asyncrat | hxxps://dropmefiles[.]com/oOAIG

Analysis

max time kernel
213s
max time network
216s
platform
windows10_x64
resource
win10-20220414-en
submitted
04-07-2022 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dropmefiles.com/oOAIG

Score

10^/10

asyncrat default rat spyware stealer suricata upx vmprotect

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

5.tcp.eu.ngrok.io:18640

Mutex

kjqhelqiwobhn2lijk

Attributes

delay
1
install
true
install_file
MsEdge.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MsEdge.exe	asyncrat
behavioral1/memory/1712-309-0x0000000000440000-0x0000000000464000-memory.dmp	asyncrat
C:\Users\Admin\AppData\Local\Temp\MsEdge.exe	asyncrat
behavioral1/memory/1712-312-0x00000000024F0000-0x00000000024FC000-memory.dmp	asyncrat
behavioral1/memory/1712-338-0x000000001BFD0000-0x000000001BFE0000-memory.dmp	asyncrat
behavioral1/memory/1712-399-0x000000001C0A0000-0x000000001C104000-memory.dmp	asyncrat

NirSoft WebBrowserPassView 8 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe	WebBrowserPassView
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe	WebBrowserPassView
behavioral1/memory/676-336-0x00000216B1FE0000-0x00000216B245E000-memory.dmp	WebBrowserPassView
C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe	WebBrowserPassView
C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe	WebBrowserPassView
behavioral1/memory/1980-383-0x0000000000E10000-0x000000000128A000-memory.dmp	WebBrowserPassView
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe	WebBrowserPassView
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe	WebBrowserPassView

Nirsoft 12 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe	Nirsoft
behavioral1/memory/676-336-0x00000216B1FE0000-0x00000216B245E000-memory.dmp	Nirsoft
C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe	Nirsoft
behavioral1/memory/1980-383-0x0000000000E10000-0x000000000128A000-memory.dmp	Nirsoft
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\hh.exe	Nirsoft
behavioral1/memory/1484-774-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/5072-797-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
C:\Users\Admin\AppData\Local\Temp\hh.exe	Nirsoft

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

Processes:

Nemesis.exetest.exeEdge.exeMsEdge.exeRegAsm.exeRtkBtManServ.exesnuvcdsm.exewinhlp32.exesplwow64.exehh.exexwizard.exe

pid	process
3872	Nemesis.exe
4280	test.exe
1196	Edge.exe
1712	MsEdge.exe
676	RegAsm.exe
1980	RtkBtManServ.exe
3848	snuvcdsm.exe
1484	winhlp32.exe
5072	splwow64.exe
1580	hh.exe
4348	xwizard.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\winhlp32.exe	upx
C:\Users\Admin\AppData\Local\Temp\winhlp32.exe	upx
C:\Users\Admin\AppData\Local\Temp\splwow64.exe	upx
behavioral1/memory/1484-730-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/5072-733-0x0000000000400000-0x000000000041B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\splwow64.exe	upx
behavioral1/memory/1484-774-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/5072-797-0x0000000000400000-0x000000000041B000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\1\1\test.exe	vmprotect
C:\Users\Admin\Desktop\1\1\test.exe	vmprotect
behavioral1/memory/4280-165-0x0000000000CB0000-0x00000000010A2000-memory.dmp	vmprotect
C:\Users\Admin\Desktop\1\1\1\test_dump.exe	vmprotect

Loads dropped DLL 1 IoCs

Processes:

Nemesis.exe

pid process

3872 Nemesis.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

124 ipecho.net
125 ipecho.net
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

528 timeout.exe

flow	ioc
124	ipecho.net
125	ipecho.net

pid	process
528	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 40 IoCs

Processes:

