cobaltstrike | 08b2f51ca9ebb29909c9d5281992554d548a9f4f0ce4b32d0ef5f9ec80281f53

Analysis

max time kernel
45s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe
Size

59.1MB
MD5

3c0086e9a2673adca00e903795ded6b4
SHA1

f39a8ac3a16d7723b2a1e91cd4ed0ebd491ca2a3
SHA256

08b2f51ca9ebb29909c9d5281992554d548a9f4f0ce4b32d0ef5f9ec80281f53
SHA512

bb708052eea814a90fd3e356933bc144a59fbc4d8b1975b67c8297514ac75d01a6f54e11cc3cf996624e46a49c95a7c82995ee1ee3dda81c7f03639a6071a42b
SSDEEP

1572864:yLOrJXzVU0mzSuu2etPQiWmoh8rbu8CQG2Y:yLqJXBU0/uu3IDmnrbRY

Score

10^/10

cobaltstrike modiloader raccoon xmrig 2ca5558c9ec8037d24a611513d7bd076 aspackv2 backdoor discovery evasion execution miner persistence stealer trojan upx

Malware Config

Extracted

Family

raccoon

Botnet

2ca5558c9ec8037d24a611513d7bd076

https://192.153.57.177:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00090000000175ed-3424.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\eyplorer.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,"	reg.exe

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral1/memory/1520-3421-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/1520-3420-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral1/memory/1520-3417-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/752-3463-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-3439-0x000000013FCE0000-0x0000000140031000-memory.dmp	xmrig
behavioral1/memory/2880-3433-0x000000013FB70000-0x000000013FEC1000-memory.dmp	xmrig
behavioral1/memory/2524-3445-0x000000013F580000-0x000000013F8D1000-memory.dmp	xmrig
behavioral1/memory/1372-3493-0x000000013FC70000-0x000000013FFC1000-memory.dmp	xmrig
behavioral1/memory/1172-3514-0x000000013F8E0000-0x000000013FC31000-memory.dmp	xmrig
behavioral1/memory/2348-3509-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig
behavioral1/memory/760-3488-0x000000013F830000-0x000000013FB81000-memory.dmp	xmrig
behavioral1/memory/2972-3529-0x000000013FB60000-0x000000013FEB1000-memory.dmp	xmrig
behavioral1/memory/2936-3531-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2900-3534-0x000000013FB20000-0x000000013FE71000-memory.dmp	xmrig
behavioral1/memory/2880-4111-0x000000013FB70000-0x000000013FEC1000-memory.dmp	xmrig
behavioral1/memory/2740-4113-0x000000013FCE0000-0x0000000140031000-memory.dmp	xmrig
behavioral1/memory/760-4115-0x000000013F830000-0x000000013FB81000-memory.dmp	xmrig
behavioral1/memory/1172-4125-0x000000013F8E0000-0x000000013FC31000-memory.dmp	xmrig
behavioral1/memory/2972-4127-0x000000013FB60000-0x000000013FEB1000-memory.dmp	xmrig
behavioral1/memory/2936-4129-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/1372-4131-0x000000013FC70000-0x000000013FFC1000-memory.dmp	xmrig
behavioral1/memory/2900-4133-0x000000013FB20000-0x000000013FE71000-memory.dmp	xmrig
behavioral1/memory/2348-4135-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1756	powershell.exe
1532	powershell.exe
2660	powershell.exe

Manipulates Digital Signatures 1 TTPs 2 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates\220DBCD5ABC713652A86F9606E332BA47AB131F4\Blob = 0f0000000100000014000000837986bdba25f682407c693bd0f96b697c2b1f6f0200000001000000cc0000001c0000006c0000000100000000000000000000000000000001000000640035006300660030003800620034002d0062006400330032002d0034003900660061002d0061006200610039002d0032003700640037003300340033003900320036003800320000000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000220dbcd5abc713652a86f9606e332ba47ab131f4200000000100000000030000308202fc308201e4a0030201020210296c14dec67fc0af4b42b79ff7cbfffd300d06092a864886f70d01010505003010310e300c0603550403130541646d696e3020170d3234303931363031343833395a180f32313234303832333031343833395a3010310e300c0603550403130541646d696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfb34d4f3c885cdbd54b2ba82104f59a5989e815165923ebf21b5613505ebfee848cea58b822f97c661d174b6537658000b0d02ec0bf59775b687e813dff8dd34102927f23b9df21888a4f37a5d0c92650b8f0931052be3e9778433888829e13183b1a4e3082dff5948f8a9de159309e76bf24bf3d682710d5ad97f12d28a3f3bc40c78e0d255dfa9bf3039f44ac7b43d0e17b6ea0e49ee2f186250f295d7256dc3ac413ca660a10272285ee03c7e2ea928cd71d9ab069eb05604ecb318824a81111c79f4aa3ef3a043518ba50d0569f50b0ae29f960ea44ff9920edf1f71d0778144c8d14911b5aafe8995530f20c5c9f667cc82653a5c21b366bbc7d13d3930203010001a350304e30150603551d25040e300c060a2b0601040182370a0304302a0603551d1104233021a01f060a2b060104018237140203a0110c0f41646d696e40454c5a59505446560030090603551d1304023000300d06092a864886f70d010105050003820101009543ed491e0a196a63aa784ca298abe98efb4b2f15df198d587c7c264929a9ed772514d5e1fb022241bd5d3bde2662d55fb74d8471ef9fee7f5a75d778dbefb91179cf718222723b06edcb81e9397d294a594fadd2db3ed6c6558f63e7bead0b17656b625c62bfb1e27bfd684f4b56eb4d2396fe9e43409e249fcae2f466faf702fc45ca013f1f4e8b001102add68a1634338ecd31dca090f7063939c40caf04c0fea5acf5437e557f0c13cbf24a2dcaf0b50e3aea0e7c2ca7741ecc208ef37107b3b6940387c1eadcef094040379e5ff3cc1cc26b22956fe702e92ddda47c4ed4bbea08c5bf3da6ee8320718bd80ef713b6f124d01526f2ed01ddb817f5e5e3	IEXPLORE.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates\220DBCD5ABC713652A86F9606E332BA47AB131F4\Blob = 0f0000000100000014000000837986bdba25f682407c693bd0f96b697c2b1f6f030000000100000014000000220dbcd5abc713652a86f9606e332ba47ab131f4200000000100000000030000308202fc308201e4a0030201020210296c14dec67fc0af4b42b79ff7cbfffd300d06092a864886f70d01010505003010310e300c0603550403130541646d696e3020170d3234303931363031343833395a180f32313234303832333031343833395a3010310e300c0603550403130541646d696e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfb34d4f3c885cdbd54b2ba82104f59a5989e815165923ebf21b5613505ebfee848cea58b822f97c661d174b6537658000b0d02ec0bf59775b687e813dff8dd34102927f23b9df21888a4f37a5d0c92650b8f0931052be3e9778433888829e13183b1a4e3082dff5948f8a9de159309e76bf24bf3d682710d5ad97f12d28a3f3bc40c78e0d255dfa9bf3039f44ac7b43d0e17b6ea0e49ee2f186250f295d7256dc3ac413ca660a10272285ee03c7e2ea928cd71d9ab069eb05604ecb318824a81111c79f4aa3ef3a043518ba50d0569f50b0ae29f960ea44ff9920edf1f71d0778144c8d14911b5aafe8995530f20c5c9f667cc82653a5c21b366bbc7d13d3930203010001a350304e30150603551d25040e300c060a2b0601040182370a0304302a0603551d1104233021a01f060a2b060104018237140203a0110c0f41646d696e40454c5a59505446560030090603551d1304023000300d06092a864886f70d010105050003820101009543ed491e0a196a63aa784ca298abe98efb4b2f15df198d587c7c264929a9ed772514d5e1fb022241bd5d3bde2662d55fb74d8471ef9fee7f5a75d778dbefb91179cf718222723b06edcb81e9397d294a594fadd2db3ed6c6558f63e7bead0b17656b625c62bfb1e27bfd684f4b56eb4d2396fe9e43409e249fcae2f466faf702fc45ca013f1f4e8b001102add68a1634338ecd31dca090f7063939c40caf04c0fea5acf5437e557f0c13cbf24a2dcaf0b50e3aea0e7c2ca7741ecc208ef37107b3b6940387c1eadcef094040379e5ff3cc1cc26b22956fe702e92ddda47c4ed4bbea08c5bf3da6ee8320718bd80ef713b6f124d01526f2ed01ddb817f5e5e3	IEXPLORE.EXE

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1900	attrib.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0005000000019d5f-113.dat	aspack_v212_v242

Executes dropped EXE 10 IoCs

pid	Process
3032	i.exe
2612	stopwatch.exe
2648	anti.exe
2688	neurosafe.exe
604	PurchaseOrder.exe
840	screenscrew.exe
2520	butdes.exe
2056	flydes.exe
2272	butdes.tmp
1296	flydes.tmp

Loads dropped DLL 25 IoCs

pid	Process
2904	cmd.exe
2904	cmd.exe
2904	cmd.exe
2904	cmd.exe
2904	cmd.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2904	cmd.exe
2904	cmd.exe
2904	cmd.exe
604	PurchaseOrder.exe
604	PurchaseOrder.exe
604	PurchaseOrder.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
1424	WerFault.exe
2904	cmd.exe
2904	cmd.exe
2520	butdes.exe
2056	flydes.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2524-3392-0x000000013F580000-0x000000013F8D1000-memory.dmp	upx
behavioral1/memory/760-3436-0x000000013F830000-0x000000013FB81000-memory.dmp	upx
behavioral1/memory/2740-3439-0x000000013FCE0000-0x0000000140031000-memory.dmp	upx
behavioral1/memory/2880-3433-0x000000013FB70000-0x000000013FEC1000-memory.dmp	upx
behavioral1/files/0x00090000000175ed-3424.dat	upx
behavioral1/memory/1172-3443-0x000000013F8E0000-0x000000013FC31000-memory.dmp	upx
behavioral1/memory/2524-3445-0x000000013F580000-0x000000013F8D1000-memory.dmp	upx
behavioral1/memory/2972-3453-0x000000013FB60000-0x000000013FEB1000-memory.dmp	upx
behavioral1/memory/2936-3462-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/1372-3493-0x000000013FC70000-0x000000013FFC1000-memory.dmp	upx
behavioral1/memory/1172-3514-0x000000013F8E0000-0x000000013FC31000-memory.dmp	upx
behavioral1/memory/2348-3509-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/memory/760-3488-0x000000013F830000-0x000000013FB81000-memory.dmp	upx
behavioral1/memory/2900-3468-0x000000013FB20000-0x000000013FE71000-memory.dmp	upx
behavioral1/memory/2972-3529-0x000000013FB60000-0x000000013FEB1000-memory.dmp	upx
behavioral1/memory/2936-3531-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2900-3534-0x000000013FB20000-0x000000013FE71000-memory.dmp	upx
behavioral1/memory/2880-4111-0x000000013FB70000-0x000000013FEC1000-memory.dmp	upx
behavioral1/memory/2740-4113-0x000000013FCE0000-0x0000000140031000-memory.dmp	upx
behavioral1/memory/760-4115-0x000000013F830000-0x000000013FB81000-memory.dmp	upx
behavioral1/memory/1172-4125-0x000000013F8E0000-0x000000013FC31000-memory.dmp	upx
behavioral1/memory/2972-4127-0x000000013FB60000-0x000000013FEB1000-memory.dmp	upx
behavioral1/memory/2936-4129-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/1372-4131-0x000000013FC70000-0x000000013FFC1000-memory.dmp	upx
behavioral1/memory/2900-4133-0x000000013FB20000-0x000000013FE71000-memory.dmp	upx
behavioral1/memory/2348-4135-0x000000013F640000-0x000000013F991000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2056	2648	WerFault.exe	36
1424	604	WerFault.exe	49
1840	2396	WerFault.exe	148

System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butdes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butdes.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flydes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flydes.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neurosafe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PurchaseOrder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	screenscrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cipher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cipher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stopwatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
2872	timeout.exe
408	timeout.exe
2236	timeout.exe
1444	timeout.exe
2248	timeout.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
996	taskkill.exe
1252	taskkill.exe
748	taskkill.exe
2624	taskkill.exe
1764	taskkill.exe
1224	taskkill.exe
1840	taskkill.exe
1660	taskkill.exe
1840	taskkill.exe
660	taskkill.exe
1504	taskkill.exe
2312	taskkill.exe
2172	taskkill.exe
2312	taskkill.exe
1020	taskkill.exe
1500	taskkill.exe
2160	taskkill.exe
2104	taskkill.exe
2876	taskkill.exe
2024	taskkill.exe
2636	taskkill.exe
320	taskkill.exe
2416	taskkill.exe
1752	taskkill.exe
2384	taskkill.exe
2680	taskkill.exe
2836	taskkill.exe
1520	taskkill.exe
2960	taskkill.exe
2576	taskkill.exe
2444	taskkill.exe
316	taskkill.exe
1872	taskkill.exe
2172	taskkill.exe
1004	taskkill.exe
1452	taskkill.exe
2324	taskkill.exe
448	taskkill.exe
2896	taskkill.exe
888	taskkill.exe
2524	taskkill.exe
2624	taskkill.exe
1424	taskkill.exe
2252	taskkill.exe
336	taskkill.exe
108	taskkill.exe
1224	taskkill.exe
2660	taskkill.exe
1564	taskkill.exe
2528	taskkill.exe
2936	taskkill.exe
948	taskkill.exe
1680	taskkill.exe
2680	taskkill.exe
2624	taskkill.exe
2432	taskkill.exe
1496	taskkill.exe
2972	taskkill.exe
1264	taskkill.exe
2964	taskkill.exe
2880	taskkill.exe
3000	taskkill.exe
2844	taskkill.exe
2172	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBF5DB81-73CD-11EF-AF94-46A49AEEEEC8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CBC889F1-73CD-11EF-AF94-46A49AEEEEC8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	IEXPLORE.EXE

