40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f.exe
Size

3.9MB
MD5

40c7b28ae79b11198b3be7c7de664f68
SHA1

ef3a6270e75f5d334ba780dd8f7818548b0e6d81
SHA256

40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f
SHA512

52dc5b17f633c1e2370b7927b9de59dd9afc2f905c1222f786f324cb28d1f983694048701bd9201142e54b107c99832b4af82ea647a389e12a820564b3a71bf2
SSDEEP

98304:EL+TeMMOQ/on3tkX1v2FQ03Le/8Vy5opUi:4+yP/+3tav2K03CEVyeUi

Score

8^/10

discovery evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 11 IoCs

pid	Process
2808	ContainerPerf.exe
2896	services.exe
1972	services.exe
1752	services.exe
2872	services.exe
2684	services.exe
1468	services.exe
1968	services.exe
1064	services.exe
2700	services.exe
2096	services.exe

Loads dropped DLL 2 IoCs

pid	Process
2664	cmd.exe
2664	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
21	pastebin.com
25	pastebin.com
9	pastebin.com
12	pastebin.com
18	pastebin.com
22	pastebin.com
28	pastebin.com
31	pastebin.com
34	pastebin.com
4	pastebin.com
5	pastebin.com
15	pastebin.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\conhost.exe	ContainerPerf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\088424020bedd6	ContainerPerf.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\conhost.exe	ContainerPerf.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\fr-FR\conhost.exe	ContainerPerf.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\088424020bedd6	ContainerPerf.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\AuthCabs\cmd.exe	ContainerPerf.exe
File created	C:\Windows\SoftwareDistribution\AuthCabs\ebf1f9fa8afd6d	ContainerPerf.exe
File created	C:\Windows\PCHEALTH\services.exe	ContainerPerf.exe
File created	C:\Windows\PCHEALTH\c5b4cb5e9653cc	ContainerPerf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2616	PING.EXE
1936	PING.EXE
2800	PING.EXE
1996	PING.EXE
1868	PING.EXE
2732	PING.EXE
1692	PING.EXE
684	PING.EXE