Nemesis.exechrome.exeRtkBtManServ.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = ffffffff	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Nemesis.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	Nemesis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 4400310000000000e454819610003100340009000400efbee4548196e45481962e0000008455010000000400000000000000000000000000000065f83b003100000010000000	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Nemesis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Nemesis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\NodeSlot = "4"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Nemesis.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Nemesis.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 4400310000000000e4548c9610003100340009000400efbee4548196e4548c962e000000f0ac010000000b000000000000000000000000000000c95336003100000010000000	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Nemesis.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings	RtkBtManServ.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeNemesis.exepowershell.exeMsEdge.exechrome.exesnuvcdsm.exehh.exexwizard.exechrome.exechrome.exe

pid	process
4328	chrome.exe
4328	chrome.exe
2448	chrome.exe
2448	chrome.exe
4812	chrome.exe
4812	chrome.exe
4788	chrome.exe
4788	chrome.exe
4240	chrome.exe
4240	chrome.exe
220	chrome.exe
220	chrome.exe
2316	chrome.exe
2316	chrome.exe
2192	chrome.exe
2192	chrome.exe
3872	Nemesis.exe
3872	Nemesis.exe
3872	Nemesis.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
1712	MsEdge.exe
1712	MsEdge.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
4336	chrome.exe
3848	snuvcdsm.exe
3848	snuvcdsm.exe
3848	snuvcdsm.exe
3848	snuvcdsm.exe
1580	hh.exe
1580	hh.exe
4348	xwizard.exe
4348	xwizard.exe
4348	xwizard.exe
4348	xwizard.exe
4348	xwizard.exe
4348	xwizard.exe
4348	xwizard.exe
4348	xwizard.exe
1544	chrome.exe
1544	chrome.exe
236	chrome.exe
236	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Nemesis.exe

pid process

3872 Nemesis.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

chrome.exe

pid	process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

7zG.exe7zG.exeNemesis.exetest.exeEdge.exeMsEdge.exepowershell.exeRtkBtManServ.exe7zG.exe

description	pid	process
Token: SeRestorePrivilege	4136	7zG.exe
Token: 35	4136	7zG.exe
Token: SeSecurityPrivilege	4136	7zG.exe
Token: SeRestorePrivilege	2208	7zG.exe
Token: 35	2208	7zG.exe
Token: SeSecurityPrivilege	2208	7zG.exe
Token: SeSecurityPrivilege	2208	7zG.exe
Token: SeDebugPrivilege	3872	Nemesis.exe
Token: SeDebugPrivilege	4280	test.exe
Token: SeDebugPrivilege	1196	Edge.exe
Token: SeDebugPrivilege	1712	MsEdge.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	1980	RtkBtManServ.exe
Token: SeRestorePrivilege	4336	7zG.exe
Token: 35	4336	7zG.exe
Token: SeSecurityPrivilege	4336	7zG.exe
Token: SeSecurityPrivilege	4336	7zG.exe

Suspicious use of FindShellTrayWindow 50 IoCs

Processes:

chrome.exe7zG.exe7zG.exe7zG.exe

pid	process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
4136	7zG.exe
2208	7zG.exe
4336	7zG.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

Processes:

chrome.exe

pid	process
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Nemesis.exe

pid process

3872 Nemesis.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2448 wrote to memory of 2536	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 2536	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4228	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4328	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4328	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe
PID 2448 wrote to memory of 4492	2448	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://dropmefiles.com/oOAIG
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb09914f50,0x7ffb09914f60,0x7ffb09914f70
2⤵
PID:2536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1716 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:2
2⤵
PID:4228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2328 /prefetch:8
2⤵
PID:4492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:1
2⤵
PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
2⤵
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4128 /prefetch:8
2⤵
PID:3604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
2⤵
PID:3608

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
2⤵
PID:2000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
2⤵
PID:3400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5396 /prefetch:8
2⤵
PID:4012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6080 /prefetch:8
2⤵
PID:3948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:8
2⤵
PID:3084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
2⤵
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:8
2⤵
PID:4412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
2⤵
PID:4448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
2⤵
PID:4308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3100 /prefetch:8
2⤵
PID:1544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5976 /prefetch:8
2⤵
PID:2632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:8
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5936 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5188 /prefetch:8
2⤵
PID:3736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
2⤵
PID:716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:8
2⤵
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2828 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
2⤵
PID:2344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
2⤵
PID:4712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
2⤵
PID:3948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=880 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5536 /prefetch:8
2⤵
PID:4952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5676 /prefetch:8
2⤵
PID:532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1660,995369803953140048,16641901167268735101,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
2⤵
PID:4024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:528

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\1\" -ad -an -ai#7zMap25329:58:7zEvent15864
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4136

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\1\" -ad -an -ai#7zMap25879:58:7zEvent7358
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2208