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
1168	notepad.exe
2460	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2768	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	704	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2724	taskkill.exe
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeDebugPrivilege	752	taskkill.exe
Token: SeDebugPrivilege	2792	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2612	stopwatch.exe
2648	anti.exe
1556	efsui.exe
1556	efsui.exe
1556	efsui.exe
1076	iexplore.exe
1076	iexplore.exe
2992	iexplore.exe
2992	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
2992	iexplore.exe
2992	iexplore.exe
2992	iexplore.exe
2992	iexplore.exe
2992	iexplore.exe
2992	iexplore.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2612	stopwatch.exe
2648	anti.exe
1556	efsui.exe
1556	efsui.exe
1556	efsui.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2992	iexplore.exe
2992	iexplore.exe
1076	iexplore.exe
1076	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
984	IEXPLORE.EXE
984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2904	2076	2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe	31
PID 2076 wrote to memory of 2904	2076	2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe	31
PID 2076 wrote to memory of 2904	2076	2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe	31
PID 2076 wrote to memory of 2904	2076	2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe	31
PID 2904 wrote to memory of 2916	2904	cmd.exe	33
PID 2904 wrote to memory of 2916	2904	cmd.exe	33
PID 2904 wrote to memory of 2916	2904	cmd.exe	33
PID 2904 wrote to memory of 2916	2904	cmd.exe	33
PID 2904 wrote to memory of 3032	2904	cmd.exe	34
PID 2904 wrote to memory of 3032	2904	cmd.exe	34
PID 2904 wrote to memory of 3032	2904	cmd.exe	34
PID 2904 wrote to memory of 3032	2904	cmd.exe	34
PID 2904 wrote to memory of 2612	2904	cmd.exe	35
PID 2904 wrote to memory of 2612	2904	cmd.exe	35
PID 2904 wrote to memory of 2612	2904	cmd.exe	35
PID 2904 wrote to memory of 2612	2904	cmd.exe	35
PID 2904 wrote to memory of 2648	2904	cmd.exe	36
PID 2904 wrote to memory of 2648	2904	cmd.exe	36
PID 2904 wrote to memory of 2648	2904	cmd.exe	36
PID 2904 wrote to memory of 2648	2904	cmd.exe	36
PID 2904 wrote to memory of 236	2904	cmd.exe	37
PID 2904 wrote to memory of 236	2904	cmd.exe	37
PID 2904 wrote to memory of 236	2904	cmd.exe	37
PID 2904 wrote to memory of 236	2904	cmd.exe	37
PID 2904 wrote to memory of 2024	2904	cmd.exe	38
PID 2904 wrote to memory of 2024	2904	cmd.exe	38
PID 2904 wrote to memory of 2024	2904	cmd.exe	38
PID 2904 wrote to memory of 2024	2904	cmd.exe	38
PID 2904 wrote to memory of 2852	2904	cmd.exe	39
PID 2904 wrote to memory of 2852	2904	cmd.exe	39
PID 2904 wrote to memory of 2852	2904	cmd.exe	39
PID 2904 wrote to memory of 2852	2904	cmd.exe	39
PID 2904 wrote to memory of 2856	2904	cmd.exe	40
PID 2904 wrote to memory of 2856	2904	cmd.exe	40
PID 2904 wrote to memory of 2856	2904	cmd.exe	40
PID 2904 wrote to memory of 2856	2904	cmd.exe	40
PID 2904 wrote to memory of 2688	2904	cmd.exe	41
PID 2904 wrote to memory of 2688	2904	cmd.exe	41
PID 2904 wrote to memory of 2688	2904	cmd.exe	41
PID 2904 wrote to memory of 2688	2904	cmd.exe	41
PID 2904 wrote to memory of 2864	2904	cmd.exe	42
PID 2904 wrote to memory of 2864	2904	cmd.exe	42
PID 2904 wrote to memory of 2864	2904	cmd.exe	42
PID 2904 wrote to memory of 2864	2904	cmd.exe	42
PID 2904 wrote to memory of 2872	2904	cmd.exe	43
PID 2904 wrote to memory of 2872	2904	cmd.exe	43
PID 2904 wrote to memory of 2872	2904	cmd.exe	43
PID 2904 wrote to memory of 2872	2904	cmd.exe	43
PID 2648 wrote to memory of 2056	2648	anti.exe	46
PID 2648 wrote to memory of 2056	2648	anti.exe	46
PID 2648 wrote to memory of 2056	2648	anti.exe	46
PID 2648 wrote to memory of 2056	2648	anti.exe	46
PID 2904 wrote to memory of 700	2904	cmd.exe	47
PID 2904 wrote to memory of 700	2904	cmd.exe	47
PID 2904 wrote to memory of 700	2904	cmd.exe	47
PID 2904 wrote to memory of 700	2904	cmd.exe	47
PID 2904 wrote to memory of 840	2904	cmd.exe	48
PID 2904 wrote to memory of 840	2904	cmd.exe	48
PID 2904 wrote to memory of 840	2904	cmd.exe	48
PID 2904 wrote to memory of 840	2904	cmd.exe	48
PID 2904 wrote to memory of 604	2904	cmd.exe	49
PID 2904 wrote to memory of 604	2904	cmd.exe	49
PID 2904 wrote to memory of 604	2904	cmd.exe	49
PID 2904 wrote to memory of 604	2904	cmd.exe	49

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1900	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\!m.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\i.exe
    i.exe
    3⤵
    - Executes dropped EXE
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\stopwatch.exe
    stopwatch.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\anti.exe
    anti.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 692
      4⤵
      Loads dropped DLL
      Program crash
      PID:2056
- - C:\Windows\SysWOW64\reg.exe
    reg import font.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:236
- - C:\Windows\SysWOW64\reg.exe
    reg import eee.reg
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:2024
- - C:\Windows\SysWOW64\reg.exe
    reg import nosearch.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
- - C:\Windows\SysWOW64\explorer.exe
    explorer
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\neurosafe.exe
    neurosafe.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\reg.exe
    reg import color.reg
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864
- - C:\Windows\SysWOW64\timeout.exe
    timeout 30
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K fence.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2576
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2444
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2016
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2792
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1080
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2588
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:2172
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:872
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:1224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1872
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2148
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2616
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:2636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:2660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:2312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:352
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:2972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:2680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:2384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2484
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1444
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2172
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2460
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:2172
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2104
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2160
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2528
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:2312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:2936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:1660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:1840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:1264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:1564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:2624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:2964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:1500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:1452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:2524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:2324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:2880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2396
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2160
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:352
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1812
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:748
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:2172
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:2416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:1504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:1424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:3000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2964
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\screenscrew.exe
    screenscrew.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:840
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\PurchaseOrder.exe
    PurchaseOrder.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 748
      4⤵
      Loads dropped DLL
      Program crash
      PID:1424
- - C:\Windows\SysWOW64\cipher.exe
    cipher /k /h /e C:\Users\Admin\Desktop\*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2272
- - C:\Windows\SysWOW64\cipher.exe
    cipher C:\Users\Admin\Desktop\*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1672
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\doc.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2992
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:2
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:984
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275472 /prefetch:2
      4⤵
      PID:2592
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\infected.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1076
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1404
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\butdes.exe
    butdes.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\is-41R88.tmp\butdes.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-41R88.tmp\butdes.tmp" /SL5="$3006E,2719719,54272,C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\butdes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2272
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\flydes.exe
    flydes.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\is-V9MF2.tmp\flydes.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-V9MF2.tmp\flydes.tmp" /SL5="$30098,595662,54272,C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\flydes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1296
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2236
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\gx.exe
    gx.exe
    3⤵
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\7zS866FA487\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS866FA487\setup.exe --server-tracking-blob=MzY5Njg4ZTc1OTE1MjcyMTMxZmYwZTk4ODU3ZWE4Mjk0NjQ0Nzc5MjcxMWY4OGZhOThlNTU5YmNlNzA1NmJiOTp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9OTF9VVlJfMzczNiZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTM3MzZfJnV0bV9pZD0wNTgwYWM0YWUyOTA0ZDA3ODNkOTQxNWE0NWRhZGFkYSZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRnJ1JTJGZ3glM0ZlZGl0aW9uJTNEc3RkLTIlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fTkxfVVZSXzM3MzYlMjZ1dG1fY29udGVudCUzRDM3MzZfJTI2dXRtX2lkJTNEMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9MDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmZGxfdG9rZW49NzAwOTYzNzgiLCJ0aW1lc3RhbXAiOiIxNzI1ODAyMjIzLjgwMDQiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEyOC4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9OTF9VVlJfMzczNiIsImNvbnRlbnQiOiIzNzM2XyIsImlkIjoiMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI0ODkyOGFmMC1jZDc3LTQ0NDctYTQyNy1kNzY5ODRmOGQ5NGMifQ==
      4⤵
      PID:1080
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\bundle.exe
    bundle.exe
    3⤵
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\rckdck.exe
    rckdck.exe
    3⤵
    PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\is-VGE0T.tmp\is-KMP2V.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VGE0T.tmp\is-KMP2V.tmp" /SL4 $180282 "C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\rckdck.exe" 6123423 52736
      4⤵
      PID:2676
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\avg.exe
    avg.exe
    3⤵
    PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\ajB204.exe
      "C:\Users\Admin\AppData\Local\Temp\ajB204.exe" /relaunch=8 /was_elevated=1 /tagdata
      4⤵
      PID:2008
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\telamon.exe
    telamon.exe
    3⤵
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\is-O2ANP.tmp\telamon.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-O2ANP.tmp\telamon.tmp" /SL5="$102B6,1520969,918016,C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\telamon.exe"
      4⤵
      PID:3064
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-M2PPH.tmp\tt-installer-helper.exe" --getuid > "C:\Users\Admin\AppData\Local\Temp\is-M2PPH.tmp\~execwithresult.txt""
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\is-M2PPH.tmp\tt-installer-helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-M2PPH.tmp\tt-installer-helper.exe" --getuid
        6⤵
        
        PID:572
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-M2PPH.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\telamon.exe > "C:\Users\Admin\AppData\Local\Temp\is-M2PPH.tmp\~execwithresult.txt""
        5⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\is-M2PPH.tmp\tt-installer-helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-M2PPH.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\telamon.exe
        6⤵
        
        PID:2768
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1444
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\gadget.msi"
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K des.bat
    3⤵
    PID:1304
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\System32\12520437.cpx
      4⤵
      PID:2916
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Windows\System32\12520850.cpx
      4⤵
      PID:1864
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\g_.exe
    g_.exe
    3⤵
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\t.exe
    t.exe
    3⤵
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\g.exe
    g.exe
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\e.exe
    e.exe
    3⤵
    PID:408
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\GAB
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\Bootstraper.exe
    Bootstraper.exe
    3⤵
    PID:2396
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\SalaNses'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1756
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1532
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1476
      4⤵
      Program crash
      PID:1840
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K proxy.bat
    3⤵
    PID:996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      PID:1508
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\GAB\1215.CompositeFont"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1168
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\GAB\1215.ini
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2460
- - C:\Windows\SysWOW64\fontview.exe
    "C:\Windows\System32\fontview.exe" C:\GAB\1215.ttc
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\fontview.exe
    "C:\Windows\System32\fontview.exe" C:\GAB\1215.TTF
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\cobstrk.exe
    cobstrk.exe
    3⤵
    PID:2524
  - - C:\Windows\System\BZbyUec.exe
      C:\Windows\System\BZbyUec.exe
      4⤵
      PID:2740
  - - C:\Windows\System\dAjCOHg.exe
      C:\Windows\System\dAjCOHg.exe
      4⤵
      PID:2880
  - - C:\Windows\System\lGLGdlT.exe
      C:\Windows\System\lGLGdlT.exe
      4⤵
      PID:760
  - - C:\Windows\System\TkCxIlB.exe
      C:\Windows\System\TkCxIlB.exe
      4⤵
      PID:1172
  - - C:\Windows\System\OJuCPWW.exe
      C:\Windows\System\OJuCPWW.exe
      4⤵
      PID:2972
  - - C:\Windows\System\LpDlVHH.exe
      C:\Windows\System\LpDlVHH.exe
      4⤵
      PID:2936
  - - C:\Windows\System\NyzYwPH.exe
      C:\Windows\System\NyzYwPH.exe
      4⤵
      PID:2900
  - - C:\Windows\System\LVQrfWJ.exe
      C:\Windows\System\LVQrfWJ.exe
      4⤵
      PID:1372
  - - C:\Windows\System\BuNggkZ.exe
      C:\Windows\System\BuNggkZ.exe
      4⤵
      PID:2348
  - - C:\Windows\System\uywIOHb.exe
      C:\Windows\System\uywIOHb.exe
      4⤵
      PID:1944
  - - C:\Windows\System\BFuNEvb.exe
      C:\Windows\System\BFuNEvb.exe
      4⤵
      PID:1432
  - - C:\Windows\System\mPopYtL.exe
      C:\Windows\System\mPopYtL.exe
      4⤵
      PID:2292
  - - C:\Windows\System\daAEkjx.exe
      C:\Windows\System\daAEkjx.exe
      4⤵
      PID:2440
  - - C:\Windows\System\WiWkmlU.exe
      C:\Windows\System\WiWkmlU.exe
      4⤵
      PID:692
  - - C:\Windows\System\WIiYGEB.exe
      C:\Windows\System\WIiYGEB.exe
      4⤵
      PID:1252
  - - C:\Windows\System\lbKsRMp.exe
      C:\Windows\System\lbKsRMp.exe
      4⤵
      PID:2780
  - - C:\Windows\System\csOIXtt.exe
      C:\Windows\System\csOIXtt.exe
      4⤵
      PID:1724
  - - C:\Windows\System\yeuxYRM.exe
      C:\Windows\System\yeuxYRM.exe
      4⤵
      PID:2172
  - - C:\Windows\System\kyMBIfk.exe
      C:\Windows\System\kyMBIfk.exe
      4⤵
      PID:3088
  - - C:\Windows\System\pjrTYgQ.exe
      C:\Windows\System\pjrTYgQ.exe
      4⤵
      PID:3104
  - - C:\Windows\System\fywsVFm.exe
      C:\Windows\System\fywsVFm.exe
      4⤵
      PID:3124
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\jaf.exe
    jaf.exe
    3⤵
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\file.exe
    file.exe
    3⤵
    PID:804
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1520
- - C:\Windows\SysWOW64\reg.exe
    reg import oobe.reg
    3⤵
    PID:800
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\OHSHIT!.exe
    OHSHIT!.exe
    3⤵
    PID:1812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:2028

