9250660cbb79a033d53de8cf0540982cdd1addbc57f05c8a300eab86c6d1920c

Analysis

max time kernel
137s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plugx/4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe
Size

665KB
MD5

6741ad202dcef693dceb98b0a10c49fc
SHA1

b1e8ba2c12908c338a1b38c61cc7dab17015bd01
SHA256

4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba
SHA512

1a6f82a5ea41d72b1493ab5cf358249b8018e4cdebe15d6a2f63e202a092779a5f40647bac0b0f9d8556383160b82add9a6205a84aaf43eeb30922761a034f49
SSDEEP

12288:n1IIZygwpE/1UZyMYUkUJIh8E2tFNgw/nK6iUDbD/W/TQ2Y6s/z:nuIIgN1UZp/Ja52tEKnK6pfKLQ2Y6s7

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00060000000142c4-71.dat	aspack_v212_v242
behavioral1/files/0x00060000000142c4-73.dat	aspack_v212_v242
behavioral1/files/0x00060000000142c4-77.dat	aspack_v212_v242
behavioral1/files/0x00060000000142c4-72.dat	aspack_v212_v242
behavioral1/files/0x00060000000142c4-134.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
1476	maze-game.exe
564	mazegame.exe
872	ctfmno.exe
1324	SxS.exe
1684	SxS.exe

Loads dropped DLL 12 IoCs

pid	Process
2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe
2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe
2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe
2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe
2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe
2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe
564	mazegame.exe
564	mazegame.exe
1548	WerFault.exe
1548	WerFault.exe
1548	WerFault.exe
1548	WerFault.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	205.252.144.228
Destination IP	205.252.144.228
Destination IP	61.139.2.69
Destination IP	202.98.96.68
Destination IP	202.98.96.68
Destination IP	61.139.2.69
Destination IP	61.139.2.69
Destination IP	202.98.96.68

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	872	WerFault.exe	29

Modifies data under HKEY_USERS 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A5F7A51-C43E-46B8-A215-B47BC5893323}\56-bd-11-4c-52-8b	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-bd-11-4c-52-8b\WpadDetectedUrl	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A5F7A51-C43E-46B8-A215-B47BC5893323}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A5F7A51-C43E-46B8-A215-B47BC5893323}\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-bd-11-4c-52-8b\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A5F7A51-C43E-46B8-A215-B47BC5893323}\WpadDecisionTime = f07fda9e196dd901	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A5F7A51-C43E-46B8-A215-B47BC5893323}\WpadDecisionTime = 1085909b196dd901	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-bd-11-4c-52-8b	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-bd-11-4c-52-8b\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-bd-11-4c-52-8b\WpadDecisionTime = f07fda9e196dd901	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A5F7A51-C43E-46B8-A215-B47BC5893323}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A5F7A51-C43E-46B8-A215-B47BC5893323}\WpadNetworkName = "Network 3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-bd-11-4c-52-8b\WpadDecisionTime = 1085909b196dd901	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9A5F7A51-C43E-46B8-A215-B47BC5893323}\WpadDecisionTime = c0673dc0196dd901	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-bd-11-4c-52-8b\WpadDecisionTime = c0673dc0196dd901	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 41003100390043003100320034004400420042003700460038003300460045000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
760	svchost.exe
760	svchost.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
760	svchost.exe
760	svchost.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
760	svchost.exe
760	svchost.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
760	svchost.exe
760	svchost.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
760	svchost.exe
760	svchost.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
760	svchost.exe
760	svchost.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
760	svchost.exe
760	svchost.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe
556	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	mazegame.exe
Token: SeTcbPrivilege	564	mazegame.exe
Token: SeDebugPrivilege	1324	SxS.exe
Token: SeTcbPrivilege	1324	SxS.exe
Token: SeDebugPrivilege	1684	SxS.exe
Token: SeTcbPrivilege	1684	SxS.exe
Token: SeDebugPrivilege	760	svchost.exe
Token: SeTcbPrivilege	760	svchost.exe
Token: SeDebugPrivilege	556	msiexec.exe
Token: SeTcbPrivilege	556	msiexec.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1476	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	28
PID 2040 wrote to memory of 1476	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	28
PID 2040 wrote to memory of 1476	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	28
PID 2040 wrote to memory of 1476	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	28
PID 2040 wrote to memory of 564	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	30
PID 2040 wrote to memory of 564	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	30
PID 2040 wrote to memory of 564	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	30
PID 2040 wrote to memory of 564	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	30
PID 2040 wrote to memory of 872	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	29
PID 2040 wrote to memory of 872	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	29
PID 2040 wrote to memory of 872	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	29
PID 2040 wrote to memory of 872	2040	4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe	29
PID 872 wrote to memory of 1548	872	ctfmno.exe	31
PID 872 wrote to memory of 1548	872	ctfmno.exe	31
PID 872 wrote to memory of 1548	872	ctfmno.exe	31
PID 872 wrote to memory of 1548	872	ctfmno.exe	31
PID 564 wrote to memory of 1324	564	mazegame.exe	32
PID 564 wrote to memory of 1324	564	mazegame.exe	32
PID 564 wrote to memory of 1324	564	mazegame.exe	32
PID 564 wrote to memory of 1324	564	mazegame.exe	32
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 1684 wrote to memory of 760	1684	SxS.exe	35
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37
PID 760 wrote to memory of 556	760	svchost.exe	37

C:\Users\Admin\AppData\Local\Temp\plugx\4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe
"C:\Users\Admin\AppData\Local\Temp\plugx\4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\maze-game.exe
  "C:\Users\Admin\AppData\Local\Temp\maze-game.exe"
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\ctfmno.exe
  "C:\Users\Admin\AppData\Local\Temp\ctfmno.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 44
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1548
- C:\Users\Admin\AppData\Local\Temp\mazegame.exe
  "C:\Users\Admin\AppData\Local\Temp\mazegame.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\ProgramData\Microsoft PA\SxS.exe
    "C:\ProgramData\Microsoft PA\SxS.exe" 100 564
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1324

C:\ProgramData\Microsoft PA\SxS.exe
"C:\ProgramData\Microsoft PA\SxS.exe" 200 0
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 300 760
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x484
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft PA\SxS.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
C:\ProgramData\Microsoft PA\SxS.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctfmno.exe

Filesize
9KB

MD5
6d5522331c533a6634d975f25f915530

SHA1
baaefe3b88830bca380721dfa3e57967788f3423

SHA256
6595dbbb8d327d766cdb0228d6f4ac6a8ff1320884c54caf9ca4ee0b4845c6d8

SHA512
4d509c768d4d90957a04e285c31dc8f4083403d650bf0215b0af445b20a9941624bb0aaa54a999da57c56c21ef87930b2d4ab54a0c9063a0f0a7ce0f67aca7db

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctfmno.exe

Filesize
9KB

MD5
6d5522331c533a6634d975f25f915530

SHA1
baaefe3b88830bca380721dfa3e57967788f3423

SHA256
6595dbbb8d327d766cdb0228d6f4ac6a8ff1320884c54caf9ca4ee0b4845c6d8

SHA512
4d509c768d4d90957a04e285c31dc8f4083403d650bf0215b0af445b20a9941624bb0aaa54a999da57c56c21ef87930b2d4ab54a0c9063a0f0a7ce0f67aca7db

Download Submit
C:\Users\Admin\AppData\Local\Temp\maze-game.exe

Filesize
458KB

MD5
469d266169ab4c2604c712c472b75bd7

SHA1
55f62b009ea046f5116a900b716eb3e432b3bf3d

SHA256
038f458a2389182590abfc557e02f423533a564e110f9fc72af6a47d1d162fd7

SHA512
2560d2a1cdacc6554a1202057c3d9bad5aee3d1cdfc1b254ec5160e81189cb4a22031d0b54704dd5abbe1323c0e4468e78196f093bae55c40aa38b03b011b898