C:\Users\Admin\Desktop\1\1\Nemesis.exe
"C:\Users\Admin\Desktop\1\1\Nemesis.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Users\Admin\Desktop\1\1\test.exe
"C:\Users\Admin\Desktop\1\1\test.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Users\Admin\AppData\Local\Temp\$Cache_2467\Edge.exe
"C:\Users\Admin\AppData\Local\Temp\$Cache_2467\Edge.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Users\Admin\AppData\Local\Temp\MsEdge.exe
"C:\Users\Admin\AppData\Local\Temp\MsEdge.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"' & exit
4⤵
PID:1760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
6⤵
- Executes dropped EXE
PID:676

C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
"C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs6CaNypdO0DCzmLh6iuROTWR5OwWqFog8ZXNLl7mdFnAiQ+FRdHxTP0Hxj5wGaoyD+dMmkCeeCgAjgekQr83tLaSurllnbvcRJ5WBiCfJP8h7Dzg4vVxrqMjJw7cC37ZhA=
7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
8⤵
PID:1580

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c compile.bat
9⤵
PID:532

C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3848

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
8⤵
PID:196

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c compile.bat
9⤵
PID:984

C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
10⤵
- Executes dropped EXE
PID:1484

C:\Users\Admin\AppData\Local\Temp\splwow64.exe
C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
10⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\AppData\Local\Temp\hh.exe
C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1580

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
8⤵
PID:2288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c compile.bat
9⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\xwizard.exe
C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"
8⤵
PID:200

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:4240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "MsEdge"
4⤵
PID:3984

C:\Windows\system32\schtasks.exe
schtasks /delete /f /tn "MsEdge"
5⤵
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp485E.tmp.bat""
4⤵
PID:3840

C:\Windows\system32\timeout.exe
timeout 3
5⤵
- Delays execution with timeout.exe
PID:528

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap27330:60:7zEvent9637 -ad -saa -- "C:\Users\Admin\Desktop\1\1\1"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4336

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies
Filesize
20KB

MD5
148c6eafb09ab3ca9f1dfc80a8c20593

SHA1
74bd7678099cb9ade5013f29dd8a47809b447da0

SHA256
525343bedeaa02e3dcfa05dbec79d877c54dc7eaed9d1a6e880b3e979db86a45

SHA512
731a03e3bb5e11b2dccb772b8afb81db93e13693e794159ba9a2fcebac9a1f3a68a5f0cfc9132c3e0c3564a7454c4ccf54df17b401adcc9bfa9a071bc8149c1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
88KB

MD5
5ba13ad4668ac24ab20869c7c422ad4a

SHA1
7aa1d64fe1e0c1794c127322c0c0b709a9ede54c

SHA256
2c70fedcc34e5b4b08e9606d4347316a7fc453449335ad67d3a2e024811d782a

SHA512
fb542d8bd9127dc9d06a18cd5d571a5836ccfd2f977b08669610c65c0083d7197222636180d017214f604fa4a7b26023a4c5a104acff63e348d55a665fd03a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\$Cache_2467\Edge.exe
Filesize
28KB

MD5
0900fded4335b644fc5a6064236a2050

SHA1
546e9292879e58e98af15fa56468a3f051e71ab9

SHA256
acf2a71cba2dc40faf0c8a9a63189beb1cfd5a3601a202b02101cd7b69ec34e8

SHA512
237a98edbaaa5dd7d908dc289bf69b5ea9b8a6262142d5dc511547f15590d0481f5d4eadd59afeea488765239a07f24a9bca45112104fd36208d5f9ef13cf931

Download Submit
C:\Users\Admin\AppData\Local\Temp\$Cache_2467\Edge.exe
Filesize
28KB

MD5
0900fded4335b644fc5a6064236a2050

SHA1
546e9292879e58e98af15fa56468a3f051e71ab9

SHA256
acf2a71cba2dc40faf0c8a9a63189beb1cfd5a3601a202b02101cd7b69ec34e8

SHA512
237a98edbaaa5dd7d908dc289bf69b5ea9b8a6262142d5dc511547f15590d0481f5d4eadd59afeea488765239a07f24a9bca45112104fd36208d5f9ef13cf931