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2804	reg.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
684	PING.EXE
2616	PING.EXE
1936	PING.EXE
2800	PING.EXE
1996	PING.EXE
1868	PING.EXE
2732	PING.EXE
1692	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe
2808	ContainerPerf.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	ContainerPerf.exe
Token: SeDebugPrivilege	2896	services.exe
Token: SeDebugPrivilege	1972	services.exe
Token: SeDebugPrivilege	1752	services.exe
Token: SeDebugPrivilege	2872	services.exe
Token: SeDebugPrivilege	2684	services.exe
Token: SeDebugPrivilege	1468	services.exe
Token: SeDebugPrivilege	1968	services.exe
Token: SeDebugPrivilege	1064	services.exe
Token: SeDebugPrivilege	2700	services.exe
Token: SeDebugPrivilege	2096	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2836	2640	40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f.exe	30
PID 2640 wrote to memory of 2836	2640	40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f.exe	30
PID 2640 wrote to memory of 2836	2640	40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f.exe	30
PID 2640 wrote to memory of 2836	2640	40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f.exe	30
PID 2836 wrote to memory of 2664	2836	WScript.exe	31
PID 2836 wrote to memory of 2664	2836	WScript.exe	31
PID 2836 wrote to memory of 2664	2836	WScript.exe	31
PID 2836 wrote to memory of 2664	2836	WScript.exe	31
PID 2664 wrote to memory of 2804	2664	cmd.exe	33
PID 2664 wrote to memory of 2804	2664	cmd.exe	33
PID 2664 wrote to memory of 2804	2664	cmd.exe	33
PID 2664 wrote to memory of 2804	2664	cmd.exe	33
PID 2664 wrote to memory of 2808	2664	cmd.exe	34
PID 2664 wrote to memory of 2808	2664	cmd.exe	34
PID 2664 wrote to memory of 2808	2664	cmd.exe	34
PID 2664 wrote to memory of 2808	2664	cmd.exe	34
PID 2808 wrote to memory of 2936	2808	ContainerPerf.exe	35
PID 2808 wrote to memory of 2936	2808	ContainerPerf.exe	35
PID 2808 wrote to memory of 2936	2808	ContainerPerf.exe	35
PID 2936 wrote to memory of 2500	2936	cmd.exe	37
PID 2936 wrote to memory of 2500	2936	cmd.exe	37
PID 2936 wrote to memory of 2500	2936	cmd.exe	37
PID 2936 wrote to memory of 2616	2936	cmd.exe	38
PID 2936 wrote to memory of 2616	2936	cmd.exe	38
PID 2936 wrote to memory of 2616	2936	cmd.exe	38
PID 2936 wrote to memory of 2896	2936	cmd.exe	39
PID 2936 wrote to memory of 2896	2936	cmd.exe	39
PID 2936 wrote to memory of 2896	2936	cmd.exe	39
PID 2896 wrote to memory of 1792	2896	services.exe	41
PID 2896 wrote to memory of 1792	2896	services.exe	41
PID 2896 wrote to memory of 1792	2896	services.exe	41
PID 1792 wrote to memory of 2152	1792	cmd.exe	43
PID 1792 wrote to memory of 2152	1792	cmd.exe	43
PID 1792 wrote to memory of 2152	1792	cmd.exe	43
PID 1792 wrote to memory of 1936	1792	cmd.exe	44
PID 1792 wrote to memory of 1936	1792	cmd.exe	44
PID 1792 wrote to memory of 1936	1792	cmd.exe	44
PID 1792 wrote to memory of 1972	1792	cmd.exe	45
PID 1792 wrote to memory of 1972	1792	cmd.exe	45
PID 1792 wrote to memory of 1972	1792	cmd.exe	45
PID 1972 wrote to memory of 1940	1972	services.exe	46
PID 1972 wrote to memory of 1940	1972	services.exe	46
PID 1972 wrote to memory of 1940	1972	services.exe	46
PID 1940 wrote to memory of 2216	1940	cmd.exe	48
PID 1940 wrote to memory of 2216	1940	cmd.exe	48
PID 1940 wrote to memory of 2216	1940	cmd.exe	48
PID 1940 wrote to memory of 1268	1940	cmd.exe	49
PID 1940 wrote to memory of 1268	1940	cmd.exe	49
PID 1940 wrote to memory of 1268	1940	cmd.exe	49
PID 1940 wrote to memory of 1752	1940	cmd.exe	50
PID 1940 wrote to memory of 1752	1940	cmd.exe	50
PID 1940 wrote to memory of 1752	1940	cmd.exe	50
PID 1752 wrote to memory of 2364	1752	services.exe	51
PID 1752 wrote to memory of 2364	1752	services.exe	51
PID 1752 wrote to memory of 2364	1752	services.exe	51
PID 2364 wrote to memory of 2856	2364	cmd.exe	53
PID 2364 wrote to memory of 2856	2364	cmd.exe	53
PID 2364 wrote to memory of 2856	2364	cmd.exe	53
PID 2364 wrote to memory of 2824	2364	cmd.exe	54
PID 2364 wrote to memory of 2824	2364	cmd.exe	54
PID 2364 wrote to memory of 2824	2364	cmd.exe	54
PID 2364 wrote to memory of 2872	2364	cmd.exe	55
PID 2364 wrote to memory of 2872	2364	cmd.exe	55
PID 2364 wrote to memory of 2872	2364	cmd.exe	55

C:\Users\Admin\AppData\Local\Temp\40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f.exe
"C:\Users\Admin\AppData\Local\Temp\40d3609e3b05566993450c98a53b3d310ac0da5b2f6a7ce9dae3cff69ddc4f7f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mschaincontainerProviderdriver\p5L4tCZskQSKrAp9i73GV6nTpbyIueed5yrdR5MhJJcsf1DbOcdt.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\mschaincontainerProviderdriver\QyeawRlrHW2G8u24NG4SBrEnR4w14yBdhDTq.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2804
  - - C:\mschaincontainerProviderdriver\ContainerPerf.exe
      "C:\mschaincontainerProviderdriver/ContainerPerf.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a5vrKwwupZ.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2936
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2500
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2616
      - C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PX3O4psMNH.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1936
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Qwmke0eayG.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1268
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s6L5myzuOs.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2824
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2yB5vkEA4A.bat"
        13⤵
        