Download Submit
C:\Users\Admin\AppData\Local\Temp\maze-game.exe

Filesize
458KB

MD5
469d266169ab4c2604c712c472b75bd7

SHA1
55f62b009ea046f5116a900b716eb3e432b3bf3d

SHA256
038f458a2389182590abfc557e02f423533a564e110f9fc72af6a47d1d162fd7

SHA512
2560d2a1cdacc6554a1202057c3d9bad5aee3d1cdfc1b254ec5160e81189cb4a22031d0b54704dd5abbe1323c0e4468e78196f093bae55c40aa38b03b011b898

Download Submit
C:\Users\Admin\AppData\Local\Temp\maze-game.exe

Filesize
458KB

MD5
469d266169ab4c2604c712c472b75bd7

SHA1
55f62b009ea046f5116a900b716eb3e432b3bf3d

SHA256
038f458a2389182590abfc557e02f423533a564e110f9fc72af6a47d1d162fd7

SHA512
2560d2a1cdacc6554a1202057c3d9bad5aee3d1cdfc1b254ec5160e81189cb4a22031d0b54704dd5abbe1323c0e4468e78196f093bae55c40aa38b03b011b898

Download Submit
C:\Users\Admin\AppData\Local\Temp\mazegame.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
C:\Users\Admin\AppData\Local\Temp\mazegame.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
C:\Users\Admin\AppData\Local\Temp\mazegame.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
\ProgramData\Microsoft PA\SxS.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
\ProgramData\Microsoft PA\SxS.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
\Users\Admin\AppData\Local\Temp\ctfmno.exe

Filesize
9KB

MD5
6d5522331c533a6634d975f25f915530

SHA1
baaefe3b88830bca380721dfa3e57967788f3423

SHA256
6595dbbb8d327d766cdb0228d6f4ac6a8ff1320884c54caf9ca4ee0b4845c6d8

SHA512
4d509c768d4d90957a04e285c31dc8f4083403d650bf0215b0af445b20a9941624bb0aaa54a999da57c56c21ef87930b2d4ab54a0c9063a0f0a7ce0f67aca7db

Download Submit
\Users\Admin\AppData\Local\Temp\ctfmno.exe

Filesize
9KB

MD5
6d5522331c533a6634d975f25f915530

SHA1
baaefe3b88830bca380721dfa3e57967788f3423

SHA256
6595dbbb8d327d766cdb0228d6f4ac6a8ff1320884c54caf9ca4ee0b4845c6d8

SHA512
4d509c768d4d90957a04e285c31dc8f4083403d650bf0215b0af445b20a9941624bb0aaa54a999da57c56c21ef87930b2d4ab54a0c9063a0f0a7ce0f67aca7db

Download Submit
\Users\Admin\AppData\Local\Temp\ctfmno.exe

Filesize
9KB

MD5
6d5522331c533a6634d975f25f915530

SHA1
baaefe3b88830bca380721dfa3e57967788f3423

SHA256
6595dbbb8d327d766cdb0228d6f4ac6a8ff1320884c54caf9ca4ee0b4845c6d8

SHA512
4d509c768d4d90957a04e285c31dc8f4083403d650bf0215b0af445b20a9941624bb0aaa54a999da57c56c21ef87930b2d4ab54a0c9063a0f0a7ce0f67aca7db

Download Submit
\Users\Admin\AppData\Local\Temp\ctfmno.exe

Filesize
9KB

MD5
6d5522331c533a6634d975f25f915530

SHA1
baaefe3b88830bca380721dfa3e57967788f3423

SHA256
6595dbbb8d327d766cdb0228d6f4ac6a8ff1320884c54caf9ca4ee0b4845c6d8

SHA512
4d509c768d4d90957a04e285c31dc8f4083403d650bf0215b0af445b20a9941624bb0aaa54a999da57c56c21ef87930b2d4ab54a0c9063a0f0a7ce0f67aca7db

Download Submit
\Users\Admin\AppData\Local\Temp\ctfmno.exe

Filesize
9KB

MD5
6d5522331c533a6634d975f25f915530

SHA1
baaefe3b88830bca380721dfa3e57967788f3423

SHA256
6595dbbb8d327d766cdb0228d6f4ac6a8ff1320884c54caf9ca4ee0b4845c6d8

SHA512
4d509c768d4d90957a04e285c31dc8f4083403d650bf0215b0af445b20a9941624bb0aaa54a999da57c56c21ef87930b2d4ab54a0c9063a0f0a7ce0f67aca7db

Download Submit
\Users\Admin\AppData\Local\Temp\ctfmno.exe

Filesize
9KB

MD5
6d5522331c533a6634d975f25f915530

SHA1
baaefe3b88830bca380721dfa3e57967788f3423

SHA256
6595dbbb8d327d766cdb0228d6f4ac6a8ff1320884c54caf9ca4ee0b4845c6d8

SHA512
4d509c768d4d90957a04e285c31dc8f4083403d650bf0215b0af445b20a9941624bb0aaa54a999da57c56c21ef87930b2d4ab54a0c9063a0f0a7ce0f67aca7db

Download Submit
\Users\Admin\AppData\Local\Temp\maze-game.exe

Filesize
458KB

MD5
469d266169ab4c2604c712c472b75bd7

SHA1
55f62b009ea046f5116a900b716eb3e432b3bf3d

SHA256
038f458a2389182590abfc557e02f423533a564e110f9fc72af6a47d1d162fd7

SHA512
2560d2a1cdacc6554a1202057c3d9bad5aee3d1cdfc1b254ec5160e81189cb4a22031d0b54704dd5abbe1323c0e4468e78196f093bae55c40aa38b03b011b898

Download Submit
\Users\Admin\AppData\Local\Temp\maze-game.exe

Filesize
458KB

MD5
469d266169ab4c2604c712c472b75bd7

SHA1
55f62b009ea046f5116a900b716eb3e432b3bf3d

SHA256
038f458a2389182590abfc557e02f423533a564e110f9fc72af6a47d1d162fd7

SHA512
2560d2a1cdacc6554a1202057c3d9bad5aee3d1cdfc1b254ec5160e81189cb4a22031d0b54704dd5abbe1323c0e4468e78196f093bae55c40aa38b03b011b898

Download Submit
\Users\Admin\AppData\Local\Temp\mazegame.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
\Users\Admin\AppData\Local\Temp\mazegame.exe

Filesize
146KB

MD5
b9932e02979acc7f4052362925484223

SHA1
483920d4c81f3383a01e76ca8c21f8eaed728d03

SHA256
8769beb0878f1a283749477d74aa817c33b00f01eb7f5b5ca2024753a8222ab5

SHA512
6a0776de45e58bc685b998cd4e769b4a4f2d95b84ee5a5b42e7f502e36b14dff0231dfe797a81c5e1d292d2b7217c1823214c2b3799cb288c3c744bc1834f488

Download Submit
memory/556-141-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/556-142-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/556-143-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/564-114-0x00000000002D0000-0x00000000002FE000-memory.dmp

Filesize
184KB

Download
memory/564-96-0x00000000002D0000-0x00000000002FE000-memory.dmp

Filesize
184KB

Download
memory/760-123-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-149-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-117-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/760-119-0x00000000000A0000-0x00000000000BA000-memory.dmp

Filesize
104KB

Download
memory/760-121-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-157-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-151-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-124-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-126-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-127-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-128-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-132-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-131-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/760-130-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-129-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-145-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/760-135-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/872-112-0x0000000000400000-0x00000000004090B0-memory.dmp

Filesize
36KB

Download
memory/1324-108-0x00000000002B0000-0x00000000002DE000-memory.dmp

Filesize
184KB

Download
memory/1324-136-0x00000000002B0000-0x00000000002DE000-memory.dmp

Filesize
184KB

Download
memory/1324-107-0x0000000000140000-0x000000000015B000-memory.dmp

Filesize
108KB

Download
memory/1324-106-0x00000000002B0000-0x00000000002DE000-memory.dmp

Filesize
184KB

Download
memory/1476-144-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1476-109-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/1684-115-0x00000000001C0000-0x00000000001EE000-memory.dmp

Filesize
184KB

Download
memory/1684-122-0x00000000001C0000-0x00000000001EE000-memory.dmp

Filesize
184KB

Download
memory/2040-95-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download