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt
Filesize
4KB

MD5
2a2c44027367530650b09adec9a4ca69

SHA1
4318abf5b3cacbf2693b996529c9689a78b416e7

SHA256
77a569333255bcb58863abd0759924d2b80e02c178e1bf7fee0493080c6c5489

SHA512
d31d7eb4f16654a9ecb4749263a293030ad485efd5fb02b9ad0b92978f41dc7951af9d1028f3a0c4a29bfdc8c98de0df68e9ce6e536ebbb11cbe4c50a9fd8380

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cookies1
Filesize
13KB

MD5
45dc4a2083ce43a37d4352c04f273ab0

SHA1
42d771297bcea8d7f751bce3794b29209720a29c

SHA256
258bd4d718f73d13960f6adde1ceb453e2e8ae62c3ca17aea672a9db01ed1b4b

SHA512
c15ea85d4f565e500ad74cb17502ba082cbfb120828be4658a6bc9aaf24bda282eef80553c7baac092e5a9763cbb5a4f2e72310ae24ee02c68e2d4bb10914b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cookies3
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsEdge.exe
Filesize
118KB

MD5
23a4ae1a02b8056bf8c305711060db1a

SHA1
988f757c8cd628289c311dcc6ee28af563dab9c0

SHA256
8170cd47490cd0a0e8769cc662fe9d7a4e975c34e5fe494b209e0d73bc0d6433

SHA512
5d18f038a1f002335172300b070e6ccf08ba5957e935350c6dc6989957a9be9825f286b368bba3554257197a942309b3fc2bbf0c5f6e7c4dc5cce0979468f883

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsEdge.exe
Filesize
118KB

MD5
23a4ae1a02b8056bf8c305711060db1a

SHA1
988f757c8cd628289c311dcc6ee28af563dab9c0

SHA256
8170cd47490cd0a0e8769cc662fe9d7a4e975c34e5fe494b209e0d73bc0d6433

SHA512
5d18f038a1f002335172300b070e6ccf08ba5957e935350c6dc6989957a9be9825f286b368bba3554257197a942309b3fc2bbf0c5f6e7c4dc5cce0979468f883

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Filesize
4.5MB

MD5
0037943f6133c2d1c92a5f048be977bd

SHA1
0885e4acf99f3be450b7305f235b22da90282030

SHA256
56927619425718dc21c0d0d3c81b708d2581e5b4e47b59c39583ddb4886ef8ff

SHA512
e1025d06df595f8c1b6401258e66d492e985db050ff3919763676afa1a05b84f9ce45e401bb7c975c7f534ce2b615969f7180cb49f6733ce11a87ca53d4ee255

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Filesize
4.5MB

MD5
0037943f6133c2d1c92a5f048be977bd

SHA1
0885e4acf99f3be450b7305f235b22da90282030

SHA256
56927619425718dc21c0d0d3c81b708d2581e5b4e47b59c39583ddb4886ef8ff

SHA512
e1025d06df595f8c1b6401258e66d492e985db050ff3919763676afa1a05b84f9ce45e401bb7c975c7f534ce2b615969f7180cb49f6733ce11a87ca53d4ee255

Download Submit
C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
Filesize
4.4MB

MD5
3405f654559010ca2ae38d786389f0f1

SHA1
8ac5552c64dfc3ccf0c678f6f946ee23719cf43d

SHA256
bc1364d8e68f515f9f35a6b41c11a649b1f514302eb01812c68c9a95a3198b30

SHA512
cb1e5ffed2ab86502ea4236383e9a4211a14b1abda13babbcceea67700c5746b37b4da6e45e10196eb76fa1e6959e71f19c6827466a54df1d5ba5ad2e16fc05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
Filesize
4.4MB

MD5
3405f654559010ca2ae38d786389f0f1

SHA1
8ac5552c64dfc3ccf0c678f6f946ee23719cf43d

SHA256
bc1364d8e68f515f9f35a6b41c11a649b1f514302eb01812c68c9a95a3198b30

SHA512
cb1e5ffed2ab86502ea4236383e9a4211a14b1abda13babbcceea67700c5746b37b4da6e45e10196eb76fa1e6959e71f19c6827466a54df1d5ba5ad2e16fc05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\compile.bat
Filesize
74B