        PID:1748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2988
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2800
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U5BoPe2aCH.bat"
        15⤵
        
        PID:2512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1996
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpiwJJ3Pd2.bat"
        17⤵
        
        PID:2204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2604
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mCHKcGl2nx.bat"
        19⤵
        
        PID:2288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1816
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1868
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PEEvsyJdYA.bat"
        21⤵
        
        PID:3048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:976
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2732
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\upHCHH0RIK.bat"
        23⤵
        
        PID:2916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1244
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1692
        
        C:\Windows\PCHEALTH\services.exe
        
        "C:\Windows\PCHEALTH\services.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gbxaZFyaug.bat"
        25⤵
        
        PID:2240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2yB5vkEA4A.bat

Filesize
160B

MD5
d6b0fcc2906eefe225edd00199ccf6ba

SHA1
c999ba752ac7464a831bc39f20a46c882fafd8b7

SHA256
93b6518522d218a76e11ebd36b2af6de1153d86f9b50937b8815c518cade5c20

SHA512
ad82fa8a9b9b3acbab9b371ee99b819cff955f4bc8b094ecf35e9c74b37a28a919b48188090a381bc9dcd102e8bcbd4aa713c3618de27fe08a8a36d7fce79815

Download Submit
C:\Users\Admin\AppData\Local\Temp\PEEvsyJdYA.bat

Filesize
160B

MD5
809470e001f7a92720037cde718458cf

SHA1
0f9d49c6a447836453e306709d5b8ecfbb039621

SHA256
a078c525c86e6652775d6d3b84a59e5c9880dc68535c972c69bfc02cc315c029

SHA512
86232743595fbb65e8f36d3a41ba5bb0f047a40310f39f357a3dcd20383a7da0ad7ccc72970628db70adb480c06fa29521914eef7a2b71d8e8023220a55798c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\PX3O4psMNH.bat

Filesize
160B

MD5
4254e09bcd4418888d75bd35d763f5b6

SHA1
82efe3e54d33d274eccf7a747dcc33349f7c3c93

SHA256
a64b5191beb1f0c37f993948009181a31d3b7e6c15631f86a6fb1e0b97a540d2

SHA512
53d7a9e4ecad6d1d6b00f24477d75461af5bf33473acd9fc99f40cdffd11ac771d9534c324fba74d85fa847ae6d13b1a3cb3d1b87e598ca4f259f5237efda0ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qwmke0eayG.bat

Filesize
208B

MD5
92e95c09137b8986b871e3b8139ebffc

SHA1
245412b7b97bde8693bd8a6d61549c9210523908

SHA256
d2d7557b28a3e6bf29c0c392e448de283d35d048f8a26b2667efa5536dc9fef3

SHA512
2fe63870307f0d6383888fc71ffb55b2045fd535d2fd4491eacef938ca91ea18e856241ad9f1c0fe3bf3f721d54505018c24b642a4095a038009a122ff13a82e

Download Submit
C:\Users\Admin\AppData\Local\Temp\U5BoPe2aCH.bat

Filesize
160B

MD5
ceb7c7a68fa671249e2259de01602582

SHA1
c56b5a8a5e65cf83c30063c552991acd0caf735e

SHA256
a48f99db8eb61d6806f7648774f73077efbde3435e8e7270d1c27265f96cbe53

SHA512
46b4ad6aefd8a6bdf315da710a57fa274347a10020f7667e4b41445d3223fd01ef761df0653472456e9954369c03ac7bac63514cde4d413931f1fd59c861d47c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5vrKwwupZ.bat

Filesize
160B

MD5
52a3b72e0eb567a6d4edd2cc214511c3

SHA1
4daa1c98002ab2fffd4c7c35b9dcdf329b50e181

SHA256
334cb4f6a8053fc003e6758251fd7c3b96c8111efd88dcf9f5faac7f4aa0c977

SHA512
8937fec8a111b311e5678da8a1a168d1043fdf08e67e3e96047f26edadcdd3fe13c0ceb479ce610bd72a5d2bd2ef1ae110e7b0edaa615857d5a2e2bbc07a9f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbxaZFyaug.bat

