14024f632c8
MD5 7f12dcb0528ed34a7e2beb4ad3ba08a5
SHA1 13ec87c6a8d58af32aee54bbc994df08fa302f8a
SHA512 58b7be220ee7c6ac6c5c124d629141cafec3ff0ab4b7ae701d78977a4e62bb5145ad6aa02e8dec7ea1c2e65278e9cfc7986c1fc099c910ca3b25e87595e93907
SSDEEP 49152:tlxVqav6abbQSqCWHQlJrJemi+o+6PQrXSGe0SUCdnh:xVqav6gbuwlJrJDi+eGe0ni
TLSH
T1FBA5338D476CD04BF6BCBFF4FEC05C9DD87E292B96A4F10129B97B0250D21A719278A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spisok.mp3

Path C:\Drivers\Horriblegraded4873\spisok.mp3
Size 2.4MB
SHA256 c4b28fa7f9b5fe86b9d62fd01597762455794e2215bbaf6827a02cf19f15d6e3
MD5 0476d6edec28e0c0e5c4b1ed901ad039
SHA1 72522ee6d260660e0cc9ccebb47952848698c72e
SHA512 a113a53f8bc82c2fdf90c4617af27a1a547cf8f328c1fdce2f161665ba0c5fdc2d785e531cd54d7656ebd8c1f93e0df8b5fe767157872911d9656120746bfa30
SSDEEP 49152:e9hInt7PqhMpGOLpjEl1eq0+HVeYlHPJvNpeZqdwjzh3G7lnJDwdV:ASnt7M+GOL2lQqn1xlPJfAqW927dJDw
TLSH
T19CC533FDB0D4D1E6FE1162F11EC42337197698C7970563D40089631BFAA6A0ADCE9CBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ustanovka.png

Path C:\Drivers\Horriblegraded4873\ustanovka.png
Size 14.7MB
SHA256 b22de43d8ccfe69633cc52316444d972c7be54a4ccc35eb3bf5f0dedf9446b8c
MD5 953a5a10006187486925c8ddbbaf0774
SHA1 3e82a0d90851e9d3b9d5d60ebcefd4199acaa9e4
SHA512 094defb50b3740337b4392109cc6149801e09e5643463c058df3c7d0c54c7d4150ebdb880df2f616515054ab87455ff6af5a9fea79e01a98dcc4e12ee3bff27d
SSDEEP 393216:OX+vtrERa+t6F1WOwnApsUhaZxtCDa1s4XVULtk:e0E4N0nzp+KiLi
TLSH
T108F63344D721293DDC4F41F5E4DF7A112EA0DFE8AE44A0787DE28F15F7100A69A8BB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StoningFarmers-4687.jeA

Path C:\Drivers\RecipesConfirmed\StoningFarmers-4687.jeA
Size 4.3MB
SHA256 ba582eb06a15b11e814f0b42606e9abec384752c55d11bdc6f18d202e055dc06
MD5 5bd1f33f734d53baf8d365453027d2fc
SHA1 0ab3fac8d01ca3f665a49fe965ab972aec110eef
SHA512 a701cdc7712e31f0c2cf50336b73d891a09fa86a198723b95e7338a049ad86561b8449af8145eee34bf2c68ada526e3dc448384f9dfe8311fcbaa1c30672c03c
SSDEEP 49152:XiALUDnB+ZqDTkTj5fjmTnnO1sNnNDyIIwf5YxAO1DLcnqstK:yAutT456nksN76SO13cnp
TLSH
T10126CF313111AA18E16F431AD0B85E1CC6BC694997BB8E9C9F23FAF27D56701EF78048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swearflesh6239.exe