MD5
808099bfbd62ec04f0ed44959bbc6160

SHA1
f4b6853d958c2c4416f6e4a5be8a11d86f64c023

SHA256
f465a1bd2f9a3efcf0589f0b1c234d285f2bebf7416b324271d987a282915ca8

SHA512
e4f75253a402f0f5d5c651cde045757dad0d4312be023fabf279d7c053fde6ba63cf387551a0451585a87f929634e0bfa73a06dac85ecd1bb5bc0b72bb98e1f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\compile.bat
Filesize
156B

MD5
eb51755b637423154d1341c6ee505f50

SHA1
d71d27e283b26e75e58c0d02f91d91a2e914c959

SHA256
db903aae119dc795581080a528ba04286be11be7e9d417305d77123545fbf0f9

SHA512
e23463fe0a3719c2700826b55f375f60e5e67f3e432aa8e90c5afc8f449fc635aa4c031f9b6fa71344a8da9542585b74e4c812383043868a10a1065d477acee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\compile.vbs
Filesize
265B

MD5
ca906422a558f4bc9e471709f62ec1a9

SHA1
e3da070007fdeae52779964df6f71fcb697ffb06

SHA256
abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee

SHA512
661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b

Download Submit
C:\Users\Admin\AppData\Local\Temp\compile.vbs
Filesize
265B

MD5
ca906422a558f4bc9e471709f62ec1a9

SHA1
e3da070007fdeae52779964df6f71fcb697ffb06

SHA256
abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee

SHA512
661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b

Download Submit
C:\Users\Admin\AppData\Local\Temp\config
Filesize
108B

MD5
1ba367d0f9aac0f650e65ab7401776c0

SHA1
75cf3295125cfaa0c247ebccc57e63f915198683

SHA256
68c4ec552c98f3b5a4744e4eefadd6364dc8075c2e718b7bcbfc76625aa60d03

SHA512
45ccdf02314fe01948aa2ecddb3b50f68d5b32d8542e3a3aeaf3f2920e2285d3b75ebb81b9eb9fb9e0a446af5a3708720e07672874d5d38871dbdcd09483449c

Download Submit
C:\Users\Admin\AppData\Local\Temp\hh.exe
Filesize
103KB

MD5
4d4c98eca32b14aeb074db34cd0881e4

SHA1
92f213d609bba05d41d6941652a88c44936663a4

SHA256
4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

SHA512
959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\hh.exe
Filesize
103KB

MD5
4d4c98eca32b14aeb074db34cd0881e4

SHA1
92f213d609bba05d41d6941652a88c44936663a4

SHA256
4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

SHA512
959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
Filesize
391KB

MD5
053778713819beab3df309df472787cd

SHA1
99c7b5827df89b4fafc2b565abed97c58a3c65b8

SHA256
f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe

SHA512
35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
Filesize
391KB

MD5
053778713819beab3df309df472787cd

SHA1
99c7b5827df89b4fafc2b565abed97c58a3c65b8

SHA256
f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe

SHA512
35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\splwow64.exe
Filesize
49KB

MD5
0d8360781e488e250587a17fbefa646c

SHA1
29bc9b438efd70defa8fc45a6f8ee524143f6d04

SHA256
ebff7d07efda7245192ce6ecd7767578152b515b510c887ca2880a2566071f64

SHA512
940a98f282473c6f706783b41b72eccce88620e12db1f91be6425f087284746e6e10d4d9420b5e79e87ec3a2fd595b9fe301576e39a4db6bd3daa4aa93a9042e

Download Submit
C:\Users\Admin\AppData\Local\Temp\splwow64.exe
Filesize
49KB

MD5
0d8360781e488e250587a17fbefa646c

SHA1
29bc9b438efd70defa8fc45a6f8ee524143f6d04

SHA256
ebff7d07efda7245192ce6ecd7767578152b515b510c887ca2880a2566071f64

SHA512
940a98f282473c6f706783b41b72eccce88620e12db1f91be6425f087284746e6e10d4d9420b5e79e87ec3a2fd595b9fe301576e39a4db6bd3daa4aa93a9042e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp485E.tmp.bat
Filesize
158B