C:\Windows\system32\efsui.exe
efsui.exe /efs /keybackup
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1556

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:692

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-566118626170958167618973435551461732140-206114434-841186379-587408356-1350700599"
1⤵
PID:1764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GAB\1215.TTF

Filesize
107KB

MD5
9c5ef64a3c5331c17385d7f8d67d5686

SHA1
303ccc84b9c64ceefd45e69a8583a5f2f00d4c86

SHA256
cdcc7e5a3a7fc3f36b82c3e8ed0a731f7ea39148a76488d8920b07eae45ab7b8

SHA512
ffb8c63674975387f59ce3653e97b80fa0dbd5ff0212f5ddddd2104e4823123d9c8071c2ece4e9435de767eb616c1f7f9477ee01f26ae740e783c28eba1adc7c

Download Submit
C:\GAB\1215.TTF

Filesize
147KB

MD5
714eac0421a6bdd26e69255776f0ffed

SHA1
e6a1ab664b961c973a4a241b2a4eca70e324b6d6

SHA256
134a9f8ecf618660305d7d34b6905375c1d5d7838ea15cdb2789ba94317f4117

SHA512
82c1e7d3dd1148e28ab370638e0edf8675c6ab45c675abaa72a020fc71a82e00d776f5bcc2b9d86ea3325228ccca38fdf4b4e17b09ed1d53b9aea7f3b54e87f3

Download Submit
C:\GAB\1215.TTF

Filesize
233KB

MD5
3ee31da26d066e40248bd65802afebb4

SHA1
b13676242496301e615bcbf62c94d4c646a2702d

SHA256
08943bf26b8c950a6b1ebd5c4cdb3f3257f97c41a6b99a09ab34b485f8db6f3a

SHA512
c1bd42afbaaed54bd99a4a240824d54618f6ba60513ac5dfd048213aa70f1c03cac1f403d26c2bf266d867fe65accfb3390db158c464f883645f5e2d14c714b1

Download Submit
C:\GAB\1215.TTF

Filesize
80KB

MD5
f37324d3575c7132e330af3c8f08da17

SHA1
1e14164f2bf6d6972744642d0a6c8afce4d6daa4

SHA256
dcc8d42eebbab6822f736a7b99e1c9d6ee6861b247a19049bb33e5955d991dde

SHA512
80e2daad5319c8a732bec4eb5b7b62fd88979638df98e104688dd9747f0f4089f5a68e61509ce0c7a7590e1c73ad4564a41e97b7a8dd16d12947daa48935f743

Download Submit
C:\GAB\1215.TTF

Filesize
87KB

MD5
cec8a6834241575dcafba6d7504d64b8

SHA1
3d412b305c3d93474c9fe02f60a049a9e87aeaab

SHA256
960458b4c0851b8b9f1d047fe50f7fa01ddfbecaec692521d262660882e9596a

SHA512
9a3e79f5a04e6f0794099788c07330b97c4ab31e95df745cea9d5e8cbc7dba2a01a04dc4cbc7b93fcd76a7d1240f073f256ec7d5a9ce08d62312b01d4fd10e78

Download Submit
C:\GAB\1215.TTF

Filesize
76KB

MD5
fa89320a67b63ce7510c4bdb5290e852

SHA1
c5e8106c9ffbc66da43604e0d0351d21b13619d4

SHA256
86c88388fb78261ba49144d32694f7ca4c70c95a8af0739c20439ed882fa26c2

SHA512
a7a958d8a67254375e3d6fce382bfad5c3263fb82aa8f69e9ff5e889a5ce977772e38609906501be3e0c9d75549a2c6a64c2ca96aab87b8f96cc4ed3a4dc97df

Download Submit
C:\GAB\1215.TTF

Filesize
158KB

MD5
fe96984566a7740d35a26a5dd8a0451c

SHA1
b6fd1059cd3cd09d64305d132d3e570a513880ca

SHA256
f31269c116aae8fadc7ad60d2819fd3987cf39a5934412c15486740edbf58f0a

SHA512
193e0a010b7ae24a43854d8cea5f99f26d7f48606310f2576f69e50a1a559a14d8bd55510e7eccb0bf0a4bd6d009f8249d2b9e400461bad1be7a51ddf4fa0c16

Download Submit
C:\GAB\1215.TTF

Filesize
158KB

MD5
e7542f998594b425b8728191c4d11d96

SHA1
f10262424d168ec6bc0a0da5cc1a94df5903cad1

SHA256
2de5e34daf966be8e165bd5604ac0714a7946ea2a0a08f86ff04e687ed54d8d7

SHA512
788aaa946e482bc62afc997c30b0cf3f92eb6fd0e82edd1835c4e3bbc0efb4e5150df178779b0685813b8913496c2ccb38e478fb418e2f0fe819387ca7170114

Download Submit
C:\GAB\1215.TTF

Filesize
73KB

MD5
1db23dfdd7b4b2f4414d285446c67c74

SHA1
88b772689b88a82ca0fb0735e2f80e8bb8d6e4d3

SHA256
686f0809fa9c6ef40a7cf5752c7514b296d6cbdf1cda098e475e464b0181bace

SHA512
d898949c7a2c42c1cfc383abb23bb5a07d60842185ac271239360fab6a34f8b4ef68c0e287c363065d4d2b1b0bb850f8797f16149a2a273ede58dbbb2a4e436f

Download Submit
C:\GAB\1215.TTF

Filesize
704KB

MD5
22b5a6b6f9d92e107b9fe7ad81a94ccc

SHA1
164da49b8b347982459bff147493fdd98d446f08

SHA256
179a222e9483750b878b4de1cc12a25ef1fec8f8e39cfcf64aaa4fea17d50b46

SHA512
545c3165daa739dcebf8e988d17243e8efa63b342ee8d606ed7c5c471494aa9b4fc5d2ff8ef4b9ff9d1975612903ef23ee611e6893c76d696d784c75e432a2ab

Download Submit
C:\GAB\1215.TTF

Filesize
78KB

MD5
58862b5f5172c3609c9b0ced6da89b12

SHA1
d2d8cc25f8c5241aebb4a4e240225402cbfbd5d6

SHA256
f976b470e19fde1971824107182927472cf67a08acc42f8e2f23951312863a8c

SHA512
032af37431d997b57fbec9164f3a7a9553c4db6c78ae3289b4c61beb46e94d9e7665f0030ed04d788ffd2b2990593178d8a3504d094926c6c296dea11fab6def

Download Submit
C:\GAB\1215.TTF

Filesize
64KB

MD5
743342b325622e6c0c222942456f7347

SHA1
459b37e8bc46a29e44a17bd5f9fb7dc59e845dae

SHA256
c254823fee1c822dca28c1ba80610521f516a21b71a59604ae8f2f76578f631d

SHA512
23f468f76366a0ef6538e927a04c3c2c32becfcd3dcd8683ffc221e13bd5d2189df9519636394fa35f713a77b62533348b7c7c260c12d1bd1354a563bab8e5ad

Download Submit
C:\GAB\1215.TTF

Filesize
161KB

MD5
28806fbbd48444f22edee13bddeef650

SHA1
7b28cb70206c9890e9601ee8d03236f84ed511c9

SHA256
21be61ff5289c2125dbb48e2a739fd4dd98c3e58b37abfc22cc0412dd8376d95

SHA512
e0867701e2f5816f5f7d889186f8db84bd92164a0e8046e464e66c700571456f4f15731f5eff7ab362dd80c4128bbf0adc926738265c64585563739bc4ac6849

Download Submit
C:\GAB\1215.TTF

Filesize
114KB

MD5
f06c4b1045d965db3246949e09ee9984

SHA1
51d8441836ecf23bc4b1281971b623223798d38a

SHA256
8f5d4ac83aeee7dc1361585883ef59304edcfc57f4996be51e74aa3a07c5aa30

SHA512
471e763597959bc965d53885b37fd151b0355658d9c14708c72a78cb5fc2faa0bfa87b3b58f577a5c95aea07004f0e518f74ee4e2dded16c748198f9008c5400

Download Submit
C:\GAB\1215.TTF

Filesize
254KB

MD5
51ee907427c788c3ab4442e73286d641

SHA1
27d9cbae146fb5e70b1426ae793c3e20d54c5fa5

SHA256
83f5b36107f7ea50fd5c52b1c3e8d64de3edc5d0f2c2e2e9f634fbbcfd7abd74

SHA512
e6897ca095eedc269c20134ac33b3fce0af099a2ae0dc65c8519b2e0626de8479e76dd73479495426992fd8e2a94bafe33f6b563e5097a34703a7654b3d75099

Download Submit
C:\GAB\1215.TTF

Filesize
97KB

MD5
76c723b7e583c58f4cfc73569237df0c

SHA1
935e4326c16d99257435c5f36d818b1fb39e78eb

SHA256
8ffabb59c6df2b176838ed6c5e934f007bdb245f02dd1ac0117570677cc85695

SHA512
41a2525b7059f1c8b8405c78cc05376ef2248e889f29f85fe0dbfb7f3c00711dada36ecce678ce1456e28978c6be41ee9ab4f9b6a96736bf57ebd72bc5026336

Download Submit
C:\GAB\1215.TTF

Filesize
139KB

MD5
082252176f1f4953cea2a7e5e9f300f4

SHA1
5eeac3e6e29c46e36464f5e886cddfe2832cb31c

SHA256
cfd1bb2c9b0e8b624952288acf9bdadaa64e52bc846e4720e2f0653359e5b8c5

SHA512
9ca3900147b2b3169dd906439d385a5494f65fb60d2483e3da8442bf60d1cf4c22c9938f5f03f86c704054ff0b462807d1caa20d965d7012c37b9ad9a8ebe173

Download Submit
C:\GAB\1215.TTF

Filesize
148KB

MD5
e2ae623d5f37a67aaf66673fc5be6ea7

SHA1
6753d6d43819396e2879e92519638448afbdbea0

SHA256
68f1597a57a071f291449e66c888c1b86ad617d8eb18da52c7c2dbdf781ddc2f

SHA512
448da634564f80378e38cf01e0d447ba008e27a573edf2ce29201757daede97bed8fab0ab1c661a820faf780ad3e5580f30d2b1cefc22003afbc551fe2209d70

Download Submit
C:\GAB\1215.TTF

Filesize
195KB

MD5
7d699dbc38b1667abc42c2bdfb0d0dbc

SHA1
41843a26bb62059cae1ec67095b3f87f53391dfa

SHA256
378a646c37d0ea6e4844aba01d0ad4aece9618487b1d177992c157abfe624df6

SHA512
129e995c24683065a9c6f62b398eb989ebbd14dd0b04cc1b74410a85095e1b36a4feb741f000a4294cda5dccdf82dc9edb62b7cc347d1b0acd4094d36d4f53c0

Download Submit
C:\GAB\1215.TTF

Filesize
64KB

MD5
a5c87c2bcb8554a41086157df79dbe8c

SHA1
0e37a1115ea2216b721aaf97ffa567a8c229c889

SHA256
b64d635f98c27f5462289948e64d53d8b9849aec9879bdc5b4d4820252689ab0

SHA512
a0600887405f5c5eccc6d36c9821d66687e0e6e6779bff6a0bb76c244aa8fbeb1befdb9caa114ad3ec8bc28edfa2999ea875c2e471a8a396d5be598adeb17c28