Filesize
160B

MD5
32337d72b5a38f0e17280b9d404cb18b

SHA1
b731b7897c48a9c886f397001351a6b0c53c61b7

SHA256
6b360e0e2e8c73e72b9afac61d40c8f9a5be214a95617d31d2d823e6a92f334d

SHA512
66dc386ce778b27e22508085285c08baad9aa49642488144fd3a5f9a783a1e34e0c98e11aaf033a8b68f1a050e642546d6e37e942666f51b39c6c5b24bbefdf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\mCHKcGl2nx.bat

Filesize
160B

MD5
872a6e0cb143f30daff0dbbaa66263d5

SHA1
da7b097e7fa6f1842ac647ef9e9a9e376250350b

SHA256
a2c876591d1012dcf9fd3a4e04f512b35178da93ade3c00eb92385bb98dc68e2

SHA512
a93b23e2b5090e91fca68c4aed975a21b3fe43950b4a4167c2a5e7b7298ffbc9c336aef5c18932f77804efc011b36118a4b3bb7d22201644b315c7fc0dbc6cd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\s6L5myzuOs.bat

Filesize
208B

MD5
884de864faaa38f6ea4437e2a3439e08

SHA1
128541d13b5fd9ab55579aa70b717414b2766980

SHA256
dad9b16feb8b0e2842ce885c0b815d3bf3c1f92b8d161453de30d737f7952126

SHA512
347c7eb588e7f984fe9d04d7b5558a3e68c6e163d7cbaf813ec809addf9e524f3412b50e3f02c7b0e4e78c1285ba38e3c3edddd3cd42dad0987f911df4e6d1ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\tpiwJJ3Pd2.bat

Filesize
208B

MD5
0562f56aed5478a0a4b15f294e1a48b0

SHA1
8de75e6055d7f42b201faf7fa2f068901183a30d

SHA256
2ef0c44877a6907b4031eaf005de29f6fbae8bb2a3ddf271db6c5f0bdda70ae6

SHA512
49e4493d5fcbd1f14c7a1c864a770c1208a205f130a3c8a5e12f66fe5fdbef2cd60ff56c41c7cbea50e6ed34488a499974927ed039e5a1c12b751a4d6a3298d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\upHCHH0RIK.bat

Filesize
160B

MD5
19855ab91448db11acc631c4d590afc0

SHA1
53f224516b168946b65be069e5675353df503597

SHA256
40545d073327f111dc702204fe2a0f9be4848d3f88d4e3d9caa4ff146cc3ed7d

SHA512
19253555d955bdd2101d6caff84d6873bbc58df41a74b9afd3aeea08f7b7aff2e1a30a7aba755f3e87e3726733bb3e33db602766b089581a2bc531cc361d5973

Download Submit
C:\mschaincontainerProviderdriver\ContainerPerf.exe

Filesize
3.7MB

MD5
6185ea8036d5aa44c2919566858cfeae

SHA1
206ce3b84d8427c010191f317371aceb00c410f6

SHA256
c807156a66ce066352e4fc3e6538eabf623a4c5546c27fa998ab9a95f858be17

SHA512
a6465963ee9e8dd18cd010eb55c39a6e320c465eed1090c63af6b6ed3de1865370d802f6f2e8df8200ead06a0acd6e4e48035783212244e9684a2413b4e605e4

Download Submit
C:\mschaincontainerProviderdriver\QyeawRlrHW2G8u24NG4SBrEnR4w14yBdhDTq.bat

Filesize
201B

MD5
40d7188fe8d29e0f457d9e2e78488a38

SHA1
0e98fa35202e227c6cac8d35ea86d62e37069e5e

SHA256
2cfe393f5c596ce1801d783fc260c657a7637da6d5828acc34d5dcefcc8b850d

SHA512
57cc20264eee8edcfbaaece38a909dafe3bb41abfe423ee6d698d89bce80ce9fc137186e37b03abecdc4447494188c0bc1e04861a8219c9dc375893cc6cdda9f

Download Submit
C:\mschaincontainerProviderdriver\p5L4tCZskQSKrAp9i73GV6nTpbyIueed5yrdR5MhJJcsf1DbOcdt.vbe

Filesize
244B

MD5
bda640ef3524c0357ec9fb8a6aa807ce

SHA1
8461b1ebc21ef92a235f44ba3e8e27875ed5bf03

SHA256
a6d4a7417bf93799852f65eda82a632c9787d3cd5827280b5bd37efdd46341fb

SHA512
ef804407ef57472b351d9adbcc71064e7ba7817c58e042a1d92e092e3acd1ed12810aa51216649984693d3d3ee5c431a0176fa238fc7c246e9edbb28e1f4c27f

Download Submit
memory/1064-312-0x0000000000FD0000-0x000000000137E000-memory.dmp

Filesize
3.7MB

Download
memory/1468-246-0x00000000001C0000-0x000000000056E000-memory.dmp

Filesize
3.7MB

Download
memory/1968-279-0x00000000000C0000-0x000000000046E000-memory.dmp

Filesize
3.7MB

Download
memory/1972-116-0x0000000000D90000-0x000000000113E000-memory.dmp

Filesize
3.7MB

Download
memory/2808-29-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/2808-39-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/2808-47-0x0000000000AF0000-0x0000000000AFC000-memory.dmp

Filesize
48KB

Download
memory/2808-49-0x0000000000B40000-0x0000000000B50000-memory.dmp

Filesize
64KB

Download
memory/2808-51-0x0000000000B50000-0x0000000000B60000-memory.dmp

Filesize
64KB

Download
memory/2808-53-0x0000000000D60000-0x0000000000DBA000-memory.dmp

Filesize
360KB

Download
memory/2808-55-0x0000000000BE0000-0x0000000000BEE000-memory.dmp

Filesize
56KB

Download
memory/2808-57-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Filesize
64KB

Download
memory/2808-59-0x0000000000D00000-0x0000000000D08000-memory.dmp

Filesize
32KB

Download
memory/2808-61-0x0000000000D10000-0x0000000000D1E000-memory.dmp

Filesize
56KB

Download
memory/2808-63-0x0000000000D40000-0x0000000000D58000-memory.dmp

Filesize
96KB

Download
memory/2808-65-0x00000000026E0000-0x000000000272E000-memory.dmp

Filesize
312KB

Download
memory/2808-43-0x0000000000B20000-0x0000000000B32000-memory.dmp

Filesize
72KB

Download
memory/2808-13-0x0000000000DD0000-0x000000000117E000-memory.dmp

Filesize
3.7MB

Download
memory/2808-41-0x0000000000B00000-0x0000000000B16000-memory.dmp

Filesize
88KB

Download
memory/2808-45-0x0000000000AE0000-0x0000000000AEE000-memory.dmp

Filesize
56KB

Download
memory/2808-37-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

Filesize
48KB

Download
memory/2808-35-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2808-15-0x00000000002B0000-0x00000000002D6000-memory.dmp

Filesize
152KB

Download
memory/2808-33-0x00000000005F0000-0x00000000005FE000-memory.dmp

Filesize
56KB

Download
memory/2808-31-0x00000000005E0000-0x00000000005EE000-memory.dmp

Filesize
56KB

Download
memory/2808-27-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/2808-25-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/2808-23-0x00000000005C0000-0x00000000005D8000-memory.dmp

Filesize
96KB

Download
memory/2808-21-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/2808-19-0x0000000000580000-0x000000000059C000-memory.dmp

Filesize
112KB

Download
memory/2808-17-0x0000000000290000-0x000000000029E000-memory.dmp

Filesize
56KB

Download
memory/2872-181-0x00000000010C0000-0x000000000146E000-memory.dmp

Filesize
3.7MB

Download
memory/2896-83-0x0000000000A40000-0x0000000000DEE000-memory.dmp

Filesize
3.7MB

Download