Path C:\Drivers\RecipesConfirmed\Swearflesh6239.exe
Size 340KB
SHA256 928d415556becba897229b293cf9c9bc54b78721e5911728a0633b22f24d1f27
MD5 06e26df88466cd28d243201b2cbe0640
SHA1 4d78b2d38fac1115d10f7b275e2e9d09eff56caa
SHA512 80a31f2c98f91edc74ac4a57f6aeead8d10466eecd4eff03821ad6953fbf2394726295f412359caecea8e3f4994ba3505ee0fcb93f2d377d96204cacf8402636
SSDEEP 6144:lE8+pg36hoAorx30faYOOlVT8NxU8NA23tfcYMRPTlmk:ltGN6rGTRYNFdP+pT
TLSH
T168746C11BB9558FCE957C0788241CA73AA377C860B21A9FF11A452393F27AE56F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Inclusion-Hypnosis-4521.tr

Path C:\Drivers\anymoresubsidize12\Inclusion-Hypnosis-4521.tr
Size 10.3MB
SHA256 bf55b0323aa437985ad974075017d10a90ae37cadb8a4d0f1ff14e0220e74917
MD5 5c28ad6b50a759039700fe649f964639
SHA1 593de913a5e5a691da8deba9dfea1f1c15d37a44
SHA512 3a3ca05d5e4ec62bea666dd0c55d2f8b00a551e3640efcb8a2a88fdcb7520430888813a3d29b1501b322423721916bf09752d38de05581776164bdcc95efd2cb
SSDEEP 196608:woqvXG5QMJDBWzH6C9G2JBynuIvA2ch4dSMBLu88GWNM+Y9t9JwRzmabC2:KXG5uzaM47hdbN9J8mU
TLSH
T1B4B633BA961AA0C4F5EA4E454F0B1B3E7268DBFD969D0897C0E8234AF11D3E0D3D151B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 113KB
SHA256 4d8e587a1c801fd3938be9b8691109341431086fc23042340582aae5814b72be
MD5 3675c9fad004ba90bbafa180333c6043
SHA1 7df1dcba159661cbdebcacdc70c61e2367a72e35
SHA512 daf7f6f590a998243a886d6aa8d466dd432edd99047414abf996970d40ae3956f0fa0466c8ce2d07d0b5dc774cb7f7f741f0cc9b76d26e695ccbdd2a077256d6
SSDEEP 3072:GOlRLjIfa3zBGnHBT+Pkael+3UK3oecCTN:djXBOBT2ka537orO
TLSH
T1CFB3121F460A31E7A29AE69882B3DD99F3DD68F4379610F9B10158C05F5421FBED07A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 139KB
SHA256 b37f463b2a36dee3146ccbf0eef5240dcbcf7fede162cfa1af15281770c898a6
MD5 75a86fbf326b310d66b2cfbe1858714e
SHA1 25089d64fa6dcfbb9e8d1a43c39b0bd4612445e1
SHA512 2f2b0c03ad51835b634d276c625be816f7f79a5c270a18408a58fdf2df8d8a758f1be98dc8e7114283d035b2af990fd2f844002f4632a07636d347bdc2fbd5c2
SSDEEP 3072:GOlRLjIfa3zBGnHBT+Pkael+3UK3oecCTIWtwpOLRDJ:djXBOBT2ka537orTWtwALR1
TLSH
T1FBE3121F461A31E3A5DAEA5546E3DD8DF2DD68F832A620F9B20114D05F0412BBED0BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 16KB
SHA256 60a4e8a118df53c1a100575831870506e589552b4d7b297967c723b088dc68ca
MD5 59e710fe202e3038f89110b883646fbe
SHA1 c8300cd3a2b230b0567fa05080342d2989eca68f
SHA512 1b6f3b552cd940c6bb470f72b451321b51a2d41ff99efe2de5fd0adf71da4c51bc19e4fc1eb7e873f0813c3dac647a7a374685565a3fd39b37d454895c43e15d
SSDEEP 384:7HJhLOez6O3S8KJ0V4khqcN443P5LxQ+BT4Yh2Az:9semOlKO4ksN4BC+dZh2E
TLSH
T14272C09B1526369645BEF9DEC066E8E8FFC2D8FC238341788411D451EFA603EAD117D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 909eef62eb3a248de5ad8dba65dbf4be81c863a35f37189108e421a488a3e159
MD5 a92f1298938f4279de4066bda8f9fa21
SHA1 c480e0f211b4d75efd431e8d64042ea2f91e245b
SHA512 75ad6799de22dc1495349f531f6e5689d8e2ed2b30ed32e5424937546ff828609cc5a257bda94450ef245ef99255245aa2497a7fc6b4ca8cf46227b50790b4ed
SSDEEP 768:9semOlKO4ksN4BC+dZh277ItNGKoQ6A/ApYyYQ4Z3LfRp8:GOlKtksCXG7ILGE3/ACyha3Lfn8
TLSH
T129F2F11F0A2137CF826FF9D9D2A6E95DF6E8C4F8365600784181C4E5DFA42257E912D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 bbb6eebbb7ee930eab1bbe515cd98200474835e3e22a6ed05c3da0d105eadd33
MD5 2f516783d2bfc1cb4a5782c7d99d6d69
SHA1 48611e91b27123f99fcef00ab9cc6c93b2c986c2
SHA512 347b590f9ed678b46c77f103306037664a9f8d8b4d729daa54742a34180df379d34e7b38228f3c90440a68b3bbafcc3b5baf5f93343cd91951f6d0792cfef8e1
SSDEEP 768:9semOlKO4ksN4BC+dZh277ItNGKoQ6A/ApYyYQ4Z3LfRpMO:GOlKtksCXG7ILGE3/ACyha3LfnMO
TLSH
T1A8F2E11F0A2137CBC26FF9DAD2A2DD59F6E884F8369600745181C8E5DFA4125BE912D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 42KB
SHA256 962dad0b064a47443a115b019994da1329a49124cd811207d889603d32df3554
MD5 17177caccb989dd219dd39de98724085
SHA1 b9e2d514d5e6fa1f74d4a3ed61f74f87f0f629b6
SHA512 7bb50db909c93fdb807c0baafe58323f39e7b464c8e0c42b963db5748bfa2838c6071f89398ad0828e92f1743ca065fb2935a00581b32c7932a6d8d95b971769
SSDEEP 768:9semOlKO4ksN4BC+dZh277ItNGKoQ6A/ApYyYQ4Z3LfRpMeuKK9nQ0:GOlKtksCXG7ILGE3/ACyha3LfnMuGn/
TLSH
T10E13F11F0B2533C7C2AAF9C9D1A6D959F7E990F9336640B4604184E5DF6952A6E803C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 54KB
SHA256 8076683a8495a06e2b911b99205e35efc211ba469d86d622297d79136b248b3a
MD5 1555ace675b7b0ba02921ba97320fcd1
SHA1 99c93bb6118f1ab933c2ddca7c418e48d7be6c83
SHA512 f4f39ad6ae2b3889c98933a4581b3d6dd3d894e145e1a09ff16d61364e9c2fa410792104e89cda260cbf21215e7a00af291a0893d29390a20cfc84bd9d5f9bc1
SSDEEP 1536:GOlKtksCXG7ILGE3/ACyha3LfnMuGnHBOMFU2y:GOlRLjIfa3zBGnHBT+f
TLSH
T1E743F11F061A33D352ABFAD8C1B7D99AF3E894FD377200B5918194949F29119AFC1393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 2KB
SHA256 6fdbd47128f8f6a982ede849bb2c31d4581a56f640c6bd99644ed1a77004b8b5
MD5 c8f109257249c846541e463c6565c279
SHA1 bbf3aa0b6f778fa9919c69c781f87d4cbaaf6841
SHA512 838d8cce74d8c8cfa44ca5f849f749e845fa57d90ca6283b745055ff0dcd35df5dc6635c3a328dfed89aa48c6429ab7c9cc854c148a46eafa3e0e1e8c1386b5d
TLSH
T138513DCF26152885987EBC0CC47066D0FBC474E63FF7907C1971C121416E1E796123B1
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 74KB
SHA256 969fd191a11788e8160da0d14bc48e6a6dfd3a8e800d92139ec2dc7ba2ae56c0
MD5 20c8c662ec0c2f2fef96e496856221a3
SHA1 54ae5ff23c886603d88511371c197ab8cfd0cf85
SHA512 96c080d518b84782f8496e5391a4d86b98901a9708fed006fca6b6fac0e4f77fb97b461495294b123e5975b05c1c9e4d49fa507b0de72ac64b3abdf65c495bdc
SSDEEP 1536:GOlKtksCXG7ILGE3/ACyha3LfnMuGnHBOMFU2Gerael+MO4CUEa:GOlRLjIfa3zBGnHBT+Pkael+3UZ
TLSH
T12173012F0A1E33D352AADADC91A3CD91F3E568F9376600B9918294D14F1851EBFC13A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 3KB
SHA256 b4f6de0d8985727cac591f280002fdcf0fb12a5e0d8d0b3e0ae2eccd583a0d32
MD5 976c1aa3f358090f767f73337fec0e98
SHA1 6d0daa8e3a9ec1ea8070d319db3dfed1a8125094
SHA512 93a70c8f9b9a3b437cf03254dc393bae1215228b99b19e5deec5ae140eb5944f748d3d1e3e0f720adf09d84346da3cf742d150f9edfb987feb1d23ed33396dd4
TLSH
T17D615A8F652564D454BFB82DD8306694EBC420FA7FF3C0BC6A73C516823A2FA9601361
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 88KB
SHA256 6786bf1f4e1b27fde207d516d7d429b400280b9e08b0e79712efeebd584ad59e
MD5 c3f25f75458e4d5f3a42baa87f06ab97
SHA1 2db4c72d5929a04e33005e5c4df9225f96039020
SHA512 7caedce8865a4eb5dc5642c460a59df3102224be3ec1ce1ec91d2c2a0e181cb6b004209df439492d194c55cf89068722f2c9a8f3d8abe725f939727edc2f4ce5
SSDEEP 1536:GOlKtksCXG7ILGE3/ACyha3LfnMuGnHBOMFU2Gerael+MO4CUEPZEOojRfz:GOlRLjIfa3zBGnHBT+Pkael+3UK3oh
TLSH
T1E793021F461F33D362ABEB9892A3DD99F3E968F53B9600B4A14058C54F2451B7EC13A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 5KB
SHA256 8e6e3877dcf74ba6a6e37dffd2b17044f258c11e9346ea596ed54f606d0e53c2
MD5 ed80322d14621b425a37e7b214132d24
SHA1 4f5621639efcee60adf48b97cf70b5538228d296