Download Submit
C:\GAB\1215.TTF

Filesize
65KB

MD5
d084e51196d50dd6735ff8a6e4d6f4f2

SHA1
2247b20e88aaf8bfef070a2f8e7aab45c337ff5d

SHA256
f6664b244192ab4cf3a58bb6a653700d1f345d03bb8879888bcea1b6f8f3f97c

SHA512
0ef09cc29a5b80774958c99731f59c2825f8c8949231451370ac114f1301c27777ceb5c6e5b1df3f13dc457f53e2f1f3d8c3b0bd6e4e0d4642b038913ec7199c

Download Submit
C:\GAB\1215.TTF

Filesize
70KB

MD5
783fbb183b5dc058707e3b8c9cff0697

SHA1
663f2658df8772b5fecdd87ff94fb8a4ba0744e9

SHA256
4629ea055c48b11affd68ee5232267c71d90feb6cc3e0b7d74afc90867716abf

SHA512
7e64ec6e818ffc18e232d9317ec4eced9a27b22716d4d219c38153ee33784b2e8b74db9d58d298c5c5afb203c264a511a5e0515512e0f5b4b2d27d3b25c5b222

Download Submit
C:\GAB\1215.TTF

Filesize
79KB

MD5
78d7bdc55148aaa3307a1e8ad735c40f

SHA1
1317b3be9d7cdf43afe98694db1cf59c6368c210

SHA256
380e2cd97160e14042cea52ff785ca92d966e29f873cf2b93e1746f3a582ec74

SHA512
654440cf3c81ff9269b8699e09abe791c7b4989ac98883079f06c0af34c0725b0f1c0126f78afa2a963c2d1dbcab257450a70ecd6637009d50c2c6923ae5533c

Download Submit
C:\GAB\1215.TTF

Filesize
80KB

MD5
7227c14c2b3c091b79b31376f047c65a

SHA1
1706f28a651741a6acb0a4fb017a337d266284d7

SHA256
d9877297dccaf1c62e194baa2f57cd119fc3d23c2a1eb154dfa73fc696170d07

SHA512
cb490c9149a554ade96aa9d93bc705dbf7e2602c61a9bc0edee1cc5e7b1cebc62cfc51f5e60fe9b1dac7bc71237fca4ec80e73bfa13d763023028519d6086319

Download Submit
C:\GAB\1215.TTF

Filesize
54KB

MD5
a72a7fbcaa9a8d77295e466c12c1f749

SHA1
8e88f855b7dde8743b0ac63a5ccedcea8cf03488

SHA256
ab475061e2479350a315bf3f72d65ae9acc37bebef4cf8df979f8f6ced659216

SHA512
ebe3bdfb9b2911cc3d6c7f687b6ca7571df4c50605ced583a799dfb0deef9473f0f855ae5432ec03ed99f76b15d62ab1b5b8ae5b176a1331c223e998d36767e8

Download Submit
C:\GAB\1215.TTF

Filesize
132KB

MD5
9f55a26d868843e465aeeb10dd59d64c

SHA1
36e27cd5efbad2bcf2d9898b5a9328db62af7395

SHA256
d9d7f0b973c131b0b7923a726f6f1de964b1073ec982106a027c3db53cf02633

SHA512
01cb2653aa622db182f1a085ac72212402e78d751d993b8c5a854b088bc83b007a8ae1cb551dc49e61dafef63ac968f2f68c3d9c869ea1ad3131b9f77b4de856

Download Submit
C:\GAB\1215.TTF

Filesize
257KB

MD5
c5f4291dd642d702ffb779fb404a1a96

SHA1
76c74ade43b9baa763f75f623a4ab0641d90be76

SHA256
4947ccd8dfeca8ca7213802cf2e5e42ae92adf67ac6d9409c8c816ab0b2e4a7c

SHA512
337dccc681ae8f1f4abcc7591eda7922d3431982ee161734d0f8d45ff3c663b7fc0ade9745ed230a6711334a48bf51c46c8090a4c3fda034e144ec9adabe6f02

Download Submit
C:\GAB\1215.TTF

Filesize
118KB

MD5
13e59409509d53b3291b3a1ddb7e57b4

SHA1
d18e84bf6a4b429cb52ac5d4a3039fb33155706d

SHA256
7a6c919690cb9c26662719b123f7a6eddb8acb7bc36e5a3e049ac7ba83c61665

SHA512
4df01f75dd4627d641c8a55a26ef4ff616ebaf9e27c1e059768f6383f576a52a4e948c1061642204213274fb96eccd0af2f71ea811b9ae7e6171113065b90031

Download Submit
C:\GAB\1215.TTF

Filesize
118KB

MD5
acc67c6f3ea43dee389ef123e02782a0

SHA1
3d66abecb0edfaf8bc70e74fe96ee6b59bb9ef23

SHA256
14e4e33df206ae15853d87b963246c6668d0dcca1ceb6d49ab0f007923fa4356

SHA512
50f2690c8d9a327cf848c976141df9acaf0de889607e3903b8c00e928015a621a7f8632049cdbd40c7accdfef95fd0f0191b9c49755f50defedc5f25aa41808b

Download Submit
C:\GAB\1215.TTF

Filesize
69KB

MD5
0b98848f13a5064a6ad70b64b57b6295

SHA1
0adf99355efd3b359c0bb8aa8a33ea22ce3974a5

SHA256
d347d9ae8a42c63ed7dc15bba992d00ee9e606e0ac499a8022757c275855f612

SHA512
1a7120b0b4b17943246df6da201b69c66d87fa6e255ffb2d442398c4f3b59e9359f3b65ba56e68f8b4ca559b9ec20dbcc781734d06ea3b7b06ac943d0bc5ea62

Download Submit
C:\GAB\1215.TTF

Filesize
58KB

MD5
9f4c90054d13847235e1819b0ff97bd1

SHA1
f2553b41e5b5ed2d58cd12ee3650b90f405b120d

SHA256
76160ce9cd774532131cf4902b810a2d02c94f225da238ff8c04e25875eb66c5

SHA512
d380665ab83798586fbf8d44fdaa21b3a724b6eed36ec5a88f15765fcfeb198a082b0eece292e2fc5f87dc7e82446e1b09c4b7a9f2ce520acfc9fbe33f0342b7

Download Submit
C:\GAB\1215.TTF

Filesize
63KB

MD5
ac20018d4e9496f671842f8111e38baf

SHA1
f33eeeb47812d6372a8c4497533d872fbd4cf118

SHA256
161349da72f167d292b01d2f434cad55f1635ccc1cc0500219fe3de26b18ad61

SHA512
80e8e968f4a551fa99f7cf0fd3e933628520d7e8df545b64cf9ca3520c8184171da787dab49194af4612525a768bb28777452da0f95eb7e2f39cd38aa3ad2bc5

Download Submit
C:\GAB\1215.TTF

Filesize
63KB

MD5
b29730a7d6d05d4ef08787e2eade3a2a

SHA1
3078d511940544cba998568e5925eed801f6bab8

SHA256
980e0ce5a0f4c407e90c72a16da2a259b7fc2a0ea48d1faf048028b2735fa941

SHA512
8cf01f3934f24fc1a6e0463d5a7bfb744e4f10856b070f12a2afb7553b85f32575ca8ab1adfbd58dae2f85cbb6657105e65e7536c9fc1671b34e286440ed6502

Download Submit
C:\GAB\1215.TTF

Filesize
832KB

MD5
ce211ada60e69c16dd55926b85caade7

SHA1
9b77e32197296931aad87168cc0dee8a1704891f

SHA256
efd8bdf3a8bd6b0eb58c001a36e8594065bd1e2e94feda7be384cad1d0979008

SHA512
8a04047c43a669ab35f23211b0f78a190ac114226b6611b793d156f1f3ccb271ac70b214772b46edc79892708ce818ac1b98404b635ecaf8abdad4d00001bf79

Download Submit
C:\GAB\1215.TTF

Filesize
192KB

MD5
516f424aacf1894f43d5f869bb1d2d4b

SHA1
8ffd6e16c9f88f65c327d16d97dc9530d887cfba

SHA256
c7a04311bd8c2097bbe8d15d4a45f327194d53926bbd846823927814d86ebe14

SHA512
c1dccd3a049df0bb4de0fbb3d838e9621c202d26cd1e9223303f731c7535ce12030a94f8382f7d84a454a0031ed4c61de2197c695d2ff1475345d0a0b7872b82

Download Submit
C:\GAB\1215.TTF

Filesize
93KB

MD5
e5b38fc8a405b9de2da31804f25b66af

SHA1
0e10ffa79e9e5f8e5663f69ad18dc68880626b33

SHA256
ece195c4b0d53ce4ebaed656341708180abfebdddadf219fb014a31e70410bde

SHA512
0459fe9fa73616c5006c4d6669c3fb4da32c8cbd69bcdb1efbf09eeba0bdeb9522b7e3b50d7beb57d966f05c4f98cc44bb26070d9d53d483f02b1740fd07e781

Download Submit
C:\GAB\1215.TTF

Filesize
79KB

MD5
70233d5f0aa6b1b94190a037a265110d

SHA1
1f5c780870e5d43586dc3572693aeb11cd98907d

SHA256
73214eb92c2744aff7fe1f9d1811fc684ee10294d07aa161a6a25235f4125f5e

SHA512
b229fc4d5145bb515894b070fbfc72d99fabe8f42fbf18c70d326cbbc14ccd3d84fbd0339bebb9a51ac6ce8d54b1a6d4ea5cc83cc047c5f593db626baea251fd

Download Submit
C:\GAB\1215.TTF

Filesize
128KB

MD5
f83cc7e79abce93d105e71542206e041

SHA1
2dff5cc3320f5d15bc34ebe828e14b20a58551de

SHA256
7c96bbc96933d689b691e262c9fe794b0d0ad8e783ed46eeb476111b66795df0

SHA512
72bf9941bcc46d3dd749fa6d8937f803ad38c633febb41ead187977473afeeac478e28810acede42c40eba6d78da1bf5567894cff5f2bbcfcadfba4a5caeaa3b

Download Submit
C:\GAB\1215.TTF

Filesize
146KB

MD5
c96b36c6ec8c33462679cbf409f929db

SHA1
b169a81cb21d800dc0c1ace84d2dfc281efa57ef

SHA256
aba7a72e1d649a843446b26e9a512ef9f8a7d83da41e5463501be9bca628ef88

SHA512
c8ff6de3f52db65a2d124e026833b1dca8c04651a5f2d4a135c2c636dd45503c8a566fea3b7193fcaf72669faa2a2226bc18d62c45ed5d01afcc21c0cb098bd4

Download Submit
C:\GAB\1215.TTF

Filesize
59KB

MD5
75e6ef1b533b46479e1390bf8f887603

SHA1
3a04b54597aabc9a69d80161d82230732b1778d6

SHA256
d4d45889fe78bf123010357c943f4af048ef1822bd1eaaa22407e58551a399a5

SHA512
1fceabd2a41f668b2066d98f0c7320279aa21aea56b310dffd85f374abdb3ae6e9ae6d3ce5c5e957d7dd7a7498be2b1874d694c0b3b072639a9607a0b2c9f6e2

Download Submit
C:\GAB\1215.TTF

Filesize
192KB

MD5
b99705885eb06ea669fc3c4eb93a1000

SHA1
ba4f2518e88f3d09a1eb49889c0bb1c3c2319325

SHA256
87f082e0cb6752d85ccc8ad6271021d0ea14be941e3027c1ebd05fc68a048398

SHA512
b9efe7bd1551922a81309b9e744b3e8d3cc11f2ecbc2deb940f435b44b80f9c7f9a92a15c024cde3fc9dde0947c0fcaa7122deb09ebe3cd141866e128b69622f

Download Submit
C:\GAB\1215.TTF

Filesize
172KB

MD5
3a208a3435b4c42b1f6c8db8a28de54d

SHA1
26154223d20a7fc4eb2295edc831ab1efc1781cd

SHA256
625ffb96a6ebfa1eed847ac4af796577bc602197c8490c392b2eff56a4ddfd06

SHA512
2b69e789eafbf3467a6ef7826305dc5890c3e43c5d037b615f12314ad27792b41d53d784369ef74d64f68d6e89c547ab621ee5f4a59619353a7d59ff1ef38333

Download Submit
C:\GAB\1215.TTF

Filesize
128KB

MD5
6448cb9b11c2626cc0e5b9d5ac98951d

SHA1
5f9bfab29d56e004ed445c19eb46396a985dbfea

SHA256
30ee354003e4eaa96b58d16be93492b31e1119bec8a826b605fa30a1e0e8becf

SHA512
ca3634ed1147f5b0edd2458883d42c97dd82a484785c7c84cff21e936d417fa8039eb47d9998c4dd5ef6af08932df9d16a0ba373e12c4250b986faf12c93fb4c

Download Submit
C:\GAB\1215.TTF

Filesize
75KB

MD5
71e85ab86c3fe09ef05b1fbac6d179d0

SHA1
5d977a012af48cacbe9ed08c7f56d5eed33b1785

SHA256
3e89c31ab109f5573d79e16b6a627d0822c6436d8896b1c27e4366dad7c133be

SHA512
3d0846d18278cb138d6840612de22cf93f22a995aff68ebebde73a982b82598bc38c13cff0359334969f1141b298af3d1768ae5337732f12c27d7241f6ff8e63

Download Submit
C:\GAB\1215.TTF

Filesize
76KB

MD5
11ce603207f2546af540c4d1c27d287e

SHA1
0d6a02c529ca8d5b902df5b01d4cd99158a1ff69

SHA256
f59264ef03a0923aa0926379b2e3e47e64dcdbb9ba291bddef6d8ad08b28953f

SHA512
1d207a542e89c6f332e3559f9c2afda30a143f183fd95251e973f29d8ccae9915aec8e1676d8f3023be9d7448332007451afea78b7f75c0451d375f58bbaa8d5