MD5
7138ffe9a289bd24cbdc717487b398d4

SHA1
3b9fd096ca153f7d257fdb5a22339236d32f5a00

SHA256
5df5895839ed15e15c7a59d6764c2161243b4c8d948ddeb2ba771093db0200c9

SHA512
4b805b5b99556c96fc6751456f5976fda96a4658458da82bdda591ed65e308f293ccc6fb4e608b8539a855093cc852a01d83e9626859d4d5a30d19a2aee38bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
Filesize
184KB

MD5
a776e68f497c996788b406a3dc5089eb

SHA1
45bf5e512752389fe71f20b64aa344f6ca0cad50

SHA256
071e26ddf5323dd9ed6671bcde89df73d78bac2336070e6cb9e3e4b93bde78d1

SHA512
02b1234ad37b768b9bcba74daf16e6b45b777f340dac0b64a85166fdd793955e3d7f88a95142b603b198e504ef1173618f840511bcdb70448f71aed19c009073

Download Submit
C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
Filesize
184KB

MD5
a776e68f497c996788b406a3dc5089eb

SHA1
45bf5e512752389fe71f20b64aa344f6ca0cad50

SHA256
071e26ddf5323dd9ed6671bcde89df73d78bac2336070e6cb9e3e4b93bde78d1

SHA512
02b1234ad37b768b9bcba74daf16e6b45b777f340dac0b64a85166fdd793955e3d7f88a95142b603b198e504ef1173618f840511bcdb70448f71aed19c009073

Download Submit
C:\Users\Admin\Desktop\1\1\1\test_dump.exe
Filesize
3.9MB

MD5
e9f1eb7f00446c69fbcc3b5ed33cb044

SHA1
fa47a3e87e0a600ab8e5d04088c0e39fdd99e96f

SHA256
997762279d181cedc329754ecc621d10f9fd726738e328f754875aeb0caf5d3c

SHA512
c9b3aff32dc53cf871d23775bbffe48f34e0faf58539fdd723a94494a6e5ee729b4d0973a14b3fd1c76f6e5896955f2bb6f924eb288db0711f11319647b37b7b

Download Submit
C:\Users\Admin\Desktop\1\1\MetroFramework.Fonts.dll
Filesize
656KB

MD5
65ef4b23060128743cef937a43b82aa3

SHA1
cc72536b84384ec8479b9734b947dce885ef5d31

SHA256
c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26

SHA512
d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7

Download Submit
C:\Users\Admin\Desktop\1\1\MetroFramework.dll
Filesize
345KB

MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
C:\Users\Admin\Desktop\1\1\Nemesis.dll
Filesize
85KB

MD5
cb105d3e5eb5a8f6ecedb6d8f4b757a1

SHA1
16f7830713eac8874bd04db23bed21c4197613ff

SHA256
55db85679a03270f13c82afac7c09d61743b087c7337297ffd77a27d393a5f8e

SHA512
d282bbc66eac7102cebf6bdefa1ed44874a3759f234116efb1f9bbaf1eab84f55cbab9b91fe76e64a5b332f5cdcef6658db6626b51a81179d72fc5a650ed9f07

Download Submit
C:\Users\Admin\Desktop\1\1\Nemesis.exe
Filesize
42KB

MD5
9635d5391c79b7dd9836211e7782bd95

SHA1
5b611f7014ec17a2ded672a7c9f9c3cf32ba88cf

SHA256
c794abac9761a004f8c2821fa745591d2bd641380fb17d020f6452f0a6b24328

SHA512
66ae80c2d89eb8cc865562423f84992d155f8204e19c8b079de4265a1550ad4e857debbb1ef0c32489f0049692a4be649b56291aa2064ab0f312ab5cc373366b

Download Submit
C:\Users\Admin\Desktop\1\1\Nemesis.exe
Filesize
42KB

MD5
9635d5391c79b7dd9836211e7782bd95

SHA1
5b611f7014ec17a2ded672a7c9f9c3cf32ba88cf

SHA256
c794abac9761a004f8c2821fa745591d2bd641380fb17d020f6452f0a6b24328

SHA512
66ae80c2d89eb8cc865562423f84992d155f8204e19c8b079de4265a1550ad4e857debbb1ef0c32489f0049692a4be649b56291aa2064ab0f312ab5cc373366b

Download Submit
C:\Users\Admin\Desktop\1\1\test.exe
Filesize
2.6MB

MD5
3d77e6cec127ee4dfa7350ed7038db9f

SHA1
e9daf9e0956bde131f9675adf9c858f145f7b448

SHA256
f355620b09bac67c2b77aae7f2db6e3142abb547d63215127091d1288819f5a3

SHA512
389d23ef28ffd42dd706c576950465032e203b924e1758e16e145aa5138ce039978f07c69213459f8eb2a8639dac4457eba9cf30a1ab2f0912d615dc7b64e148

Download Submit
C:\Users\Admin\Desktop\1\1\test.exe
Filesize
2.6MB

MD5
3d77e6cec127ee4dfa7350ed7038db9f

SHA1
e9daf9e0956bde131f9675adf9c858f145f7b448

SHA256
f355620b09bac67c2b77aae7f2db6e3142abb547d63215127091d1288819f5a3

SHA512
389d23ef28ffd42dd706c576950465032e203b924e1758e16e145aa5138ce039978f07c69213459f8eb2a8639dac4457eba9cf30a1ab2f0912d615dc7b64e148

Download Submit
\??\pipe\crashpad_2448_PGJEEEXIGSZCOCZK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\Desktop\1\1\Nemesis.dll
Filesize
85KB

MD5
cb105d3e5eb5a8f6ecedb6d8f4b757a1

SHA1
16f7830713eac8874bd04db23bed21c4197613ff

SHA256
55db85679a03270f13c82afac7c09d61743b087c7337297ffd77a27d393a5f8e

SHA512
d282bbc66eac7102cebf6bdefa1ed44874a3759f234116efb1f9bbaf1eab84f55cbab9b91fe76e64a5b332f5cdcef6658db6626b51a81179d72fc5a650ed9f07

Download Submit
memory/196-618-0x0000000000000000-mapping.dmp

Download
memory/200-962-0x0000000000000000-mapping.dmp

Download
memory/528-404-0x0000000000000000-mapping.dmp

Download
memory/532-538-0x0000000000000000-mapping.dmp

Download
memory/676-336-0x00000216B1FE0000-0x00000216B245E000-memory.dmp

Filesize
4.5MB

Download
memory/676-333-0x0000000000000000-mapping.dmp

Download
memory/984-684-0x0000000000000000-mapping.dmp

Download
memory/1196-265-0x0000000000990000-0x000000000099E000-memory.dmp

Filesize
56KB

Download
memory/1196-227-0x0000000000000000-mapping.dmp

Download
memory/1484-700-0x0000000000000000-mapping.dmp

Download
memory/1484-730-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1484-774-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1580-472-0x0000000000000000-mapping.dmp