SHA512 260fb02c0a3c558f6fe7f50b32793c86a36f4f5cf6e26445ef7f9fe5dcec6584b444ce6363173668836140bbd8ab856ffef6f2671b79f4128ea062eede57c341
SSDEEP 96:QLYhz5EmPUPfuhD4EHMqrqON97aRw6aDVE8OgBWHyoO+ScxGfq/b:Q0R5/P42hLOONNz6aDIgMu3pw
TLSH
T152C18ECF210771E5C8BEB95FC071A9D4F7C8D4F077938194A863C81197F90B6D921262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 16KB
SHA256 85d4718a471a3257ab57fbd6e1e321845e4290bb47589a347d61e8de64215668
MD5 237414100c1e77af214e2fabd5fdb832
SHA1 3bb84e5a2a3a5d109d10c9ee8cd2e2bce7bff41d
SHA512 507592be2bd7beede46dc7b80f0ea8c4d70eff1380ca1ad5ccf2e58f48f2887adad3de07093e40193fc7c112165e8215a51e53dd1067648351cb1a4e80445d32
SSDEEP 384:7HJhLOez6O3S8KJ0V4khqcN443P5LxQ+BT4Yh2+:9semOlKO4ksN4BC+dZh2+
TLSH
T1E372CF9B1526359645BEF9CED066E8E8FBC1D8FC238340788411A051EFA603DAE227D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 40KB
SHA256 b4a2db38125d193478a3076f2018cad2b8afd2ac91752ae55c58ec8eae3175d7
MD5 1f06b3879e57ee285949c90b2ce6c6f6
SHA1 dede3938cbdbb87dbb2cc939a04388d9432b1ca5
SHA512 23bc984f93240de498da5387772631b0a8d7fb68f5e3637de5d1d5f30d970a3e8aa3171ba9d80eb14fe879dca9de169d597d06ad2574e66cd2c3190a82824ed6
SSDEEP 768:9semOlKO4ksN4BC+dZh277ItNGKoQ6A/ApYyYQ4Z3LfRpMeuK2:GOlKtksCXG7ILGE3/ACyha3LfnMu2
TLSH
T12B13F11F0A2633C7C2EAF9C9D1A6D949F7E894F9376600B8508184E5EF646266E803D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 863B
SHA256 8d24330016f7a5a39598436980c6c8adcad3016cbf0345993c8b702f9d911b40
MD5 762d32a27cfccc4dfc7a13816c7fbe43
SHA1 720159437385fc92cabcb34eefc7a5e44033cdd3
SHA512 d9077c73088b17c744737756ecdb262758cd635a4a683bb50167d7aa48a57286a50ed7e5b4dba372c89f37357da75a408c80eae267a86cd98e4c2e2475dd32e1
TLSH
T1D211238F3441245678B8762CD17182A0AA9CB8B126D6A5B42F60F24182A959B7625325
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 74KB
SHA256 e9cce2d83f32c02b6ddb980d9599afd44b9b3d9b2f34777d282009828e7538d0
MD5 1a99e171ef78302f085d47bae9043f56
SHA1 6ec66084c635313476fc3593b2dadc62119dcc3c
SHA512 8b0cab9b35b5e996aa3be7a64995b732abfcda10627df399b82c2748f640ee9bb1c0000483f65c7b53af6fd4c9c3c00d9e0c5a169d8308220f89a3cb461806db
SSDEEP 1536:GOlKtksCXG7ILGE3/ACyha3LfnMuGnHBOMFU2Gerael+MO4CUs:GOlRLjIfa3zBGnHBT+Pkael+3Us
TLSH
T19073012F0A1A33C351AADADCD1A3CD91F3E968F937650179918294D54F1851EBFC13A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ToDesk_x64_5.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-7JAEO.tmp\ToDesk_x64_5.tmp
Size 1.1MB
SHA256 cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
MD5 129b8e200a6e90e813080c9ce0474063
SHA1 b5352cdae50e5ddf3eb62f75f2e77042386b8841
SHA512 10949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841
SSDEEP 24576:WEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyb7xyx:bdmbjTKlD00R
TLSH
T17C453A22A3D68433D5732E758D6BC2945C367E202FA4D48A7EF89E0C4E79B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/740-54-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/740-5-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/1460-334-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-541-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-402-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-400-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-399-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-401-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-539-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-328-0x000002135D350000-0x000002135E558000-memory.dmp

Download

memory/1460-474-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-473-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1460-475-0x000002135E560000-0x00000213617D1000-memory.dmp

Download

memory/1976-1289-0x000001B83AE90000-0x000001B83B0BB000-memory.dmp

Download

memory/2260-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2260-77-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3056-544-0x00000247A4F20000-0x00000247A514B000-memory.dmp

Download

memory/3240-1064-0x0000012B3EC10000-0x0000012B3EE3B000-memory.dmp

Download

memory/3264-202-0x0000025211760000-0x000002521184B000-memory.dmp

Download

memory/3264-303-0x0000025211760000-0x000002521184B000-memory.dmp

Download

memory/3264-775-0x0000025211760000-0x000002521184B000-memory.dmp

Download

memory/3264-836-0x0000025211760000-0x000002521184B000-memory.dmp

Download

memory/3264-224-0x0000025211760000-0x000002521184B000-memory.dmp

Download

memory/3264-196-0x0000025211670000-0x0000025211758000-memory.dmp

Download

memory/3264-253-0x0000025211760000-0x000002521184B000-memory.dmp

Download

memory/3264-384-0x0000025211760000-0x000002521184B000-memory.dmp

Download

memory/4500-839-0x00000255416C0000-0x00000255418EB000-memory.dmp

Download

memory/4860-49-0x000001D952660000-0x000001D95288B000-memory.dmp

Download