Download Submit
C:\GAB\1215.TTF

Filesize
65KB

MD5
3a3d092a423bd014de2d195bd85ab146

SHA1
f0ef8aa40d804a04a36d360b58ce9e286ac4d2f2

SHA256
cecb72159f98d3ca71f407d2554cb42b3f16d72fdc227b7f73b65d13cf6d0011

SHA512
f0b25906a5beaa56476b5059dbbd071b4d45ba946d34d52f6abfd0258f0e3e669fe51cccfdf5c7de5575ffce2918d450b1112174ccefeb76dc563ae7d7168b5f

Download Submit
C:\GAB\1215.TTF

Filesize
71KB

MD5
fed576f140815b94c793e22c991c2502

SHA1
888d07d6fb3aba7703e6399f9ef5ddadc407ad7f

SHA256
bb6020a0c7896acea03bceff2ea847af854fc773d7eeaee176d6e4c86952e595

SHA512
d04ea051996366835aaae5029aa7c7ab0972df2c67591596c47776c970276a5088e147b90f48af39cea23c34ae992c8007416425955b5fd36a1312e03ddfd74f

Download Submit
C:\GAB\1215.TTF

Filesize
67KB

MD5
139eef79f26c1e30c53c3b30e5741f0a

SHA1
02b8c601d6a425ec7f794b1d3a635647de99fc77

SHA256
bf35391098749eb0fbb6a37ab58de3782cd3941f0815f772fee8a3107479457c

SHA512
d11a08847c43b860701149f5fbc69f869eb8b410fb8f3ea4423909bf51af0fdf44985103b29407234f00940db813d66e3536c82115e9819e4d5cf4616cc91f96

Download Submit
C:\GAB\1215.TTF

Filesize
64KB

MD5
5840b12e1fe2028193a0c39f3394ec3d

SHA1
dbfd3d3d0fadf74d2ebd4d4c37e8baabb24a4b70

SHA256
742b98033897b55660dd82f9a962cbac9b86930639be2bd60041de4d7994562e

SHA512
46820c70bba276f1b972bca110cbc1cdcff9a00138d0756cf973db9767ebbf0a082976cae8e0f811d2a31597cfbfdb9262b716658416ec9a6909ff2a8cd5290c

Download Submit
C:\GAB\1215.TTF

Filesize
171KB

MD5
b592a65e85d41f51230958c04130d340

SHA1
278a4278161a0a00a6af0d204d7876027fff8d2e

SHA256
bf2eb7af0acdedaf1984fe2e68c1eb5dcf69798c4161100272d086701e6b10cf

SHA512
f08c920f69764c1a07c1fa8a8e810a2b3930db45c5609043db240238581f423e8296a65d85d404ca2481e1a51ab52d47986c5144035d6187b149cf5ba6ce76c2

Download Submit
C:\GAB\1215.TTF

Filesize
253KB

MD5
3b839b8f5b064f5c20f40027783e6366

SHA1
3177f347f069330957535e17f17d7d75a47be610

SHA256
39d3f73f4857378f079c6a23d8dd4dc6fa8324712b982a4129b7d265ceaa85d7

SHA512
69e446bbb1db843e951f2b4da9880b0b2fb86e320558cdb4613c42f5b53a3249f4a7f2e4c918bc2f1a988bb5741d52e33fd51d3d93fecf268ba78d1e94b5e1a3

Download Submit
C:\GAB\1215.TTF

Filesize
34KB

MD5
9e2ee65661bee40438d514fe592bfcf8

SHA1
140a77e69329638a5c53dc01fbcfe0ce9ab93423

SHA256
ac9ee085920a3d8b076d5e0c61dc9df42c4bac28d1fc968344f9ceddb3972f69

SHA512
3b3c7ff00d8f12cea48008a2e95c194f7fc64ee96425a3cfefb8b65a9f7dad66fa16104ec1cf96ac6892426e5e8ab59dab91e3d56d76f58753b80f8ac48f2612

Download Submit
C:\GAB\1215.fon

Filesize
11KB

MD5
e8e2828893c426e2c13813655953f997

SHA1
d535561209f0199f6355b1cb7956b722c2ebc13c

SHA256
231f67c6f23f9f9f8a17e9cbc17311879cb9674c49d639c7587d0ea84e4becd6

SHA512
4a2af1c3d627633a849a6eb8faad527bb31432f9508f10d42621ffecd56e9a526a95109d45ce50750a9ebfca145fee929fe5f398933b0a6a0eb32a44fbdf11f7

Download Submit
C:\GAB\1215.fon

Filesize
12KB

MD5
485dd1b7e3c6e385c019a86f44430a73

SHA1
4969b6ca2e9651d156a0dba0c20b5c75338bdbb1

SHA256
fe05ecb88dfdcb4bd45dc846903930a2b75695d22fb27f5dbe4a3dd97dce51ea

SHA512
4be583bed425b0feb129c809f73d6e5b3f45ac2992aa8fc6cc2d18313c1fda56d8d1d9a5fdcb0c823725ee22bf36b1d1cdf74ccbea9c1c28c119e3ff8dde0507

Download Submit
C:\GAB\1215.fon

Filesize
12KB

MD5
ba66231408492f0e6085ddadb087822f

SHA1
19b0faa9021a3138d60dd7228070121f361b627d

SHA256
7f411475c0185f9dfecf704ad8c3ee5fcfdf42722a595babe7cb93dd7ba6200c

SHA512
547ff4ff7cd210f8583560652a6218e6f518aed175a197baca14a091d8af2d20273b874cd75feef6d9bcfcfae24f95fd3cef9f8c2595983f7fbbee89a818c6a1

Download Submit
C:\GAB\1215.fon

Filesize
9KB

MD5
14710889b3a475a7340045d840cf58fb

SHA1
89ce8a8b366c67a3e849e54c3680474b991e0e6a

SHA256
f8d79640d3d9c54e0722a693641b4ebc95ceaafb4b15df92f50d4c951ccb9b99

SHA512
1aa61a7e1e8153f09c6c1ac337ba3faa222a12303656168a3ef514906f6e80fb7929517e9c5ffab5339ed00fceea3630c6cf6c8f60a1c6e29c65c40ab87cad38

Download Submit
C:\GAB\1215.fon

Filesize
10KB

MD5
e83e135a35c8d52c10519e19ce98a452

SHA1
adf764a640ceef918f07ffab62e3a9370a97fc4a

SHA256
e7b34f803da510990f6d4abaf729d129887bff2c17ceadb39fec823e7f15a1dd

SHA512
4eed36f28b5d954e4bb417d011e4e000b02a090250e128261e7f57cb3cf077c9e49d22f7a5973e865fcab15dd73b52a3905c4b681bda5a0d73ab309a8d7e271e

Download Submit
C:\GAB\1215.fon

Filesize
79KB

MD5
90da1299d7024460c64c10fb26527e1e

SHA1
af5135aa364357d95bb5ff6510f712c2b54a5a9d

SHA256
cea1d9697b1d0985394e63ca635a31fbe94bed163ff428377d5951a2e6756a89

SHA512
bf3bfdcb22e4e23a95fb588f5809bd39384d7183a6dfe73acb79353130bc76a57f7cef7435b26c0342569587858902cb8cdeabf9efdd7b443ede9415dc925e22

Download Submit
C:\GAB\1215.fon

Filesize
5KB

MD5
85a2b00160b440c990405cbf5fbe67d0

SHA1
ef50813ea58a0a11305278377a1732f3fc85c703

SHA256
5488f8e0565a68e36ce087443bf218ece112c9c653a3189085ea246291715ace

SHA512
6b0dfe7b9a61fb49a987ad7af39ea6d97f18845acbe373af163cb980fc371c96370c883117bf93bdf91dd057d50b55a59ccdff17354f28c2dd6f86f0b1ca6b10

Download Submit
C:\GAB\1215.fon

Filesize
4KB

MD5
9d2bf033acde5a212f6f5404d490e169

SHA1
a0e28adf40a9d06710d20071dcaba2569b91b1dd

SHA256
93e7c6c123d9b53a2d933f63093b4b85302023517f56abf057f9ef8a94d83b8b

SHA512
8dcb0dd9dc72c2de61e26932b72d5923a43b0f512e8d2df5334f478a78ee80f492bb8cb193dd3a314a6a19dd95e4899b40e7b76c3b1f767f5e8b46d1b1b3c00d

Download Submit
C:\GAB\1215.fon

Filesize
12KB

MD5
f319dbb4098519ac71cc776b06a88f66

SHA1
80f2d9b484d93e0e743b09e4666230d2059f75dd

SHA256
5ddc4fcbeeb13a81e3060ea62b1e168f447545012273bc2019940f47cff09c20

SHA512
33d949d412c0fecbdeac49d7e5ae8a621a28a5ba8e8d7a7bfe64ae8ec58ec777b8ab31379705b7fc0f04588ed72bf4e24b6ef4ee7628d11ca1e1fdc040271abb

Download Submit
C:\GAB\1215.fon

Filesize
8KB

MD5
b0ac2d09abc0efc32b28b7e364659a15

SHA1
33738efa553c7dcb30a94055b24fd1a16616bc27

SHA256
a0e5dbe96d1cae29501b481cd98a1eac5f0f662aa367aa9712a419c3c32f4284

SHA512
25853b53eb7c6115546cf59c276142f5aa2e54718f18f98402fa7267cd685601280b2e9f903a4c4e16c74e531bf591f0355fee29b0c702e0c15ba6e00899329f

Download Submit
C:\GAB\1215.fon

Filesize
5KB

MD5
c27256b57a80ba1b00f492e319faa36d

SHA1
4c20a0ba4ff944fbe459e44764ed92c956f9df78

SHA256
335f7722e371a57fd169efdb554ef8080d8fb13dae8270ce2b0116079da27371

SHA512
4de2217e068d2ffcce2c6c2d3deabccecbe2a23d564bb34cd5f85a736c679e80ff139d6cea3c6132f3f681b5f41e927ea228b31cfc143aaf6533c67ceae5d509

Download Submit
C:\GAB\1215.fon

Filesize
5KB

MD5
21475b17405b86f37a2c15a1df2733b3

SHA1
e640903a5fa2a800a27b74c73a02ea855dcbd953

SHA256
6e7a86167874f989433a264345e5ea6c0e000861cbca8153858b23d7d35d5ecc

SHA512
5752f5cdd3d6e56de8d6382dced5b7425fead8cbdb21755fb504320157a4aad3a713fb8d5d4d52e843d60b0251b3c14ee6e7720824ace97b9fd8a5dbf7e0d8f0

Download Submit
C:\GAB\1215.fon

Filesize
6KB

MD5
ac2aad216301bc75f750ac93543c941b

SHA1
0a9a8a43087b94e829801287c7bd44ae49553935

SHA256
b904000ce079d3a87698a1e16d82f944dd49fc77e9326e698c9c402f2287133a

SHA512
c9f113198a4e713141e80343ce38306899cc2df78373630215de2ac4acc80753bfb36395f66b7d28a7f1f28628903e01fc6f4925ad09e22f4b309cb83cf5f206

Download Submit
C:\GAB\1215.fon

Filesize
7KB

MD5
ad75fb38d57de96a18fd5fcad4a282cb

SHA1
2689835e7573d1ea8cfdf6ae7fd77b671baccbc7

SHA256
c7b31d6d41b52ea093fc845bb51f5fc8bb772b278a0cd8d0dac980dc9e6b08eb

SHA512
ef3e09211a3e58428b94bda0f84d84e83e1e76f40b6f633a6a0e4121cfbdd4cf5253627be285e853d8c536a611f8abf6b2cfdff69033e596c56aaa5b625b6bc2

Download Submit
C:\GAB\1215.fon

Filesize
12KB

MD5
a71275d7ff6ecdeff05b4b3b9d1ce239

SHA1
d4c48fee5aa16dfe31690149bfba23c680ab8a85

SHA256
cb4745a7d0a3a0d552367d086182bfefbdcc974249af5cdf1750afac9fad7eb3

SHA512
dd03a487f1efb73d8eb30021fd1afa0f5c0f072ebaa6f8669be375441508c7dc6c1d1a03de84f29a312b2c27e0dedbbb42150dcab30e9c5452acb73def209241

Download Submit
C:\GAB\1215.fon

Filesize
93KB

MD5
6120c8578a9ce38edc9460df5fc1d6d9

SHA1
202d5a6b6b03fe95955b2e7fae3e45c2ef1101de

SHA256
d28f5f91888f1d1e34e2e3b859f318106d2ed7720a59c13c5e9a21d338c4c8ae

SHA512
f282683ad1e5c5a86f1c3249e2097e47c600c342587c890f2b7c6783e1fc8e014188eb83b8bc9e9ffd5ed661d59de9bf284a45ba2b4c65d75c4eb68043ec07d6

Download Submit
C:\GAB\1215.fon

Filesize
56KB

MD5
7036de1a2c57dae028856905a5a328bd

SHA1
f245385d652d1891cfc6615b5687c5508e3bc266

SHA256
19bfe5865332ca1f1392bf77950f79dbb7d9e5600f79bc546397567310364fe2

SHA512
61f9c1cd851958b2b6ee02c2e933ab8357ed1b6e00027feed22d775ede0a9fb0343930e43addb5c69e5cbf08718de0f05b0cf25213623fb63519662b19ee2157