Download
memory/1580-768-0x0000000000000000-mapping.dmp

Download
memory/1712-399-0x000000001C0A0000-0x000000001C104000-memory.dmp

Filesize
400KB

Download
memory/1712-305-0x0000000000000000-mapping.dmp

Download
memory/1712-309-0x0000000000440000-0x0000000000464000-memory.dmp

Filesize
144KB

Download
memory/1712-311-0x000000001BEF0000-0x000000001BF66000-memory.dmp

Filesize
472KB

Download
memory/1712-312-0x00000000024F0000-0x00000000024FC000-memory.dmp

Filesize
48KB

Download
memory/1712-313-0x000000001B050000-0x000000001B06E000-memory.dmp

Filesize
120KB

Download
memory/1712-338-0x000000001BFD0000-0x000000001BFE0000-memory.dmp

Filesize
64KB

Download
memory/1760-314-0x0000000000000000-mapping.dmp

Download
memory/1980-455-0x0000000005D10000-0x0000000005D18000-memory.dmp

Filesize
32KB

Download
memory/1980-417-0x0000000001B40000-0x0000000001B4C000-memory.dmp

Filesize
48KB

Download
memory/1980-458-0x0000000009FD0000-0x0000000009FD8000-memory.dmp

Filesize
32KB

Download
memory/1980-422-0x0000000008730000-0x0000000008796000-memory.dmp

Filesize
408KB

Download
memory/1980-421-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

Filesize
40KB

Download
memory/1980-423-0x00000000087A0000-0x0000000008842000-memory.dmp

Filesize
648KB

Download
memory/1980-397-0x0000000005C80000-0x0000000005CF6000-memory.dmp

Filesize
472KB

Download
memory/1980-392-0x0000000005B00000-0x0000000005BB0000-memory.dmp

Filesize
704KB

Download
memory/1980-383-0x0000000000E10000-0x000000000128A000-memory.dmp

Filesize
4.5MB

Download
memory/1980-459-0x0000000009FE0000-0x0000000009FE8000-memory.dmp

Filesize
32KB

Download
memory/1980-463-0x000000000A1C0000-0x000000000A1DE000-memory.dmp

Filesize
120KB

Download
memory/1980-339-0x0000000000000000-mapping.dmp

Download
memory/1980-416-0x0000000005BE0000-0x0000000005C02000-memory.dmp

Filesize
136KB

Download
memory/1980-420-0x0000000008680000-0x00000000086BC000-memory.dmp

Filesize
240KB

Download
memory/1980-419-0x0000000005C10000-0x0000000005C40000-memory.dmp

Filesize
192KB

Download
memory/1980-456-0x0000000009BF0000-0x0000000009F40000-memory.dmp

Filesize
3.3MB

Download
memory/1980-418-0x0000000001B70000-0x0000000001B8A000-memory.dmp

Filesize
104KB

Download
memory/2288-828-0x0000000000000000-mapping.dmp

Download
memory/3840-401-0x0000000000000000-mapping.dmp

Download
memory/3848-553-0x0000000000000000-mapping.dmp

Download
memory/3872-124-0x00000296D8180000-0x00000296D81A2000-memory.dmp

Filesize
136KB

Download
memory/3872-173-0x00000296F0AE9000-0x00000296F0AEF000-memory.dmp

Filesize
24KB

Download
memory/3872-310-0x00000296F0AE9000-0x00000296F0AEF000-memory.dmp

Filesize
24KB

Download
memory/3872-126-0x00000296F28E0000-0x00000296F298A000-memory.dmp

Filesize
680KB

Download
memory/3872-123-0x00000296D81B0000-0x00000296D820C000-memory.dmp

Filesize
368KB

Download
memory/3872-121-0x00000296D64A0000-0x00000296D64B0000-memory.dmp

Filesize
64KB

Download
memory/3872-337-0x00000296F0AE9000-0x00000296F0AEF000-memory.dmp

Filesize
24KB

Download
memory/3984-400-0x0000000000000000-mapping.dmp

Download
memory/3992-893-0x0000000000000000-mapping.dmp

Download
memory/4240-970-0x0000000000000000-mapping.dmp

Download
memory/4280-159-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-164-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-188-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-207-0x000000000ABF0000-0x000000000AFB0000-memory.dmp

Filesize
3.8MB

Download
memory/4280-196-0x000000000A6F0000-0x000000000ABEE000-memory.dmp

Filesize
5.0MB

Download
memory/4280-202-0x000000000A290000-0x000000000A29A000-memory.dmp

Filesize
40KB

Download
memory/4280-200-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-199-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-198-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-197-0x000000000A2D0000-0x000000000A362000-memory.dmp

Filesize
584KB

Download
memory/4280-194-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-195-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-193-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-192-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-191-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-190-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-189-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-187-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-186-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-185-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-184-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-183-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-182-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-181-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-180-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-179-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-178-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-177-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-176-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-175-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-174-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-172-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-171-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-168-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-167-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-166-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-165-0x0000000000CB0000-0x00000000010A2000-memory.dmp

Filesize
3.9MB

Download
memory/4280-212-0x0000000006920000-0x00000000069BC000-memory.dmp

Filesize
624KB

Download
memory/4280-163-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-162-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-161-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-160-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-158-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-157-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-156-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-155-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-154-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-153-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-152-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-151-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-150-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-149-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-148-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-147-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-146-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-145-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-144-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-143-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-142-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-130-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-131-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-132-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-140-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-141-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-139-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-138-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-133-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-134-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-136-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4280-135-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4320-402-0x0000000000000000-mapping.dmp

Download
memory/4348-907-0x0000000000000000-mapping.dmp

Download
memory/4536-315-0x0000000000000000-mapping.dmp

Download
memory/5072-797-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5072-733-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5072-716-0x0000000000000000-mapping.dmp

Download