Download Submit
C:\GAB\1215.fon

Filesize
79KB

MD5
4d992d25e715d687230691d8e55fa7da

SHA1
0ce15f009f69f39f2679e1a42844105cdcccfaf2

SHA256
116e9f622b491092e8864c2e2cc8891f47098fce884846435c565f2733a4ab9b

SHA512
ba1bdcc814aa5ac3530733bb8159f0c6a24131beaa7f531e6b0f12f3106a3a4f67bdda63f04a64ec93c863a7c93bd406bc9d0e3c7bd20c1f5fbb2a68a1b344ba

Download Submit
C:\GAB\1215.fon

Filesize
22KB

MD5
c3684228ea77e61bc8ce3ab2e67baad2

SHA1
b458911822ec75f7c9a26209c89d584a8cb3cec0

SHA256
0426a1c4864fa355f269659dcf43fecbec844feb4bce1689ac05077b69953652

SHA512
ebbc497f155269e6f9425f61dfec67582c6fc9bea161ee11de3f894fc89cc75143eaccb80a147c4eb4f151f274ff2d107aaa17de7607dcc7631ed06b6b620d16

Download Submit
C:\GAB\1215.fon

Filesize
67KB

MD5
c8770f4ec043d300b243dab762df3929

SHA1
f61389fed120c83261a616d4247f99cfa5d5108e

SHA256
a2d7ffb3f80d42047fb0386577a171285c9f7562105163ae11d23b954e6975ee

SHA512
af72a94790bdfc2c075e14565627ee12cc1ec6beb28669480285192d2dad458218b1380dd26c54c6f8c2090ddc18f54b907c6d4fe582e4ba8f7d0980d270d53b

Download Submit
C:\GAB\1215.fon

Filesize
70KB

MD5
b4efe310a86a9de7cb0e57ed56416e2d

SHA1
1c62f4898dc9da1c9e082b56bca2a58dffa3b492

SHA256
501e4bd0483d4547652c00fddebf5d083c628208d93b9a2334acfb361a2f9859

SHA512
2bf7664188cb4d0e93655896ab1d9e6cea5dd680171f96d4a3c1d6867edebfa314e6235b1caecc8ff5173baa19e2c6d8dcc2fca044567df83da9bce7161f7e73

Download Submit
C:\GAB\1215.fon

Filesize
64KB

MD5
fd98c850c1d024647df7d80dbd937c32

SHA1
000b013b3935a597fafb2635df895b8e5004df04

SHA256
7a6338bdb94e66ac962543b24f411ae5e35f4af636d0aa353da6b562e3c7addb

SHA512
44bc1351e47d5438025e4a869d79b7212cdccac606bc05579309d9c0ddd34f49358205d2ce4e6df61a04112f281f685373a8d4cc405437f1d5a67210e72e3de7

Download Submit
C:\GAB\1215.fon

Filesize
5KB

MD5
3b7c7a0dfabcf0f819c021d8fface544

SHA1
89836c80ec84416b297189f38f8741ffa29ea5a4

SHA256
1d714e4fe2aefb9faaef0cd27d79aa1077983f46fcf202f9e8686c6e7f3b68fe

SHA512
ef74dab2427a9371c5a5e99ca3542d9cd7bcc3a98e3e01564aff36cd707b7ed42c9c0a452795a75f485d52b9d7f9da017c9eb0806d0512ba4a10459d377af240

Download Submit
C:\GAB\1215.fon

Filesize
7KB

MD5
612406581a0b6f3e61a33578fe26356c

SHA1
8840632f69481a0a57059cbedaab1fff9a7917c3

SHA256
477213515baaa22b0ffee373e885cc5def232164f14d734212a4c409b2805701

SHA512
8ae4a3fb9b90d3f90fcfbda204a33ed850e33186c5bdf08653fee310a09188c06e9d4e05ca7a0930464b09887304e5dd2feb241ca7ac35989717a3108241a41b

Download Submit
C:\GAB\1215.fon

Filesize
7KB

MD5
6e78ea1629ed74deed4190d87aecbbea

SHA1
c1e6e0eea7d9e7b7e693530ed43cc271567e5bf1

SHA256
9ae1c525224824cbb209b46c64d19cfac121f1bee266a9924ec5319f7ea45295

SHA512
60be03a64880316b9d8c1dac2e9884dd1bf764ceba0be2c47a114cec20c285f6a925dcfd4f1f855f863775e6896ad8e9239ed45523ac317c4388449dd93509d6

Download Submit
C:\GAB\1215.fon

Filesize
6KB

MD5
ca12c7bd93cdc1e5f13cc2d988490435

SHA1
9483decf1cdef2015cb29606c77531fa1ee7f625

SHA256
f90c3a12a0a1adacf59aefa20e7020478b3b38fef15bd4e1495a98750b3f57a3

SHA512
a77d215f1f94fb1ad05f84173ff326283a1ac1252301b523977e9de555aefc22a7eedb96c051b01258438d894435a8e80d83643f4c8a600e36d4b8c33304dcb1

Download Submit
C:\GAB\1215.fon

Filesize
6KB

MD5
8a5dbabcb9b11e3e0c527b93e69d5e4d

SHA1
c47add614ece5ed16ca456bac08b1f2cbaccfec9

SHA256
824ea3f5eabd9c3b8e0041e78935feb65545f58760ce0c47a0d938ad75f8e241

SHA512
ddcb3520d68321e6372630cb34473c7b310ffed1263cde8e1059837e63e42e7a7e644537044dee774e9ea3e912e485f2630bc106233e039ea925355ec29921c0

Download Submit
C:\GAB\1215.ttc

Filesize
3.2MB

MD5
489210ecf84eee43deeb2418c29c21ba

SHA1
aaba959e7747e5fd07fedff523bb755ce2ba2c37

SHA256
065e483aa85e6992270bf1857730243889d5a82b9a3e044a79465bcf7816400f

SHA512
955fb2ba98fc2cc7fb3c7cf33ef18604b341555ba0758ff3b42ee43f63c8425452377eb96d0325677c3044d83f62c98d310da08cf86c682c7fdbeee8d2cc757b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
b8c7838fc0e796255d3b2fd04c81e8f4

SHA1
ae8bc08333510ec0c9c4d5880374a977b55a2d50

SHA256
79f10fd2aee9d5e90f660485ca41d475a2e9950ff6025a469f20bd518bd22ac7

SHA512
b7cbab0fd8141c581bd799eb308530b6f9bc24fc5f85bfcb8691613d6e611990647e120c6b17fefd8584a57801549f9b3189bdfd56522504705e16e2b381bdf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1d03fb1489bf951992859f0f578ff847

SHA1
80cae579e53aba094588305c2e9a4afeaded6faf

SHA256
18b31ea91f6188ee4b4c0002e9e8ed68b3ff61c3789fbea7aad4cb6adf40b214

SHA512
a8efd52c94b0ed36a39890ad77836e26170b742a32c693f2a7bf424b125ebe5537531f4bb002aeec2e3915599ebc5ba9cbca55669f96301ac83a17c448877f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32ac0a7072f7bd5418cc15bf343bcf50

SHA1
31847b6c550c214f32c11cffd240e5d1cfa40efb

SHA256
7f80d2c150422e66cf294360caccccc7967f4b41a4e649711b1dff966fe395c4

SHA512
0906d1ba744fb60543f024b9ff9a2a76b0abaee5008388c72fb89e751958db30388bb77c764f5f32b07245027e15d4913b0712947ff78cdfc013a15bfb688373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7f7bb29f985760376dd955e66409a7f

SHA1
0525e26abcf3e2fbc58a915eee627c5d99ed214c

SHA256
e10ac9679b495d1f2d05f404273e971039bc69e8d38c1e0652fd585963310ea8

SHA512
7e24cefdbee77f91bb9ec1df384c980d52d80ae0931c8d4fc1c1ea1b14deb1a9f2e1edc58acb086537f510b51ba451f51e049bc0c11df9ac70f25bbc9fda07b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e39487c6a2b55e1ce06a685dd8ac89d0

SHA1
b49b796e44ae22f6ceb30dd4c660ddef6cd86608

SHA256
6f059f2afb12e492aeb5a048d5322d5aed783f18fb18f6c1a81068cd6e2162ba

SHA512
4b4ecd1da97e724ae5f61caf3175043330c40c7aedc0768b06ad0b853716378d2c0eea00c61c1aa260ee8ed973a964f0fac7fed5a61eb8a2b47bdbcf474261a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
342ca56cbbed8b015808ceff41e7a794

SHA1
b7e49901574e596ce30fdbeedcf46f4a48c61101

SHA256
9f96f4f6df968c7fdd9bd2113ce71b1e1cd241bb657e1fca77909070e1d99b1a

SHA512
ab6fa0284c907d0a880e793afaae8e697ee2fb31972d7384503269e070ed8d028940814948af39d16d9c76843cee78a0e4b0ee18c743d3a33827df6d8c8ced22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7aa16b2289656828fd601d2b3507b17

SHA1
1075d959b1f94d939566b9da393eae7e987a595a

SHA256
fc6a2caf613e2f21badb1a49ad88f53ec809b71c910b39421392ec86dec07af5

SHA512
d2180672b6da2a80c622512651bd0c184d3e7cffc250ef33f83c6ac42fb3823c1846cde75213bd46eaf22ab221ae65dcf2f7efddb031ae61112f7354e8298c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c5cae6df21cff59dde788eb1a2183d1

SHA1
cc5f002f62e0e41c7478c538f255c4b6239acfb6

SHA256
bcc41da9b32a2966b3bbe46c2cf4ea2eaf830582ecab73bb97d02e1f00558ed1

SHA512
5adba77303b72af6728b2fb1836e47cf1237a4bad88010cf4a31043bf5838586b92a43177e056ae6a77daa5eb6cc0475820f353cc24b3f112c3328b3ecc96197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ecb396fb226612ef52ac1d76f4e1473

SHA1
c8ab8298ba4b5673a1badd58b115d1dbd4075813

SHA256
82ee585e3a0772eae0ae811ca21e1944bc116ec0e95e26b94064c2c1ee1d6c37

SHA512
741ee10a4eb2e9cb738e9e34f3dcffe9b18d0259c480313c295351b3832a86b991d9a2e38a54c85fe6e01cb77b45dbea55904616f0afd27b6ef06174170336d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73f24d19408c49c0ccf4673b7bcd9f4c

SHA1
071b0e1a6cd0c8028415fd06d9c58eeb6b324530

SHA256
7c2c43e7c8cd6920551cfe47f91a4773d840716cb15828f318580481b1de13ec

SHA512
7026ebe21ea8dde56b1ad074e80b75c4cd3ca933f7b4ed566b2a672f7bea5eeec7295454889760042ff40d7834fde9ecaac0df655e7cd97c01af11cb4e4198d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d15c8ff775b7c0eae002625935474e2

SHA1
a8188dea2a27ce9c6add7abf6af5c7d05c96332a

SHA256
0169a4c239b2ffc2b68bb1e8f18dbf18ad65995b235c3b023abee5116bd7cec2

SHA512
9de052ef2e2cee99dccb1381fee881cd0d376aa4ec3a4b1c9dcbb83e776943af6bb0448cffa0131c5a32e96c35d77782ea49d73271b5e017ef68e4ff0ba7f5b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cdb549372ea34815dac4f8e3865af37

SHA1
cac1aa67106535e8275659ae0a04b4b79f637b30

SHA256
993aacc1d709c378d03edc5deaeed0072a3327c684b83bc2fd24e311bc3b955b

SHA512
18bf306e11b8498eda9777510cba9bd1efe4280f9dd915e0f8d8777f606f18d690df9401cd60c5afe4460615bd78a4c136fa23224d55ce0dc9d8593a2bb7c0d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3bdd5dddecb7bcdc0fba209c941c71a

SHA1
e3a1dcef887040c998ba9eedd8d6edc77f6180c8

SHA256
fb30478d18a27777336555714c3584edde23034274abca05b943f79db5797f56

SHA512
6589c527737ea89fdf44a4dfda33c6dbb171e18404cd94ec3af6e888a70a3bff1f6ae9fbc80b8271f73ca0a72b6e2a0f55d76afa57fbcc39ba0c261ab708e153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e47475c3650ecfe98067a68e89960d31

SHA1
04ca78bd2882a8bb21cf24f028b5bde468b39553

SHA256
68d9c61eaaa345d031130691190d5d5b4585bf72433e6285dbbf0dd0e9ec7a01

SHA512
11cf24e025b22a6aef0e78c20042d781884b54f5c76c108261ffa286f0cf7ae450b20a80e6b8c9ef50aef5b5c5cd259eecaf6873e9d20c438ef583fd5b3b55d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cae34804ae273589430de24ad7615c5

SHA1
6faa8bc01e2a1d7c75d45ca207a966c8bde69060

SHA256
0bb1431770f6a128f9849811cedf694932f2119c1b4e309583d94c91135c8955

SHA512
e80478fcc5cc85cef10615dbd6068e72adaf67eafbcbda2ab2f6210456764892ec354c67458a68df19da59df49d1eb9bce404c2b54807ee44ef8e8b81e8cdb27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01a55f83c5b61c8b2eb4d25e4be22d19

SHA1
03aab458641be06e9b8bf5eab43b1bda7e2fdf29

SHA256
453eff981fd173441637401b46fa25d81a71f7d4e3e761a9c68f1b5fe24ca19e

SHA512
e97768673659285d60a5c86e7943f4908ec44a391ba73b95934e2c6c466062f4f2d9f99424d5a349f20a424f4ad947e7ad030835d9d03b61e1fdb68808dddbe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4961b7e84c24f546f031ee04f1ac7aa

SHA1
afebd72e8778b7f38135b7ca89ecba4111b4386d

SHA256
7d8cd05f3966c03f7442eb29a1f370a86fd396a8a58aa23b405528707464eca3

SHA512
5e7886058507b17248d2a4d5e0574d18eba7323c7cfb1db85de03fe32ac043c6d1ccadcf59c622228cb5ba8e67563529c86b9b7dc98eb458ac0124cf2aac1138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26a4e8d22af3336615c69019188fe5a2

SHA1
36045e836273156cd7768e13d4d151474fba27c3

SHA256
a0e279662b3cab1f61291845566f938555dec00f6d8abb280aa6db79aea5c47c

SHA512
91b8c9b0172147a03ebc16e63c42cacf44342b2ba47d12199ea54d01c9fea9887ab8d2e9c28e685a524bd79b3e1b27b8dda0883acb609db47b0d658f2e64ae6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d961db37f3107a6008fc106788a148df

SHA1
5fafb4a61996a2a8576422ef3f0f0795b8df7332

SHA256
7e67705718b2801cfff49e32707e69feb227f00ec6328be2e495e2ef5fc0e7ab

SHA512
94d46bf90848fbe7b7406bebfc06434131c60b0dd8038a416c3d892166c8b440814b0bce31ffe32c0f31ff87c4c50cf9aba0c999c38c8bf5e87e1c901addccf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
270191326e3fc35d276cd0f2e521b2ec

SHA1
348e6ee42bbfc0e3a89050ae6aa54f4e2ae9aac9

SHA256
a778cec65fd1916c2612a91cb9b7af0d806018e4d21755d47b46fe2356ff71a1

SHA512
942f0342e389a39b9167b1e276841440dc94393f29324c56255fbf5df1c1fafa27846ed4f769d805184259760b1f2b302f21b905bf50ded57c9ba290009cce6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CBC889F1-73CD-11EF-AF94-46A49AEEEEC8}.dat

Filesize
5KB

MD5
22fe0ea9606ee97621364fb1f56ffd18

SHA1
cb89abd99bcfba93e7f13c72e5021c5c43f1d96b

SHA256
1a0db74ac66e20822a4b93940e1755cc92cba8e7ce8a959da14d18e1eb2a5da7

SHA512
e6fe8f7cff999e429cbd5037036c414569194109c8d12764588e4dc40b0c74837cc000c7da81139efa570de516a3959995c70f4fbeb70474436549dfd2853f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CBF5DB81-73CD-11EF-AF94-46A49AEEEEC8}.dat

Filesize
5KB

MD5
a74b931b731f7cfe483f6ad323d1804e

SHA1
7f92ed5fd19a336bc3c12ce064203ff645e75598

SHA256
45efa812487278c3dfdbfcb5032e53a947626aa7dea51062e7dc0e8f217eb36c

SHA512
bd36535b3df3829724a22d185c00aa51097e5547dcc6c6d211f361f7f23c67995f34b639f9c54f9db861098485aca3ae6341cfd8daa65949f41ff8b3a5bb3f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\!m.bat

Filesize
1KB

MD5
9a406b8d8364842f6820ca4356a4c450

SHA1
153c67b38d3d6d391bd7d3b0fb7a68571ea74125

SHA256
e984a5d7fe4d4f0fa8c9d1acb99b76ca60b69ea5d373fc4ffa403678206943a3

SHA512
72721fb0689a8f7ebd057828a9e8bd1806f43f652f5d9b2026daf6de087b70a086693766f870dfd36619ee7ded4baee46ed5d4493a25814eda357d18e46664e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\PurchaseOrder.exe

Filesize
934KB

MD5
f7f32729079353000cd97b90aa314cc1

SHA1
21dbddeea2b634263c8fbf0d6178a9751d2467b8

SHA256
8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212

SHA512
2c40c12b81e7c377ddf0a6691ebeedc895dcf02c9211a1563b840de735fab77968565b1d3d0c40cc0b2b583fd4bfa1c69f995fca758ea85f548bf5797b5bf847

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\butdes.exe

Filesize
2.8MB

MD5
1535aa21451192109b86be9bcc7c4345

SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c

SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\code.js

Filesize
4KB

MD5
016bf2cf2bad527f1f1ea557408cb036

SHA1
23ab649b9fb99da8db407304ce9ca04f2b50c7b4

SHA256
17bb814cfaa135628fd77aa8a017e4b0dcd3c266b8cdca99e4d7de5d215643c0

SHA512
ac2d4f51b0b1da3c544f08b7d0618b50514509841f81bc9dad03329d5c1a90e205795a51ca59522d3aa660fb60faae19803eceeeea57f141217a6701a70510e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\color.reg

Filesize
1KB

MD5
a2441cc58179194cb45e0668e9b09cfe

SHA1
eb01b9b82ec0d46ff6f46236923cce26d017c109

SHA256
65e3f61a4c680ab23243ea3765b3cf0fc5414d34c9070cbe6f11c2cbc75ba4b0

SHA512
08644e315bd71acb452b05beb499174022095ae4b231f91c67792997394f13d7c9ec21b8caa97ba1bcf88dd484031a10c939f27f853b4ac943496d54f6452eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\doc.html

Filesize
15KB

MD5
5622e7755e5f6585a965396b0d528475

SHA1
b059dc59658822334e39323b37082374e8eeaac4

SHA256
080cb8ef0cbf5a5de9163b365eec8b29538e579f14a9caa45c0f11bc173c4147

SHA512
62f5abda3473ca043bf126eed9d0bcc0f775b5ac5f85b4fe52d1d656f476f62188d22cf79b229059a5d05e9258980c787cb755f08ca86e24e5f48655b5447f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\download.jpg

Filesize
8KB

MD5
01a5131931ef35acecbe557ba13f3954

SHA1
c7afc7590d469432704d963ffcee31ad8bcfc175

SHA256
d364872ddde28d81d23bb3b08f9e86f921b542f3a35fcaf12549cf5666462bd0

SHA512
ce32352484d676bd0f47c24808707c603fe9f09e41afd63d90f07599f13a5e32c73b0970a9964632f76f5843dda87a033340ee12fadd87b9f219329d0c69b02e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\eee.reg

Filesize
33KB

MD5
ad39d3ee72df4b32d48ce5aef0cf359f

SHA1
125b495b74a6ea49d3c8f3343a9b17b33332fd68

SHA256
ebd1cfc4d28f97d8c3044d305bcae6e8e2402fc7483c0be891619cd02c8dcc2e

SHA512
c3dc49882e4434ab06738e4786de3e79b0e44d12ad60276492bf7475d7f3408d7451b69a753aae273c05857fc2093e6f4ed2cacbd6e79f2e38296e3b7efafa29

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\favicon.ico

Filesize
5KB

MD5
e0c7cc30d8f9a3cf0140bf838198571b

SHA1
2494a9ab234b90ff0a3cc2dbc152483fb540afd3

SHA256
73bb7f4a70650054fb42f4c7ab85d9a683253a0df26703ecd4a2bb3155d93cb4

SHA512
7b87a3296fd984d89dacfa70bdc274ed9faf553c3e086d3e865ed7a2e55f92fbb55bd270a5863ebb6b95f3ce26d321b5936665741300676863f40111b95a6e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\fence.bat

Filesize
187B

MD5
f1a53c52c034352ad3efc4d7efb9bdf6

SHA1
ab9a74fbde28de0e0579266cb2547dcad77adce8

SHA256
27bfdeea2850a4336f69b840d3dc5dd800e530e0a52b22eee4d9c43cd544a13a

SHA512
6fe862a0151f80b82088cea9b965fe8b2aeb2efb0ab16b4fce442a11756a2896f32b96dbb480aba9b4266a516ff4ffbe47def17273cdc7113d700694e87dee67

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\flydes.exe

Filesize
833KB

MD5
b401505e8008994bf2a14fdf0deac874

SHA1
e4f7f375b1e88dd71a0274a997ed5d9491bde068

SHA256
6bcf6b84d71737787e3cc8d9d0eed9720f388cc2d0337832a7e8ca3c6f455a41

SHA512
1bca98547ecf5a98d42b1d77cff50ca79ee560c893b2470aeb86887fef6e40a5ccdb72956f04a1d2a862827eebd3b7746e3043f3e6209597dcde9385ed55cc11

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\font.reg

Filesize
16KB

MD5
f99019a747df87574971ff5d788cd8d6

SHA1
51f59c63c22c6524c00462ac136bae4395e9196e

SHA256
c71187aae9aa77964b19db391eb96132262b3912c54aaf830c4cc7a836404ecb

SHA512
625e88f5e45322e8da1d9e2a83b7e4abc4431d6022d20fc279a67d4404e099c8adabf643c9591e47fe592c5ef27d662e6bea2ceb62b99ebde2b1f86f8a40a9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\fries.jpg

Filesize
12KB

MD5
c4d9d3cd21ef4de91abc95f99c4bc7dc

SHA1
b2cf457237c44c824068727b8440fe6a352a360c

SHA256
6fd1c3bde9a6a478e39d1cf2121e980c0bcf59454fe1673d707aa70170953bc9

SHA512
d10fbb0bdfb30160484950aa58bd2f97c38cf2d0914550b4041c9acd273e8013920ef1ee74216f92437a44ab81111a4c70ed3dc2df680ee4d187c22557900ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\images.jpg

Filesize
13KB

MD5
49f4fe0c8646909c7cf87adf68d896fd

SHA1
9193264c38e5ed9fa0f5be1d79f802cf946a74cf

SHA256
9292dfcddc9e88e5dbc095ceeb83ce23400a3405a4d47fffc80656941c87d5ec

SHA512
9df4db8c958110cea66f627170919346ed673d3c13aa55292484fc74ebac2864b0292cd4d66d35957b4b2740b2fe30ddfb9d9e04115d655fb58bf39e100d285e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\infected.html

Filesize
972B

MD5
f48be9db7436f1c53508f1ad70064459

SHA1
16b20d3933cc6398859f1334a848982cccfd8501

SHA256
f79460fad80962fabe51f271a2ad33fd54c418fbb0a8646c1d78654696d7d7b2

SHA512
c7870b4fd16827817fa16c68f9d1a51270cfd9dc052861977a12ffcbc91a1668c82f168f8b33661d68579cfed766e15d0e436794d0eed164946eb9927355b638

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\neurosafe.exe

Filesize
289KB

MD5
f0d99e475391a9ef4be431c987af9ef7

SHA1
f2da513c5da93019f07b077459c6165b02c3f1ec

SHA256
d4e57d24203e6224043042f44a4c98a64d6f0783116ca229fcc6e5a2971c9e79

SHA512
417be9f77602de3d8d6ed43398455827ebe44411b17bca304707efb6194ba10b2f41b0f42581ac36e1558673403a16baaa65f5d16f1ff71c8a169b5fda1e3912

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\nosearch.reg

Filesize
210KB

MD5
f68d38e0570e426038ff1a1e43afe037

SHA1
0d13a96502394de36608da595e7b95fe65273275

SHA256
51f2ba3572185d138fcc40cfb83c26657c4b3c9fcb19f866abad81c75b0b8b20

SHA512
a4fe35709fc8c7ff28b8ad105d907624fd807c8d2f53b7dedc20f3003e72515b430a38e891e344c21910381b307e438607b50cd56045779e260b97fc2cce41e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\nuggets.webp

Filesize
32KB

MD5
e40209599b592630dcac551daeb6b849

SHA1
851150b573f94f07e459c320d72505e52c3e74f0

SHA256
3c9aefa00fb2073763e807a7eccac687dcc26598f68564e9f9cf9ffdcd90a2be

SHA512
6da5895f2833a18ddb58ba4a9e78dd0b3047475cae248e974dc45d839f02c62772a6ba6dfe51dd9a37f29b7ec9780e799f60f0e476655006dec693164e17eec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\screenscrew.exe

Filesize
111KB

MD5
e87a04c270f98bb6b5677cc789d1ad1d

SHA1
8c14cb338e23d4a82f6310d13b36729e543ff0ca

SHA256
e03520794f00fb39ef3cfff012f72a5d03c60f89de28dbe69016f6ed151b5338

SHA512
8784f4d42908e54ecedfb06b254992c63920f43a27903ccedd336daaeed346db44e1f40e7db971735da707b5b32206be1b1571bc0d6a2d6eb90bbf9d1f69de13

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\stopwatch.exe

Filesize
68KB

MD5
338a4b68d3292aa22049a22e9292e2a2

SHA1
9595e6f6d5e18a3e71d623ac4012e7633b020b29

SHA256
490d833205f9dfe4f1950d40c845489aa2d2039a77ab10473384986f8442ea6f

SHA512
06bc6463b65508d050c945d5bf08078eecd6982c74c7bab2a6722b99523189d24f530c10c05577e0dbd5b46e896d472112d036023ef5e576e2a8f9401b8668a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7725.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7738.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V9MF2.tmp\flydes.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA6EB.tmp\JsisPlugins.dll

Filesize
2.1MB

MD5
d21ae3f86fc69c1580175b7177484fa7

SHA1
2ed2c1f5c92ff6daa5ea785a44a6085a105ae822

SHA256
a6241f168cacb431bfcd4345dd77f87b378dd861b5d440ae8d3ffd17b9ceb450

SHA512
eda08b6ebdb3f0a3b6b43ef755fc275396a8459b8fc8a41eff55473562c394d015e5fe573b3b134eeed72edff2b0f21a3b9ee69a4541fd9738e880b71730303f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA6EB.tmp\StdUtils.dll

Filesize
195KB

MD5
34939c7b38bffedbf9b9ed444d689bc9

SHA1
81d844048f7b11cafd7561b7242af56e92825697

SHA256
b127f3e04429d9f841a03bfd9344a0450594004c770d397fb32a76f6b0eabed0

SHA512
bc1b347986a5d2107ad03b65e4b9438530033975fb8cc0a63d8ef7d88c1a96f70191c727c902eb7c3e64aa5de9ce6bb04f829ceb627eda278f44ca3dd343a953

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB33B.tmp\CR.History.tmp

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB33B.tmp\FF.places.tmp

Filesize
5.0MB

MD5
79e827a46cf98d39f25ce78ae223e53f

SHA1
2d86dd11ea6cf7e5d7752b0150c29000e3700446

SHA256
54ad30e218f5616e11c79010abff660a910581780c64049b873fac42afff10df

SHA512
16c7b8675bc43ee87746858e737b9743f5852136c6473aa29d059c8b827b297117597bb572d40861e3ddf9b7ee7c8f0082d434d443f9fa5e1bc3f21a20970f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB33B.tmp\Midex.dll

Filesize
126KB

MD5
2597a829e06eb9616af49fcd8052b8bd

SHA1
871801aba3a75f95b10701f31303de705cb0bc5a

SHA256
7359ca1befdb83d480fc1149ac0e8e90354b5224db7420b14b2d96d87cd20a87

SHA512
8e5552b2f6e1c531aaa9fd507aa53c6e3d2f1dd63fe19e6350c5b6fbb009c99d353bb064a9eba4c31af6a020b31c0cd519326d32db4c8b651b83952e265ffb35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB33B.tmp\jsis.dll

Filesize
127KB

MD5
2027121c3cdeb1a1f8a5f539d1fe2e28

SHA1
bcf79f49f8fc4c6049f33748ded21ec3471002c2

SHA256
1dae8b6de29f2cfc0745d9f2a245b9ecb77f2b272a5b43de1ba5971c43bf73a1

SHA512
5b0d9966ecc08bcc2c127b2bd916617b8de2dcbdc28aff7b4b8449a244983bfbe33c56f5c4a53b7cf21faf1dbab4bb845a5894492e7e10f3f517071f7a59727c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB33B.tmp\nsJSON.dll

Filesize
36KB

MD5
f840a9ddd319ee8c3da5190257abde5b

SHA1
3e868939239a5c6ef9acae10e1af721e4f99f24b

SHA256
ddb6c9f8de72ddd589f009e732040250b2124bca6195aa147aa7aac43fc2c73a

SHA512
8e12391027af928e4f7dad1ec4ab83e8359b19a7eb0be0372d051dfd2dd643dc0dfa086bd345760a496e5630c17f53db22f6008ae665033b766cbfcdd930881a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB33B.tmp\thirdparty.dll

Filesize
93KB

MD5
7b4bd3b8ad6e913952f8ed1ceef40cd4

SHA1
b15c0b90247a5066bd06d094fa41a73f0f931cb8

SHA256
a49d3e455d7aeca2032c30fc099bfad1b1424a2f55ec7bb0f6acbbf636214754

SHA512
d7168f9504dd6bbac7ee566c3591bfd7ad4e55bcac463cecb70540197dfe0cd969af96d113c6709d6c8ce6e91f2f5f6542a95c1a149caa78ba4bcb971e0c12a2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\220DBCD5ABC713652A86F9606E332BA47AB131F4

Filesize
1KB

MD5
054665343b61a70297e26ed0e7ec8f7c

SHA1
c965e7a0ba58f3866a23230d87ececfbd26fb698

SHA256
313a8d607d5376647c05085881755d3d441165c032431d294fadd53c4d98b286

SHA512
89858090119ae9d0ba538c1be1d61cffb00aca94f79535d58e7bbb68d0fb43dacd00ac93d684a9cbb96694aaf76e2e62543c8ef3ebdcad59e803b7e2f86bcf84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KMSAGOE9QNTMI7UHDMHT.temp

Filesize
7KB

MD5
f9b0737046a614737cc1ec61374f3ffc

SHA1
be9df8f2a7d2f0e3cece039c397cbbbc5c443b51

SHA256
f534f9f4e4a77ef903fc109a392add5f912c366db7105b892f99563b1b301f62

SHA512
189773e5c411241b9b1e4b18c1a64af6227a331789bdb3a17e1c20afcbad544c1823875666a0b10e74a827883db4108f50f2793efcb9fdc7f898ac2f2c63e6c8

Download Submit
C:\Windows\system\BZbyUec.exe

Filesize
5.2MB

MD5
223988b383dd4270b5517d2fb2891877

SHA1
a41b67ce9e68f15d033f112bba49ff5cadb23a3b

SHA256
6b1570f44a875cb8e290aa0b5b190926ae1c1a8ffcab6f8f5a4b37539b186234

SHA512
6b55915a031c618391ef70fe204c7e80cf2a898fd67897af5839b49dfa6c56f0a725aace6aee53713307143fde04f39ef03a5d104ab267cbec2ea357a8958ef0

Download Submit
\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\anti.exe

Filesize
1.9MB

MD5
cb02c0438f3f4ddabce36f8a26b0b961

SHA1
48c4fcb17e93b74030415996c0ec5c57b830ea53

SHA256
64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

SHA512
373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

Download Submit
\Users\Admin\AppData\Local\Temp\2024-09-16_3c0086e9a2673adca00e903795ded6b4_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_4727f3bb-f205-4dbe-986e-c6cdf553e65b\i.exe

Filesize
12KB

MD5
cea5426da515d43c88132a133f83ce68

SHA1
0c224d0bb777f1e3b186fdf58cc82860d96805cc

SHA256
2be7a0865ded1c0bd1f92d5e09bb7b37a9e36a40487a687e0359c93878611a78

SHA512
4c1f25147222c84dff513bebf00e828719454ad634ef9380cfc7835f0457a718b4b437ecb60c1fa72a7f83fbb67e1ddfcd225194eedda77034c72f8c752c642c

Download Submit
memory/408-3359-0x000000013F8D0000-0x000000013F8F6000-memory.dmp

Filesize
152KB

Download
memory/408-1367-0x000000013F8D0000-0x000000013F8F6000-memory.dmp

Filesize
152KB

Download
memory/604-112-0x0000000000260000-0x000000000034A000-memory.dmp

Filesize
936KB

Download
memory/752-3463-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/752-3394-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/760-4115-0x000000013F830000-0x000000013FB81000-memory.dmp

Filesize
3.3MB

Download
memory/760-3488-0x000000013F830000-0x000000013FB81000-memory.dmp

Filesize
3.3MB

Download
memory/760-3436-0x000000013F830000-0x000000013FB81000-memory.dmp

Filesize
3.3MB

Download
memory/804-3408-0x0000000000C10000-0x0000000000DB2000-memory.dmp

Filesize
1.6MB

Download
memory/804-3410-0x00000000004A0000-0x00000000004C2000-memory.dmp

Filesize
136KB

Download
memory/804-3409-0x0000000002200000-0x00000000022E2000-memory.dmp

Filesize
904KB

Download
memory/840-1246-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/840-478-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/840-3434-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1152-1365-0x000000013F9A0000-0x000000013F9C6000-memory.dmp

Filesize
152KB

Download
memory/1152-3358-0x000000013F9A0000-0x000000013F9C6000-memory.dmp

Filesize
152KB

Download
memory/1172-3514-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/1172-3443-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/1172-4125-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/1260-3346-0x000000013F100000-0x000000013F129000-memory.dmp

Filesize
164KB

Download
memory/1260-1360-0x000000013F100000-0x000000013F129000-memory.dmp

Filesize
164KB

Download
memory/1268-1247-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1268-3352-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1296-1273-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1372-4131-0x000000013FC70000-0x000000013FFC1000-memory.dmp

Filesize
3.3MB

Download
memory/1372-3493-0x000000013FC70000-0x000000013FFC1000-memory.dmp

Filesize
3.3MB

Download
memory/1520-3421-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1520-3411-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1520-3413-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1520-3415-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1520-3417-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1520-3419-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1520-3420-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2028-94-0x00000000037D0000-0x00000000037E0000-memory.dmp

Filesize
64KB

Download
memory/2056-519-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2056-1271-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2076-2-0x0000000000380000-0x00000000003A4000-memory.dmp

Filesize
144KB

Download
memory/2076-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/2076-3-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2076-1-0x00000000002C0000-0x000000000030A000-memory.dmp

Filesize
296KB

Download
memory/2076-100-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/2076-3407-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2076-101-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2272-1272-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2348-4135-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2348-3509-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2396-1530-0x00000000001B0000-0x00000000001CC000-memory.dmp

Filesize
112KB

Download
memory/2396-3030-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/2520-515-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2520-1270-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2524-3422-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2524-3486-0x000000013FB70000-0x000000013FEC1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3392-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3512-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3438-0x0000000002220000-0x0000000002571000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3545-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3546-0x000000013FCD0000-0x0000000140021000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3544-0x000000013FEB0000-0x0000000140201000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3535-0x000000013FC70000-0x000000013FFC1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3432-0x000000013FB70000-0x000000013FEC1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3426-0x000000013FCE0000-0x0000000140031000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3532-0x000000013FB20000-0x000000013FE71000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3530-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3442-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3445-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3446-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3528-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3511-0x000000013FEB0000-0x0000000140201000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3461-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3467-0x000000013FB20000-0x000000013FE71000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3494-0x0000000002220000-0x0000000002571000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3469-0x000000013FCE0000-0x0000000140031000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3470-0x000000013FC70000-0x000000013FFC1000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3492-0x0000000002220000-0x0000000002571000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3497-0x0000000002220000-0x0000000002571000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3510-0x0000000002220000-0x0000000002571000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3527-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3513-0x000000013FCD0000-0x0000000140021000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3506-0x0000000002220000-0x0000000002571000-memory.dmp

Filesize
3.3MB

Download
memory/2524-3502-0x0000000002220000-0x0000000002571000-memory.dmp

Filesize
3.3MB

Download
memory/2648-85-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-86-0x0000000000FE0000-0x00000000011D2000-memory.dmp

Filesize
1.9MB

Download
memory/2648-102-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2656-3353-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2656-1250-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2676-3355-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2740-4113-0x000000013FCE0000-0x0000000140031000-memory.dmp

Filesize
3.3MB

Download
memory/2740-3439-0x000000013FCE0000-0x0000000140031000-memory.dmp

Filesize
3.3MB

Download
memory/2880-4111-0x000000013FB70000-0x000000013FEC1000-memory.dmp

Filesize
3.3MB

Download
memory/2880-3433-0x000000013FB70000-0x000000013FEC1000-memory.dmp

Filesize
3.3MB

Download
memory/2900-4133-0x000000013FB20000-0x000000013FE71000-memory.dmp

Filesize
3.3MB

Download
memory/2900-3468-0x000000013FB20000-0x000000013FE71000-memory.dmp

Filesize
3.3MB

Download
memory/2900-3534-0x000000013FB20000-0x000000013FE71000-memory.dmp

Filesize
3.3MB

Download
memory/2904-3393-0x0000000002770000-0x00000000027C1000-memory.dmp

Filesize
324KB

Download
memory/2904-3344-0x00000000027F0000-0x0000000002819000-memory.dmp

Filesize
164KB

Download
memory/2904-3347-0x00000000027F0000-0x0000000002816000-memory.dmp

Filesize
152KB

Download
memory/2904-3345-0x00000000027F0000-0x0000000002817000-memory.dmp

Filesize
156KB

Download
memory/2904-1359-0x00000000027F0000-0x0000000002817000-memory.dmp

Filesize
156KB

Download
memory/2904-1361-0x00000000027F0000-0x0000000002816000-memory.dmp

Filesize
152KB

Download
memory/2904-3389-0x00000000035F0000-0x0000000003941000-memory.dmp

Filesize
3.3MB

Download
memory/2904-3391-0x0000000002770000-0x00000000027C1000-memory.dmp

Filesize
324KB

Download
memory/2904-3357-0x00000000027F0000-0x0000000002816000-memory.dmp

Filesize
152KB

Download
memory/2904-1358-0x00000000027F0000-0x0000000002819000-memory.dmp

Filesize
164KB

Download
memory/2904-1364-0x00000000027F0000-0x0000000002816000-memory.dmp

Filesize
152KB

Download
memory/2936-3531-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2936-4129-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2936-3462-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2948-3356-0x000000013FB60000-0x000000013FB87000-memory.dmp

Filesize
156KB

Download
memory/2948-1363-0x000000013FB60000-0x000000013FB87000-memory.dmp

Filesize
156KB

Download
memory/2972-3453-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2972-4127-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2972-3529-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/3064-3354-0x0000000000400000-0x0000000000729000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads