agenttesla | b092df938c83fe5f929d53a2f449f54de2ee7156881b72932b42d6127f9e6df6

Analysis

max time kernel
20s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe
Size

58.1MB
MD5

09dc1da297f4981397cc9a9854cc0339
SHA1

73f45544088fe01663494b109acf61b4c2d3c081
SHA256

b092df938c83fe5f929d53a2f449f54de2ee7156881b72932b42d6127f9e6df6
SHA512

bbf165224365ff6999ce9e4395000007940c9670abec686a9bba742dceb0bd630f83c5a8afce4931b739d930e4951e9fa4cc5227a8248e12097060208edda9ac
SSDEEP

1572864:rLOrJXzVo0mz3uu2etPQiWmoh8rb28CQG2Y:rLqJXBo0kuu3IDmnrb5Y

Score

10^/10

agenttesla cobaltstrike modiloader raccoon xmrig 2ca5558c9ec8037d24a611513d7bd076 backdoor bootkit discovery evasion execution keylogger miner persistence spyware stealer trojan upx

Malware Config

Extracted

Family

raccoon

Botnet

2ca5558c9ec8037d24a611513d7bd076

https://192.153.57.177:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
webmaster
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002344e-2139.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 2 IoCs

resource	yara_rule
behavioral2/memory/6244-2125-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/6244-2126-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/7092-2247-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral2/memory/440-2204-0x00007FF7BE630000-0x00007FF7BE981000-memory.dmp	xmrig
behavioral2/memory/7008-2208-0x00007FF6BC830000-0x00007FF6BCB81000-memory.dmp	xmrig
behavioral2/memory/6080-2188-0x00007FF7DEEB0000-0x00007FF7DF201000-memory.dmp	xmrig
behavioral2/memory/6336-2213-0x00007FF77A840000-0x00007FF77AB91000-memory.dmp	xmrig
behavioral2/memory/6384-2215-0x00007FF679CF0000-0x00007FF67A041000-memory.dmp	xmrig
behavioral2/memory/4192-2218-0x00007FF78DC50000-0x00007FF78DFA1000-memory.dmp	xmrig
behavioral2/memory/6480-2219-0x00007FF7EB700000-0x00007FF7EBA51000-memory.dmp	xmrig
behavioral2/memory/6608-2222-0x00007FF6A9F10000-0x00007FF6AA261000-memory.dmp	xmrig
behavioral2/memory/6052-2223-0x00007FF7A4CC0000-0x00007FF7A5011000-memory.dmp	xmrig
behavioral2/memory/7000-2226-0x00007FF66D160000-0x00007FF66D4B1000-memory.dmp	xmrig
behavioral2/memory/5280-2225-0x00007FF78A6F0000-0x00007FF78AA41000-memory.dmp	xmrig
behavioral2/memory/6556-2224-0x00007FF64A2D0000-0x00007FF64A621000-memory.dmp	xmrig
behavioral2/memory/6484-2221-0x00007FF60C2A0000-0x00007FF60C5F1000-memory.dmp	xmrig
behavioral2/memory/6508-2220-0x00007FF67B190000-0x00007FF67B4E1000-memory.dmp	xmrig
behavioral2/memory/3288-2217-0x00007FF763F50000-0x00007FF7642A1000-memory.dmp	xmrig
behavioral2/memory/4016-2216-0x00007FF7A4580000-0x00007FF7A48D1000-memory.dmp	xmrig
behavioral2/memory/6320-2214-0x00007FF7A42E0000-0x00007FF7A4631000-memory.dmp	xmrig
behavioral2/memory/7024-2212-0x00007FF75ADD0000-0x00007FF75B121000-memory.dmp	xmrig
behavioral2/memory/6824-2244-0x00007FF71FC70000-0x00007FF71FFC1000-memory.dmp	xmrig
behavioral2/memory/6228-2248-0x00007FF7F49B0000-0x00007FF7F4D01000-memory.dmp	xmrig
behavioral2/memory/7148-2249-0x00007FF64F290000-0x00007FF64F5E1000-memory.dmp	xmrig
behavioral2/memory/3100-2255-0x00007FF777A70000-0x00007FF777DC1000-memory.dmp	xmrig
behavioral2/memory/440-2363-0x00007FF7BE630000-0x00007FF7BE981000-memory.dmp	xmrig
behavioral2/memory/6052-2365-0x00007FF7A4CC0000-0x00007FF7A5011000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6128	powershell.exe
6120	powershell.exe
6112	powershell.exe
2436	powershell.exe
2456	powershell.exe

Downloads MZ/PE file

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5896	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	avg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	ajC036.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 25 IoCs

pid	Process
1852	anti.exe
3168	butdes.exe
4520	flydes.exe
1492	i.exe
4492	butdes.tmp
4236	flydes.tmp
3564	gx.exe
2040	bundle.exe
5112	rckdck.exe
680	is-GGSBU.tmp
3724	avg.exe
3576	telamon.exe
3956	setup.exe
3276	setup.exe
4996	stopwatch.exe
1288	telamon.tmp
2280	setup.exe
5256	tt-installer-helper.exe
5524	tt-installer-helper.exe
5924	ajC036.exe
5676	g_.exe
5636	t.exe
5720	g.exe
5868	e.exe
5984	Bootstraper.exe

Loads dropped DLL 26 IoCs

pid	Process
3956	setup.exe
3276	setup.exe
3724	avg.exe
3724	avg.exe
1288	telamon.tmp
2280	setup.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5636	t.exe
5636	t.exe
5720	g.exe
5720	g.exe
5676	g_.exe
5676	g_.exe
5868	e.exe
5868	e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6824-2117-0x00007FF71FC70000-0x00007FF71FFC1000-memory.dmp	upx
behavioral2/files/0x000800000002344e-2139.dat	upx
behavioral2/memory/6228-2181-0x00007FF7F49B0000-0x00007FF7F4D01000-memory.dmp	upx
behavioral2/memory/3100-2189-0x00007FF777A70000-0x00007FF777DC1000-memory.dmp	upx
behavioral2/memory/440-2204-0x00007FF7BE630000-0x00007FF7BE981000-memory.dmp	upx
behavioral2/memory/7148-2198-0x00007FF64F290000-0x00007FF64F5E1000-memory.dmp	upx
behavioral2/memory/7008-2208-0x00007FF6BC830000-0x00007FF6BCB81000-memory.dmp	upx
behavioral2/memory/6080-2188-0x00007FF7DEEB0000-0x00007FF7DF201000-memory.dmp	upx
behavioral2/memory/6336-2213-0x00007FF77A840000-0x00007FF77AB91000-memory.dmp	upx
behavioral2/memory/6384-2215-0x00007FF679CF0000-0x00007FF67A041000-memory.dmp	upx
behavioral2/memory/4192-2218-0x00007FF78DC50000-0x00007FF78DFA1000-memory.dmp	upx
behavioral2/memory/6480-2219-0x00007FF7EB700000-0x00007FF7EBA51000-memory.dmp	upx
behavioral2/memory/6608-2222-0x00007FF6A9F10000-0x00007FF6AA261000-memory.dmp	upx
behavioral2/memory/6052-2223-0x00007FF7A4CC0000-0x00007FF7A5011000-memory.dmp	upx
behavioral2/memory/7000-2226-0x00007FF66D160000-0x00007FF66D4B1000-memory.dmp	upx
behavioral2/memory/5280-2225-0x00007FF78A6F0000-0x00007FF78AA41000-memory.dmp	upx
behavioral2/memory/6556-2224-0x00007FF64A2D0000-0x00007FF64A621000-memory.dmp	upx
behavioral2/memory/6484-2221-0x00007FF60C2A0000-0x00007FF60C5F1000-memory.dmp	upx
behavioral2/memory/6508-2220-0x00007FF67B190000-0x00007FF67B4E1000-memory.dmp	upx
behavioral2/memory/3288-2217-0x00007FF763F50000-0x00007FF7642A1000-memory.dmp	upx
behavioral2/memory/4016-2216-0x00007FF7A4580000-0x00007FF7A48D1000-memory.dmp	upx
behavioral2/memory/6320-2214-0x00007FF7A42E0000-0x00007FF7A4631000-memory.dmp	upx
behavioral2/memory/7024-2212-0x00007FF75ADD0000-0x00007FF75B121000-memory.dmp	upx
behavioral2/memory/6824-2244-0x00007FF71FC70000-0x00007FF71FFC1000-memory.dmp	upx
behavioral2/memory/6228-2248-0x00007FF7F49B0000-0x00007FF7F4D01000-memory.dmp	upx
behavioral2/memory/7148-2249-0x00007FF64F290000-0x00007FF64F5E1000-memory.dmp	upx
behavioral2/memory/3100-2255-0x00007FF777A70000-0x00007FF777DC1000-memory.dmp	upx
behavioral2/memory/440-2363-0x00007FF7BE630000-0x00007FF7BE981000-memory.dmp	upx
behavioral2/memory/6052-2365-0x00007FF7A4CC0000-0x00007FF7A5011000-memory.dmp	upx

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	avg.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\AVAST Software\Avast	avg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	ajC036.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\AVAST Software\Avast	ajC036.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
215	raw.githubusercontent.com
216	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
261	api.ipify.org
262	api.ipify.org

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ajC036.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rckdck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ajC036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	telamon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stopwatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flydes.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butdes.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-GGSBU.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tt-installer-helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstraper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	butdes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flydes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	telamon.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajC036.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ajC036.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3908	timeout.exe
6844	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
6340	taskkill.exe
5492	taskkill.exe
5080	taskkill.exe
3876	taskkill.exe
5832	taskkill.exe
5596	taskkill.exe
6780	taskkill.exe
5588	taskkill.exe
5552	taskkill.exe
2948	taskkill.exe
6568	taskkill.exe
6120	taskkill.exe
6256	taskkill.exe
6988	taskkill.exe
7080	taskkill.exe
796	taskkill.exe
4308	taskkill.exe
5720	taskkill.exe
6984	taskkill.exe
5180	taskkill.exe
6396	taskkill.exe
5628	taskkill.exe
6648	taskkill.exe
6392	taskkill.exe
4612	taskkill.exe
6768	taskkill.exe
5340	taskkill.exe
7076	taskkill.exe
5804	taskkill.exe
6208	taskkill.exe
6856	taskkill.exe
6308	taskkill.exe
6188	taskkill.exe
1072	taskkill.exe
1440	taskkill.exe
4000	taskkill.exe
6672	taskkill.exe
2784	taskkill.exe
4600	taskkill.exe
5688	taskkill.exe
6648	taskkill.exe
6940	taskkill.exe
7128	taskkill.exe
5848	taskkill.exe
4012	taskkill.exe
2784	taskkill.exe
5748	taskkill.exe
5880	taskkill.exe
5548	taskkill.exe
5340	taskkill.exe
3332	taskkill.exe
5776	taskkill.exe
5476	taskkill.exe
6772	taskkill.exe
7124	taskkill.exe
532	taskkill.exe
3944	taskkill.exe
3100	taskkill.exe
5436	taskkill.exe
5044	taskkill.exe
4232	taskkill.exe
6584	taskkill.exe
6712	taskkill.exe
2580	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
7164	notepad.exe
5360	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
3468	msedge.exe
3468	msedge.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
3724	avg.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe
5924	ajC036.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	taskkill.exe
Token: 33	4956	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4956	AUDIODG.EXE
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	3876	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	5304	taskkill.exe
Token: SeDebugPrivilege	5628	taskkill.exe
Token: SeDebugPrivilege	5720	taskkill.exe
Token: SeDebugPrivilege	5748	taskkill.exe
Token: SeDebugPrivilege	5776	taskkill.exe
Token: SeDebugPrivilege	5804	taskkill.exe
Token: SeDebugPrivilege	5832	taskkill.exe
Token: SeDebugPrivilege	5880	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	5164	taskkill.exe
Token: SeDebugPrivilege	5548	taskkill.exe
Token: SeDebugPrivilege	5340	taskkill.exe
Token: SeShutdownPrivilege	5440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5440	msiexec.exe
Token: SeSecurityPrivilege	5840	msiexec.exe
Token: SeCreateTokenPrivilege	5440	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5440	msiexec.exe
Token: SeLockMemoryPrivilege	5440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5440	msiexec.exe
Token: SeMachineAccountPrivilege	5440	msiexec.exe
Token: SeTcbPrivilege	5440	msiexec.exe
Token: SeSecurityPrivilege	5440	msiexec.exe
Token: SeTakeOwnershipPrivilege	5440	msiexec.exe
Token: SeLoadDriverPrivilege	5440	msiexec.exe
Token: SeSystemProfilePrivilege	5440	msiexec.exe
Token: SeSystemtimePrivilege	5440	msiexec.exe
Token: SeProfSingleProcessPrivilege	5440	msiexec.exe
Token: SeIncBasePriorityPrivilege	5440	msiexec.exe
Token: SeCreatePagefilePrivilege	5440	msiexec.exe
Token: SeCreatePermanentPrivilege	5440	msiexec.exe
Token: SeBackupPrivilege	5440	msiexec.exe
Token: SeRestorePrivilege	5440	msiexec.exe
Token: SeShutdownPrivilege	5440	msiexec.exe
Token: SeDebugPrivilege	5440	msiexec.exe
Token: SeAuditPrivilege	5440	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5440	msiexec.exe
Token: SeChangeNotifyPrivilege	5440	msiexec.exe
Token: SeRemoteShutdownPrivilege	5440	msiexec.exe
Token: SeUndockPrivilege	5440	msiexec.exe
Token: SeSyncAgentPrivilege	5440	msiexec.exe
Token: SeEnableDelegationPrivilege	5440	msiexec.exe
Token: SeManageVolumePrivilege	5440	msiexec.exe
Token: SeImpersonatePrivilege	5440	msiexec.exe
Token: SeCreateGlobalPrivilege	5440	msiexec.exe
Token: SeDebugPrivilege	5940	taskkill.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1852	anti.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
4996	stopwatch.exe
5440	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3956	setup.exe
3724	avg.exe
5924	ajC036.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1972	4860	2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe	83
PID 4860 wrote to memory of 1972	4860	2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe	83
PID 4860 wrote to memory of 1972	4860	2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe	83
PID 1972 wrote to memory of 1852	1972	cmd.exe	85
PID 1972 wrote to memory of 1852	1972	cmd.exe	85
PID 1972 wrote to memory of 1852	1972	cmd.exe	85
PID 1972 wrote to memory of 5076	1972	cmd.exe	86
PID 1972 wrote to memory of 5076	1972	cmd.exe	86
PID 1972 wrote to memory of 5076	1972	cmd.exe	86
PID 5076 wrote to memory of 3332	5076	cmd.exe	88
PID 5076 wrote to memory of 3332	5076	cmd.exe	88
PID 5076 wrote to memory of 3332	5076	cmd.exe	88
PID 1972 wrote to memory of 3468	1972	cmd.exe	89
PID 1972 wrote to memory of 3468	1972	cmd.exe	89
PID 3468 wrote to memory of 1540	3468	msedge.exe	92
PID 3468 wrote to memory of 1540	3468	msedge.exe	92
PID 1972 wrote to memory of 3168	1972	cmd.exe	93
PID 1972 wrote to memory of 3168	1972	cmd.exe	93
PID 1972 wrote to memory of 3168	1972	cmd.exe	93
PID 1972 wrote to memory of 4520	1972	cmd.exe	94
PID 1972 wrote to memory of 4520	1972	cmd.exe	94
PID 1972 wrote to memory of 4520	1972	cmd.exe	94
PID 1972 wrote to memory of 1492	1972	cmd.exe	95
PID 1972 wrote to memory of 1492	1972	cmd.exe	95
PID 4520 wrote to memory of 4236	4520	flydes.exe	96
PID 4520 wrote to memory of 4236	4520	flydes.exe	96
PID 4520 wrote to memory of 4236	4520	flydes.exe	96
PID 3168 wrote to memory of 4492	3168	butdes.exe	97
PID 3168 wrote to memory of 4492	3168	butdes.exe	97
PID 3168 wrote to memory of 4492	3168	butdes.exe	97
PID 1972 wrote to memory of 3908	1972	cmd.exe	98
PID 1972 wrote to memory of 3908	1972	cmd.exe	98
PID 1972 wrote to memory of 3908	1972	cmd.exe	98
PID 5076 wrote to memory of 5080	5076	cmd.exe	99
PID 5076 wrote to memory of 5080	5076	cmd.exe	99
PID 5076 wrote to memory of 5080	5076	cmd.exe	99
PID 5076 wrote to memory of 2784	5076	cmd.exe	215
PID 5076 wrote to memory of 2784	5076	cmd.exe	215
PID 5076 wrote to memory of 2784	5076	cmd.exe	215
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102
PID 3468 wrote to memory of 2704	3468	msedge.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5896	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\!m.bat" "
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\anti.exe
    anti.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K fence.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3332
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5080
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1072
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2580
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5304
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5628
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5748
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5776
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5044
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:5688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:6768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:6536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:6340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:6856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:7124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:6744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:6648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:6940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1440
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:4232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:4612
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:7068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:4000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:7128
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:5340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:3944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:5180
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:6396
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:3100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:6120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:4600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:2784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:6380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:6540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:6584
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:6188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:7076
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:7080
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      PID:6968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:5476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:5492
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:6780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:6712
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:796
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      PID:6592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im shutdown.exe
      4⤵
      Kills process with taskkill
      PID:6772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5588
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im werfault.exe
      4⤵
      Kills process with taskkill
      PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\doc.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99b3d46f8,0x7ff99b3d4708,0x7ff99b3d4718
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2388 /prefetch:2
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,811441720495506999,15833583001542609523,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5104 /prefetch:2
      4⤵
      PID:5788
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\butdes.exe
    butdes.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\is-ICCHK.tmp\butdes.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ICCHK.tmp\butdes.tmp" /SL5="$80116,2719719,54272,C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\butdes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4492
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\flydes.exe
    flydes.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\is-0IGD5.tmp\flydes.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0IGD5.tmp\flydes.tmp" /SL5="$70280,595662,54272,C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\flydes.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4236
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\i.exe
    i.exe
    3⤵
    - Executes dropped EXE
    PID:1492
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3908
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\gx.exe
    gx.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\7zSCED79A97\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zSCED79A97\setup.exe --server-tracking-blob=MzY5Njg4ZTc1OTE1MjcyMTMxZmYwZTk4ODU3ZWE4Mjk0NjQ0Nzc5MjcxMWY4OGZhOThlNTU5YmNlNzA1NmJiOTp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9OTF9VVlJfMzczNiZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTM3MzZfJnV0bV9pZD0wNTgwYWM0YWUyOTA0ZDA3ODNkOTQxNWE0NWRhZGFkYSZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRnJ1JTJGZ3glM0ZlZGl0aW9uJTNEc3RkLTIlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fTkxfVVZSXzM3MzYlMjZ1dG1fY29udGVudCUzRDM3MzZfJTI2dXRtX2lkJTNEMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9MDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmZGxfdG9rZW49NzAwOTYzNzgiLCJ0aW1lc3RhbXAiOiIxNzI1ODAyMjIzLjgwMDQiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEyOC4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9OTF9VVlJfMzczNiIsImNvbnRlbnQiOiIzNzM2XyIsImlkIjoiMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI0ODkyOGFmMC1jZDc3LTQ0NDctYTQyNy1kNzY5ODRmOGQ5NGMifQ==
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\7zSCED79A97\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCED79A97\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.115 --initial-client-data=0x31c,0x320,0x324,0x2f8,0x328,0x6f4b1b54,0x6f4b1b60,0x6f4b1b6c
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409160823531\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409160823531\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409160823531\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409160823531\assistant\assistant_installer.exe" --version
        5⤵
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409160823531\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409160823531\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x26c,0x248,0x8e4f48,0x8e4f58,0x8e4f64
        6⤵
        
        PID:6620
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\bundle.exe
    bundle.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\rckdck.exe
    rckdck.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\is-DPV13.tmp\is-GGSBU.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DPV13.tmp\is-GGSBU.tmp" /SL4 $2010C "C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\rckdck.exe" 6123423 52736
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:680
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\avg.exe
    avg.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\ajC036.exe
      "C:\Users\Admin\AppData\Local\Temp\ajC036.exe" /relaunch=8 /was_elevated=1 /tagdata
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5924
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\telamon.exe
    telamon.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\is-NL0ST.tmp\telamon.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NL0ST.tmp\telamon.tmp" /SL5="$200A2,1520969,918016,C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\telamon.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1288
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\tt-installer-helper.exe" --getuid > "C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\~execwithresult.txt""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\tt-installer-helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\tt-installer-helper.exe" --getuid
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5256
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\telamon.exe > "C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\~execwithresult.txt""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\tt-installer-helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\telamon.exe
        6⤵
        Executes dropped EXE
        
        PID:5524
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\stopwatch.exe
    stopwatch.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4996
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\gadget.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5440
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\g_.exe
    g_.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5676
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\t.exe
    t.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5636
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\g.exe
    g.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\e.exe
    e.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5868
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\GAB
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5896
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\Bootstraper.exe
    Bootstraper.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\SalaNses'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6120
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6128
  - - C:\SalaNses\soles.exe
      "C:\SalaNses\soles.exe"
      4⤵
      PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\dng.html
    3⤵
    PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99b3d46f8,0x7ff99b3d4708,0x7ff99b3d4718
      4⤵
      PID:2280
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10
    3⤵
    - Delays execution with timeout.exe
    PID:6844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K proxy.bat
    3⤵
    PID:6340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:6988
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\GAB\10005.CompositeFont"
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:7164
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\GAB\10005.ini
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5360
- - C:\Windows\SysWOW64\fontview.exe
    "C:\Windows\System32\fontview.exe" C:\GAB\10005.ttc
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\fontview.exe
    "C:\Windows\System32\fontview.exe" C:\GAB\10005.TTF
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\cobstrk.exe
    cobstrk.exe
    3⤵
    PID:6824
  - - C:\Windows\System\TOzKZir.exe
      C:\Windows\System\TOzKZir.exe
      4⤵
      PID:6228
  - - C:\Windows\System\yIEfYeB.exe
      C:\Windows\System\yIEfYeB.exe
      4⤵
      PID:6080
  - - C:\Windows\System\WbTZdxG.exe
      C:\Windows\System\WbTZdxG.exe
      4⤵
      PID:3100
  - - C:\Windows\System\HyKfmID.exe
      C:\Windows\System\HyKfmID.exe
      4⤵
      PID:6052
  - - C:\Windows\System\LinEwVV.exe
      C:\Windows\System\LinEwVV.exe
      4⤵
      PID:7148
  - - C:\Windows\System\YbEcTzz.exe
      C:\Windows\System\YbEcTzz.exe
      4⤵
      PID:440
  - - C:\Windows\System\wHdIWip.exe
      C:\Windows\System\wHdIWip.exe
      4⤵
      PID:7008
  - - C:\Windows\System\ugjKHnk.exe
      C:\Windows\System\ugjKHnk.exe
      4⤵
      PID:7024
  - - C:\Windows\System\GdlxEHz.exe
      C:\Windows\System\GdlxEHz.exe
      4⤵
      PID:6336
  - - C:\Windows\System\eKKlSZr.exe
      C:\Windows\System\eKKlSZr.exe
      4⤵
      PID:6320
  - - C:\Windows\System\REBiHbS.exe
      C:\Windows\System\REBiHbS.exe
      4⤵
      PID:6556
  - - C:\Windows\System\lFGVCBA.exe
      C:\Windows\System\lFGVCBA.exe
      4⤵
      PID:6384
  - - C:\Windows\System\AMuFpwp.exe
      C:\Windows\System\AMuFpwp.exe
      4⤵
      PID:4016
  - - C:\Windows\System\PEGetRy.exe
      C:\Windows\System\PEGetRy.exe
      4⤵
      PID:3288
  - - C:\Windows\System\rCeneMx.exe
      C:\Windows\System\rCeneMx.exe
      4⤵
      PID:4192
  - - C:\Windows\System\nQTyMBX.exe
      C:\Windows\System\nQTyMBX.exe
      4⤵
      PID:5280
  - - C:\Windows\System\gidHypZ.exe
      C:\Windows\System\gidHypZ.exe
      4⤵
      PID:6480
  - - C:\Windows\System\usIxedm.exe
      C:\Windows\System\usIxedm.exe
      4⤵
      PID:6508
  - - C:\Windows\System\LCwmFew.exe
      C:\Windows\System\LCwmFew.exe
      4⤵
      PID:6484
  - - C:\Windows\System\KdvEVkl.exe
      C:\Windows\System\KdvEVkl.exe
      4⤵
      PID:6608
  - - C:\Windows\System\qqrnEoA.exe
      C:\Windows\System\qqrnEoA.exe
      4⤵
      PID:7000
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\jaf.exe
    jaf.exe
    3⤵
    PID:7092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K des.cmd
    3⤵
    PID:5992
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\file.exe
    file.exe
    3⤵
    PID:6640
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\PurchaseOrder.exe
    PurchaseOrder.exe
    3⤵
    PID:6628
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\PurchaseOrder.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2436
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TESAYt.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2456
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1072
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TESAYt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA4E6.tmp"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5836
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:6844
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:6928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x318
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GAB\10005.CompositeFont

Filesize
42KB

MD5
8f64a583b0823bfc2fdf7277e67b5e16

SHA1
f8029c828d0aef58f8818b866f1f7f1ec2f095b8

SHA256
b637a0f9031088d08147f397836fe1c16b15c70db696db4ddea05ec5b95b4f91

SHA512
e8c7941c8a42f6408b0071c7f0ea06a226757d3a07e3943738296c5dd5e5e60d682424182f0d788f42a5758f1c76ef1ec89901acc43799833234f09f3b4278a2

Download Submit
C:\GAB\10005.TTF

Filesize
192KB

MD5
f7b1472867c97ee78b7f235f03e5def2

SHA1
bc2b56ae0b0b240618e01cd32077a5be97d01ec0

SHA256
bd46951cf86985c207fbd92b913883e2ff65afd49d4a101459429570dd6e588d

SHA512
544d264762bf382e2128e7f14db2d7b278e2c20fbf863e80da0b32b0628b1e814f144570b27a973a145164b447c37589071a859020dab4fa4095ebd3e126268b

Download Submit
C:\GAB\10005.TTF

Filesize
61KB

MD5
e7bed05c30089838608b1c37988d78e7

SHA1
5da70eae06a01da6144f5b0d51d8c88d1f6b1de0

SHA256
efef0fa6138c648f9b5694f11d3372cf2733ae6126c91dbc7b2327c00546a699

SHA512
0140f75bc15b64f4f913715409febf4209e21b890cdce51f8e2246f6bf1e40ec9d0ae072db0fcdce1e613abc2ec1309f96651f9fb25665865c5c9829a4352307

Download Submit
C:\GAB\10005.TTF

Filesize
1.1MB

MD5
15e38bb2a94b1c34087106ead5be11e5

SHA1
bd09acd84daac7ebc297fb11155497808cf26372

SHA256
b1379f5df117e0325c34fdaa61a2454303717b05d15ff04186d4be47aa3aa4c2

SHA512
438f77742c0c16c2537e8cff78a9227149f81f005fd3d20d5e86985fd8ed58f34375d110192795363bcd7132a6e341a6ad0a09d1edb51a8149c3b9a4d58bff93

Download Submit
C:\GAB\10005.TTF

Filesize
164KB

MD5
32442207adcaa9247104cf2fce48e73e

SHA1
a9731d6f54ad7687de8c3910bb47531300983320

SHA256
91046862e08fbade0bdd648e81c4efbe6a963947f8b6e32b64a28fe39073c468

SHA512
21b20dfd395538eba5673c3abc1833065ade489aef01f304264eac8e74051cbaad7ecb1257c06b77878f49c4f710d1b9ac75012312e159927fdc62876d62f3a8

Download Submit
C:\GAB\10005.TTF

Filesize
933KB

MD5
3acaf2bc511a361018240882ba732b35

SHA1
6164af868bcbfa9c9ed973000b71ed7861d4cced

SHA256
b7fb24c6a49a5bd68ae295296b5a6b91b1a3cdd236e70d0113ea899057f08d21

SHA512
f99301baf7d83a82b3b784836fc944bc73efcda197475866348a40bb92a4e057fbaeee2492ee3fbd2f0a5a8a6e311394346e7e3d80a928c53830d0437be47ac1

Download Submit
C:\GAB\10005.TTF

Filesize
449KB

MD5
8e0aed5d7d7959aa4b510f11f5bde9ca

SHA1
01df582563c5578c2939a792b781f25f8a3956bc

SHA256
f06d499543a714728a4545c5655d5cfe142483f4abbf62f9f0e3e5f71139ffdb

SHA512
dc405e2fc19f57279ae114b4f72584bd884d69a6c8ca4bb2a42672313fe0135874ca85e17cbf48d46f160c3ea06b4bcf34d10b4a061d1bbe667140488723309e

Download Submit
C:\GAB\10005.TTF

Filesize
1.1MB

MD5
53589909799fb70b21681bcc8876ce61

SHA1
fd1f332a037d0d4f616c7cd15591949a97a2f90c

SHA256
b252bc620d9d4df9713cce7ed8c6131563e4d76e9ae7d0336faa14f757cafee6

SHA512
6c1a0aa00f3020aaf935e547d7c02df6978f8a996a382fbb688129c79fd260bb4deda7b19992d36e3b21501a03d17ba325260c3c965355dda4d4777e2f33f3a8

Download Submit
C:\GAB\10005.TTF

Filesize
34KB

MD5
9e2ee65661bee40438d514fe592bfcf8

SHA1
140a77e69329638a5c53dc01fbcfe0ce9ab93423

SHA256
ac9ee085920a3d8b076d5e0c61dc9df42c4bac28d1fc968344f9ceddb3972f69

SHA512
3b3c7ff00d8f12cea48008a2e95c194f7fc64ee96425a3cfefb8b65a9f7dad66fa16104ec1cf96ac6892426e5e8ab59dab91e3d56d76f58753b80f8ac48f2612

Download Submit
C:\GAB\10005.TTF

Filesize
64KB

MD5
b128c4efac101466c7578cbec14dc57e

SHA1
5e9d921fae706b87faf69dc17fa977d7b295a3ec

SHA256
31e50c5c2595ca6864014326b48bb12cb4948335b2b5d19a45c1d0528c2dde2a

SHA512
749ef377075678726c439e25fc097bcc391758ace0e04c9aefc224a6f7628efd42b2128ccf2f9e46a1e2de32ec883affc4b53ad37931c266efae5f63070e30b1

Download Submit
C:\GAB\10005.TTF

Filesize
563KB

MD5
bc48726aae612fa201e18db8f38957eb

SHA1
c65c4884cdbaadc799edfc22a9e13ac23ad5e8ee

SHA256
8fdb188252a2db0f020c89831bddb61cadfe290c3616fe534479b4d3b10d09c1

SHA512
9e6ef76c7ec50491f0d037eda63185d056b8ab0089301eca8efef32275ade754781c2915b1c16085ee8f51ea7c080bfc64210aea7e4a7d7e306a240018ab2e5e

Download Submit
C:\GAB\10005.fon

Filesize
35KB

MD5
8a5853ebfc046f428dd31c5f3ae217ef

SHA1
61dccd934eeaf49b9dfe4385e5ba12ea8eaaa35c

SHA256
0da0d4ed89fd1e8810c7f2cdb5372abfb02cb3d031acacc1a5bbc853f879c2bd

SHA512
b2427ec94402e06af2239277087376ebb5a4a231a2d9fd020e7eae557b865355f257d0fb3c2f2f306c132f919160b5b7d50e0f078f9e382a3ed9ceee3e285c32

Download Submit
C:\GAB\10005.fon

Filesize
5KB

MD5
21475b17405b86f37a2c15a1df2733b3

SHA1
e640903a5fa2a800a27b74c73a02ea855dcbd953

SHA256
6e7a86167874f989433a264345e5ea6c0e000861cbca8153858b23d7d35d5ecc

SHA512
5752f5cdd3d6e56de8d6382dced5b7425fead8cbdb21755fb504320157a4aad3a713fb8d5d4d52e843d60b0251b3c14ee6e7720824ace97b9fd8a5dbf7e0d8f0

Download Submit
C:\GAB\10005.fon

Filesize
37KB

MD5
fdb4c5d869ccb8b4230a3f0e162dcb22

SHA1
3085fa5c2c6c42ded66f8ca77f3e366a0c1bb867

SHA256
8f51432ddde758e386ac1c3f5c2a02278b1a0134ea30ffa879794087ff1d4d3f

SHA512
babff722c300f752ec71c055ed89564c74c0188059033e13a9d529bdb4f23b5b399a97b5bf5f670d5ccf6b8dccddf91e0df3f5551436e5c9db4ac8288b0d9615

Download Submit
C:\GAB\10005.fon

Filesize
12KB

MD5
dcfe71d27bf49ba16fde0d1945bfb4a2

SHA1
86b3d8696b5da354ef42c8ab4a9d21cdaaf0dda1

SHA256
eacbfca9a5ef05a108ef5337c773d82a43398bb8ea177e5ebeef62934dd75811

SHA512
4da8efcfd4a77e230c61a527eb96b5193b9f5ddc0d476dfca8ce6ba7143ac5c8a1fd8b673cc2c7b554dae42ec01364a178f64532b6de17d44dce07b3089869c3

Download Submit
C:\GAB\10005.fon

Filesize
82KB

MD5
5972eeea7971170eb72cab2fc85c2b17

SHA1
d327d96bd78c5e851e065d053829abbb370c0c09

SHA256
9677467feb714a89de457e262ff6647708b7de66127671b77f7e1e92aa0c2f41

SHA512
c55c5217271f29bd3a7a130daa5e5711eff65630127f90112a26bb4ba3dbf416059f9424606bc1998ff4eec874c18767a395e20c3dc516a00079b2c5a7221ed3

Download Submit
C:\GAB\10005.fon

Filesize
63KB

MD5
1126be0ed8a10d76bf871b1ad5f70cfb

SHA1
248932d10a42b5c28c91a19deaf8fbbcd9e69665

SHA256
cba1d43181b319d7556fa4c096cf5d9a938e9efa212ee77b56db980c7c50b5d4

SHA512
5e5afcaa804dd223ba40431f8136016044558a53e91bea6b61aa53b220cb261d0f529ca209a8f41bce8a8a392b673292031d0f70b03e45eaeaaa914fb67071ce

Download Submit
C:\GAB\10005.fon

Filesize
64KB

MD5
3ab899f487699715495d0a1aa35034bd

SHA1
480398c06355807833abe2cfdbfd8cfba043770f

SHA256
2230978ea01f8c2687c1a0e320380d116cd5677303c0d9ff2c209bff97fb8355

SHA512
ef2a23d6e21d66cbcacb05def254bff864d33cff7b5dc0a5b0e5fae5074642ffc9d5a21874bde29957ca95f99ad5b0cdc2542e4f5ce7319bf83f66125bb13536

Download Submit
C:\GAB\10005.fon

Filesize
12KB

MD5
40f8022c3fe4e1cc97bb794e1b519b3f

SHA1
7ff107451b67b2d432db4706c697a9391c13a6f4

SHA256
6b16818c057024f588f4f423cb1f50d24e092fca3c9b5c8c1943cf5b3ea70759

SHA512
08a85d0203a0534067538ba0c1f40273409f61f212269cb3095df1defc114ff007efcb4c3c4897a345cda17db16c98b88ae61100b9e4636862d26edb8a402ba3

Download Submit
C:\GAB\10005.fon

Filesize
6KB

MD5
51dbaecc504d2848478dcff689b02227

SHA1
08af58505ff35b905e6cabfb2140032caa1fb5eb

SHA256
97e9a254714bc38941ba0e20b736a91f22a3a203a354a06691d9bca2183ad112

SHA512
ad759f80326efc5a8c59447d2c00f4e7947ba5825a736acce512266f21a5f7eb8b4cda2b67e55101c40aa76c3e0b0a8d05436542fe92a01c74d43647e575df2a

Download Submit
C:\GAB\10005.fon

Filesize
6KB

MD5
89b3b99975cf9f7592ad2d77be92ecd1

SHA1
ee700e439d50e0739b6f462946f4b39a6266c4bd

SHA256
868bb859fa5a5ddb4027b1c8e7b6071fbccb62ad9608ee7b56583ba3b705d823

SHA512
f10c49a944edc073be7772d6cc3087850528e93d48d791cfa8525881d0834f3534c5419ea4cad781d9780e329a86cca7b37cbb62afebb0179a3aa60a68dc91fe

Download Submit
C:\GAB\10005.fon

Filesize
6KB

MD5
8a5dbabcb9b11e3e0c527b93e69d5e4d

SHA1
c47add614ece5ed16ca456bac08b1f2cbaccfec9

SHA256
824ea3f5eabd9c3b8e0041e78935feb65545f58760ce0c47a0d938ad75f8e241

SHA512
ddcb3520d68321e6372630cb34473c7b310ffed1263cde8e1059837e63e42e7a7e644537044dee774e9ea3e912e485f2630bc106233e039ea925355ec29921c0

Download Submit
C:\GAB\10005.fon

Filesize
5KB

MD5
5b0fc639b0421b2078daa00504037183

SHA1
09421acd18703e1e9edbe9db71a459edf07044d4

SHA256
dd31bbc61473a6b24138a97ae14c93a7d09defa6c01ae602a1bb74696804cadc

SHA512
f45696421e667ce2f006c24e2774f4da8209fb13426a72463e261bf5b48ae58915a139b900fcc2b84ef1e1d5aa62b55dedcf2889a6599a680b7c582613f1e568

Download Submit
C:\GAB\10005.fon

Filesize
31KB

MD5
58a076cd5d614f0d12ea3ab08d7aa96b

SHA1
37a4df38a30b5b129da5ef119f02cc37818676bb

SHA256
7ca5905d6b4af020874c626b7c5e5d7a6a146769bb41447eb0b28ccb7dbea5ae

SHA512
af5f4f8c28da15d8e83bf08856d23c4d002e34494cad2c3cea8055c2e6e411f725e309a549d5c9b205e66abaa2f9d09cf5a6225af3db35f3c37df3382a016068

Download Submit
C:\GAB\10005.fon

Filesize
35KB

MD5
366ae7e721daf7196fdc2995b55b7b73

SHA1
6fb95010a8d79fe89034004c4733e670669c9118

SHA256
95f6427410dc4ff03fe0f34c55031767b856cd174024f3dc4c6c700c25fec3a9

SHA512
65a56557f8533750eae0c68b15fe0322b94dd89b8e3a99b01b7e55b05ed51541571614d5bae994a2cb99c400a7bad514256493bb4720310768a8a11b11009380

Download Submit
C:\GAB\10005.ttc

Filesize
2.2MB

MD5
9302daded9c2ff67700e4556a8f53602

SHA1
d5fe2829ebe53092d99f64fde07470ddb5fdaa20

SHA256
c0d11802a139b7e27aedabf0dc43823c28fc3ed0bb8328898299aaca67d1cb84

SHA512
0a38d664893098fb2434703e04b43a64f1d1dceaca1065cad23964d8d8e34cd4eb520f640401a1e88046fe74431d8c093cf847c08507475ce57655a2fac58628

Download Submit
C:\GAB\10005.ttc

Filesize
13.0MB

MD5
e868c731ec770c425dbc74881b3ca936

SHA1
a8dc99a2e0bc3360f8441243aab13fe7279a759a

SHA256
1e5a4b342c6417bb9352e8c29cb839413987a06438e7b48fd0320925827f289c

SHA512
51bbdbcd06bc41c1ef6a589ca2b6300f1f9350d11b8bfa60605c7a68a0d6a714998bec6060cbc3b27dd2d1485d57f344890b0278d7313dbdb5593334ceea3b49

Download Submit
C:\SalaNses\soles.exe

Filesize
1.2MB

MD5
acebc69ae67997867002990dae3f699d

SHA1
8483b45b2faaa21ad548e72fb49ae3a08143334e

SHA256
f545fbcf52e694eaed07f7869ee67d1dffea29a3769e2482f5eccb3c21148442

SHA512
6c9f88407ffbf228f44270c28d0eeba804a8f3198454becebdd5f2d13eda5c1f0407f1e98569bbcd490225a10ba6e1917c1af1971bd1f636a71250b602dcbf28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
c43e4fd0cc13305f39100b9b91482486

SHA1
980b017f0921c42cbbf69ce932252f9f1a5a6581

SHA256
8ea5a42e82c7e954d44cdfa1b8d773ea2d455976ffb1d19bac0c8139967288e7

SHA512
2ecb8645b8993c8cab8dd7891aaf88c9fab4cbc1d6730cd3f45aecb6a6c5b94c96c50b611af5912ad1d1bd85b2aab58734c5920c012692092afcbd18b2334016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
4d95eda5ddc61423502dc980032e9cf8

SHA1
7f60ff4e22ad853d6cba7c3c1cb8c9188e8d3617

SHA256
65f8cac2edb7fd5eaadca76cd98781120f4f9116e7e080255875aa3dc9cd14f1

SHA512
318214f7d8f30a3787529a1ffadfbfd4b1150c264651d168007933283728aaf4445e51dc22ca170abebfd24f9ebb36bd34156e5a7b8ffb1c7b0e2e69f017f2ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
e435371e4c17bcd14ff35e29e9576a8b

SHA1
8dc0654065ffe579405eb22d5ecc215e0b384cd7

SHA256
f0bdfc6cdb6ec9e261fbb161253f58f3908d761e341ad7ee1912d7944e4b5201

SHA512
180cafd50568588300ac5a421f6ffbb05114dbaf4c4e79637e70882e4dff8ed020d0cd556fe90f201598257f9d7d9b6313a5339e3bfa94380d7ed7552bf17e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
9dadee392b444328dc24dd3f490e4a76

SHA1
379b6b9d233d0f22e868a4986bf03323b3140842

SHA256
d93b26b4cf86c2adec5fbe116e2b2689b6da6b908069ea6b7260fdf94b0b1957

SHA512
8e07b30a1fefe4edc91ed99a224762c2e4fc68a19752df63c7382b0b6fc8f1894a1bb706230aa5e5884ccc57ab4079f3b9afe698fa00eb19ae2465f9826e96cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e1b94026b0cfa24b537b954c550240c0

SHA1
11cf5c201d1bf263873ff0f2a23f1a998219fc2d

SHA256
e5f5f0c18efcac865f6ddd455302218eaf66cb53baa8dff5ca5a21fb35ec059f

SHA512
b3ec6ec68dc5b4776471496a0ceb501af66415e39a3f0a981278d62409c94ef598501f972e89111a5c340e9efe778bbad0db7be14bca5b9345b4f7969e326b16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32dbbed36f30c77be7836ea9314cbdcc

SHA1
2a14e618e3a97db31945dbdef201359c61c1e7dc

SHA256
73bed571ad82833dbb949773372c3d4c6b7115bdcdf1771281cd7399e03d2674

SHA512
c4098dc98b483780f8028855f003d927caf00773b9bb4508e01eabb7a2c1c49825b16b8c6aac23692ec735a0766b7893f87ccd6210e0151209504ace46cc2984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2eb506870691d1e2d38904904ce4003

SHA1
1febcd9fcc3cee961d71fe1a9e641327f16145f1

SHA256
112c8697dd7e7292682a82a1d00e0c3cc74e1a19fe5476a31913c4d95d4859fe

SHA512
f45431a774d9d58df9badcafd9000477899fa74a621100a69a5a5083f8162f1e763eb44d68d46697cbf096ed92f9cdc1fa8bfc8732ead7a276010bcd9878046f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
912ca5cf168f0780138cfcab1af67654

SHA1
b71479819d9a6336c9a66157cfbb5b15395826e9

SHA256
93b99ab1f270b9c111f0af4e25ddbdbbcce5a9739800f0707f01233438010b6a

SHA512
6697a680a64d878e5386b536e6735cf24f4bae0ca03a953c30ce56b97773d42d1ff62a464a65be569bec775765675fc8934b2106797bf3b7d4fac9e7cc3bab43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4afb5320b1171b268a67ad09d5d0f096

SHA1
0828f950ae6fdc1d493d81b73f97ff33cd32a24a

SHA256
d9d06ab19f81a5b6f6bd98ce068bc270430152c1a5091d009dea9c2e2b59cdd0

SHA512
70a03e48774a36e21596768ae350225ef7562ec48aaff9dffa2ef95a96e9c5fdcfc14bed8ce7db2590c93853d81ac114f3aa620eebc972a34e9abf24ef94a67e

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409160823531\additional_file0.tmp

Filesize
1.4MB

MD5
e9a2209b61f4be34f25069a6e54affea

SHA1
6368b0a81608c701b06b97aeff194ce88fd0e3c0

SHA256
e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

SHA512
59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\!m.bat

Filesize
888B

MD5
64642da120c419155726108ec85d5967

SHA1
9576dd63e8fdbda9441f384ebbd8356c7e9b660c

SHA256
0bba9556b2b2688c2f441bc36f3ecb0ebf70d04c5c322b71072e998b4f750135

SHA512
cb99da0633c74a63be8a767cc70c6f488e5b3f987f8b64c46e5f4ec1777d3916e4f62b2db5e2d1b79d564f5a9df79fd3af81baf31fb06def7bf027a2e28ad519

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\anti.exe

Filesize
1.9MB

MD5
cb02c0438f3f4ddabce36f8a26b0b961

SHA1
48c4fcb17e93b74030415996c0ec5c57b830ea53

SHA256
64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

SHA512
373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\avg.exe

Filesize
5.8MB

MD5
0dc93e1f58cbb736598ce7fa7ecefa33

SHA1
6e539aab5faf7d4ce044c2905a9c27d4393bae30

SHA256
4ec941f22985fee21d2f9d2ae590d5dafebed9a4cf55272b688afe472d454d36

SHA512
73617da787e51609ee779a12fb75fb9eac6ed6e99fd1f4c5c02ff18109747de91a791b1a389434edfe8b96e5b40340f986b8f7b88eac3a330b683dec565a7eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\bundle.exe

Filesize
429KB

MD5
ae4581af98a5b38bce860f76223cb7c9

SHA1
6aa1e2cce517e5914a47816ef8ca79620e50e432

SHA256
7c4b329a4018dc7e927a7d1078c846706efae6e6577f6809defaa51b636e7267

SHA512
11ad90a030999bbb727dbfde7943d27f2442c247633cde5f9696e89796b0f750f85a9be96f01fa3fd1ec97653a334b1376d6bb76d9e43424cabe3a03893ecf04

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\butdes.exe

Filesize
2.8MB

MD5
1535aa21451192109b86be9bcc7c4345

SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c

SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\code.js

Filesize
4KB

MD5
016bf2cf2bad527f1f1ea557408cb036

SHA1
23ab649b9fb99da8db407304ce9ca04f2b50c7b4

SHA256
17bb814cfaa135628fd77aa8a017e4b0dcd3c266b8cdca99e4d7de5d215643c0

SHA512
ac2d4f51b0b1da3c544f08b7d0618b50514509841f81bc9dad03329d5c1a90e205795a51ca59522d3aa660fb60faae19803eceeeea57f141217a6701a70510e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\doc.html

Filesize
15KB

MD5
5622e7755e5f6585a965396b0d528475

SHA1
b059dc59658822334e39323b37082374e8eeaac4

SHA256
080cb8ef0cbf5a5de9163b365eec8b29538e579f14a9caa45c0f11bc173c4147

SHA512
62f5abda3473ca043bf126eed9d0bcc0f775b5ac5f85b4fe52d1d656f476f62188d22cf79b229059a5d05e9258980c787cb755f08ca86e24e5f48655b5447f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\download.jpg

Filesize
8KB

MD5
01a5131931ef35acecbe557ba13f3954

SHA1
c7afc7590d469432704d963ffcee31ad8bcfc175

SHA256
d364872ddde28d81d23bb3b08f9e86f921b542f3a35fcaf12549cf5666462bd0

SHA512
ce32352484d676bd0f47c24808707c603fe9f09e41afd63d90f07599f13a5e32c73b0970a9964632f76f5843dda87a033340ee12fadd87b9f219329d0c69b02e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\fence.bat

Filesize
167B

MD5
6465a5431e01a80bf71aca9e9698e5b0

SHA1
d56ed108f13a6c49d57f05e2bf698778fd0b98dc

SHA256
1c5f05fecfc1f4fd508f1d3bbb93a47e8b8196b9eded5de7152a6fa57ca7580f

SHA512
db7f64b8af595d0bf6fd142471868df6d29ec7cfbb49a7e0da63d9bc8ca8f319e4c41f2c7baeafe17a3679861163400ccb36c18617982b244aaf482e9c264e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\flydes.exe

Filesize
833KB

MD5
b401505e8008994bf2a14fdf0deac874

SHA1
e4f7f375b1e88dd71a0274a997ed5d9491bde068

SHA256
6bcf6b84d71737787e3cc8d9d0eed9720f388cc2d0337832a7e8ca3c6f455a41

SHA512
1bca98547ecf5a98d42b1d77cff50ca79ee560c893b2470aeb86887fef6e40a5ccdb72956f04a1d2a862827eebd3b7746e3043f3e6209597dcde9385ed55cc11

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\fries.jpg

Filesize
12KB

MD5
c4d9d3cd21ef4de91abc95f99c4bc7dc

SHA1
b2cf457237c44c824068727b8440fe6a352a360c

SHA256
6fd1c3bde9a6a478e39d1cf2121e980c0bcf59454fe1673d707aa70170953bc9

SHA512
d10fbb0bdfb30160484950aa58bd2f97c38cf2d0914550b4041c9acd273e8013920ef1ee74216f92437a44ab81111a4c70ed3dc2df680ee4d187c22557900ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\gx.exe

Filesize
3.1MB

MD5
80bf3bf3b76c80235d24f7c698239089

SHA1
7f6071b502df985580e7c469c6d092472e355765

SHA256
2b95e56af10406fbd3ecee38dab9e9c4a9b990d087f2ad2d7b1981c087829da2

SHA512
076b8b6a80ea15738ce682cc715792546582d7a74f971f94f6b5b9cf8164f01280322baec7f72894ac4b8d63b9f2f6074e8fc5e47880ef6c0b57a47beef3581a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\i.exe

Filesize
12KB

MD5
cea5426da515d43c88132a133f83ce68

SHA1
0c224d0bb777f1e3b186fdf58cc82860d96805cc

SHA256
2be7a0865ded1c0bd1f92d5e09bb7b37a9e36a40487a687e0359c93878611a78

SHA512
4c1f25147222c84dff513bebf00e828719454ad634ef9380cfc7835f0457a718b4b437ecb60c1fa72a7f83fbb67e1ddfcd225194eedda77034c72f8c752c642c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\images.jpg

Filesize
13KB

MD5
49f4fe0c8646909c7cf87adf68d896fd

SHA1
9193264c38e5ed9fa0f5be1d79f802cf946a74cf

SHA256
9292dfcddc9e88e5dbc095ceeb83ce23400a3405a4d47fffc80656941c87d5ec

SHA512
9df4db8c958110cea66f627170919346ed673d3c13aa55292484fc74ebac2864b0292cd4d66d35957b4b2740b2fe30ddfb9d9e04115d655fb58bf39e100d285e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\nuggets.webp

Filesize
32KB

MD5
e40209599b592630dcac551daeb6b849

SHA1
851150b573f94f07e459c320d72505e52c3e74f0

SHA256
3c9aefa00fb2073763e807a7eccac687dcc26598f68564e9f9cf9ffdcd90a2be

SHA512
6da5895f2833a18ddb58ba4a9e78dd0b3047475cae248e974dc45d839f02c62772a6ba6dfe51dd9a37f29b7ec9780e799f60f0e476655006dec693164e17eec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\rckdck.exe

Filesize
6.2MB

MD5
a79fb1a90fb3d92cf815f2c08d3ade6d

SHA1
25e5e553af5e2d21b5cfc70ba41afb65202f6fd5

SHA256
43759b0c441fd4f71fe5eeb69f548cd2eb40ac0abfa02ea3afc44fbddf28dc16

SHA512
82aa45337987c4f344361037c6ca8cf4fbf0fc1e5079ac03f54f3184354792965f6f3b28bd2ab7b511d21f29859e2832fc6b6122a49ddecde12afc7e26fd62dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\stopwatch.exe

Filesize
68KB

MD5
338a4b68d3292aa22049a22e9292e2a2

SHA1
9595e6f6d5e18a3e71d623ac4012e7633b020b29

SHA256
490d833205f9dfe4f1950d40c845489aa2d2039a77ab10473384986f8442ea6f

SHA512
06bc6463b65508d050c945d5bf08078eecd6982c74c7bab2a6722b99523189d24f530c10c05577e0dbd5b46e896d472112d036023ef5e576e2a8f9401b8668a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-09-16_09dc1da297f4981397cc9a9854cc0339_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_a2e4d4a9-dcbe-414f-a920-3a8f51de1bce\telamon.exe

Filesize
2.3MB

MD5
6a80889e81911157ca27df5bc5ac2e09

SHA1
02ac28dd7124317e294fac847a05b69411c9cdb2

SHA256
0b74c13914f712fce5bb41c25a443c4214a97792bdbb6fea05b98350901405ff

SHA512
329ec105834f4531386090074994e5c4ddbdaf4cc4801956b675e258e9167f9e70cf31b8d636d119b59b57af0912decdc259d12999842008cec807a967c89aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCED79A97\setup.exe

Filesize
6.4MB

MD5
defd30ea336650cc29c0c79fad6fa6b5

SHA1
935d871ed86456c6dd3c83136dc2d1bda5988ff3

SHA256
015a13bd912728e463df6807019b1914dffc3e6735830472e3287150a02e13f4

SHA512
8c6ebbf398fb44ff2254db5a7a2ffbc8803120fa93fa6b72c356c6e8eca45935ab973fe3c90d52d5a7691365caf5b41fe2702b6c76a61a0726faccc392c40e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2409160823524893956.dll

Filesize
5.9MB

MD5
640ed3115c855d32ee1731c54702eab7

SHA1
1ac749b52794cbadfec8d9219530e9a79fc9427c

SHA256
29b4cabc7a0e9dffbc2395b976749be0aad88357dd3b1d7e0cfc9b0c645421a3

SHA512
bebe55fdbb363b78c4a6371304f65b89e03a03cee5a8ebceee1681261d8df64a0de36888ed763c3a607ae2732ab54e2e41edb624f37a7fdf8755c40e6bb96f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jpsagq42.n1u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ajC036.exe

Filesize
5.8MB

MD5
c79bb78a0bad2559a7037913dd1f1f34

SHA1
a5b36348ad93fdf971201f31136d8c9b056984a7

SHA256
f63b47288af395ac9c02c980592691e2d446fe8b4d3813007433ae262af693c3

SHA512
1bd81cbe784427e54903159225e0fd94c0fab1d9498c11db177d86268f34129e6835759a9a3e3822c717349043930e13168390fcc2f9a74f9699f14497cfc888

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\tt-installer-helper.exe

Filesize
404KB

MD5
5b4c8e63be988b83b09e13e9d1d74bb9

SHA1
bcb242f54ee83f232df6b871aebc0f3d44e434c6

SHA256
8ae877bd5f45975d827280bee2e19021c3401b5ba069df0e556f6911798adb4d

SHA512
a31f9e24a4a27847516808b24f312d4df6b865eb421f84d8d4fc022bdb309e08e5648c52c13772a48456c578f3771d232539c7d30132a82a08e8ebbabcbffa0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AMDPU.tmp\~execwithresult.txt

Filesize
77B

MD5
e38b955b08d2224243c73908da947394

SHA1
b910c1cca821ef1dad4ae74eec4fd4aa6afd7c11

SHA256
9cd826592b9dd269d9cae37183d6bbfbc39826dc27463d53dbe05e936c1d0ec6

SHA512
7e4d1b85edd6b86f170453603c224cd80f6cc3cd8208953aa7aadfa870154314cdfef0b770e84ead313ff17d9c53dc1043ed5a66837ff0dd03223af861b9e085

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DPV13.tmp\is-GGSBU.tmp

Filesize
659KB

MD5
5aa68bb2bf3b994bda93834ad34e7963

SHA1
0156732d5dd48feacfab3aa07764061d73b9116c

SHA256
a90bfd9874c3e60650dba4c286b97ccdb375a456b95556feb38f3cba214770aa

SHA512
e52fecbba96aa911552ef0e11d5d044ec44caf6e0947f64c9a17b04d846a3e86d19e4dfa5ac981fc98d44f941fda3a697c1d23ac6e8ef162f4bcdde9142f22f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ICCHK.tmp\butdes.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NL0ST.tmp\telamon.tmp

Filesize
3.1MB

MD5
292d91bef15a5a5d5f5c06425a96e0ee

SHA1
5f4400c94ceebf54825e94cb5d9f616850331e96

SHA256
b6f6cbd03951a6feee4d4766443ce0b7623db000cbfe774146ee43f5a5831373

SHA512
0aca0538ce4c94ef9a8008846add36f51db001905f6cdb373a0348094f11762269aaf92928c6761eb41b1b22cd045ece325b9cd71c67944a1e6c092a72fca200

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfAD97.tmp\JsisPlugins.dll

Filesize
2.1MB

MD5
d21ae3f86fc69c1580175b7177484fa7

SHA1
2ed2c1f5c92ff6daa5ea785a44a6085a105ae822

SHA256
a6241f168cacb431bfcd4345dd77f87b378dd861b5d440ae8d3ffd17b9ceb450

SHA512
eda08b6ebdb3f0a3b6b43ef755fc275396a8459b8fc8a41eff55473562c394d015e5fe573b3b134eeed72edff2b0f21a3b9ee69a4541fd9738e880b71730303f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfAD97.tmp\StdUtils.dll

Filesize
195KB

MD5
34939c7b38bffedbf9b9ed444d689bc9

SHA1
81d844048f7b11cafd7561b7242af56e92825697

SHA256
b127f3e04429d9f841a03bfd9344a0450594004c770d397fb32a76f6b0eabed0

SHA512
bc1b347986a5d2107ad03b65e4b9438530033975fb8cc0a63d8ef7d88c1a96f70191c727c902eb7c3e64aa5de9ce6bb04f829ceb627eda278f44ca3dd343a953

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfAD97.tmp\jsis.dll

Filesize
127KB

MD5
2027121c3cdeb1a1f8a5f539d1fe2e28

SHA1
bcf79f49f8fc4c6049f33748ded21ec3471002c2

SHA256
1dae8b6de29f2cfc0745d9f2a245b9ecb77f2b272a5b43de1ba5971c43bf73a1

SHA512
5b0d9966ecc08bcc2c127b2bd916617b8de2dcbdc28aff7b4b8449a244983bfbe33c56f5c4a53b7cf21faf1dbab4bb845a5894492e7e10f3f517071f7a59727c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfAD97.tmp\nsJSON.dll

Filesize
36KB

MD5
f840a9ddd319ee8c3da5190257abde5b

SHA1
3e868939239a5c6ef9acae10e1af721e4f99f24b

SHA256
ddb6c9f8de72ddd589f009e732040250b2124bca6195aa147aa7aac43fc2c73a

SHA512
8e12391027af928e4f7dad1ec4ab83e8359b19a7eb0be0372d051dfd2dd643dc0dfa086bd345760a496e5630c17f53db22f6008ae665033b766cbfcdd930881a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfAD97.tmp\thirdparty.dll

Filesize
93KB

MD5
7b4bd3b8ad6e913952f8ed1ceef40cd4

SHA1
b15c0b90247a5066bd06d094fa41a73f0f931cb8

SHA256
a49d3e455d7aeca2032c30fc099bfad1b1424a2f55ec7bb0f6acbbf636214754

SHA512
d7168f9504dd6bbac7ee566c3591bfd7ad4e55bcac463cecb70540197dfe0cd969af96d113c6709d6c8ce6e91f2f5f6542a95c1a149caa78ba4bcb971e0c12a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC1DB.tmp\CR.History.tmp

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC1DB.tmp\CR.History.tmp

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC1DB.tmp\FF.places.tmp

Filesize
5.0MB

MD5
199d82d11c3c57b35976685dd2c6135f

SHA1
b95c80c6766745ca4049acd19d25e9e60d55871c

SHA256
d1e83b9f571cdd8087d0ba5e2de31ad98ebf2c1156eea86de6ef8dea5fc2adcb

SHA512
972db73c22a683a2a68043f53a388978b72f20b2c1411bc69b662b1e66c31dbcb60f142748c6960242da7c58dcabac46b056f6c612612d062b54e38dbf44c14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC1DB.tmp\Midex.dll

Filesize
126KB

MD5
2597a829e06eb9616af49fcd8052b8bd

SHA1
871801aba3a75f95b10701f31303de705cb0bc5a

SHA256
7359ca1befdb83d480fc1149ac0e8e90354b5224db7420b14b2d96d87cd20a87

SHA512
8e5552b2f6e1c531aaa9fd507aa53c6e3d2f1dd63fe19e6350c5b6fbb009c99d353bb064a9eba4c31af6a020b31c0cd519326d32db4c8b651b83952e265ffb35

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B015BDE3-BE95-442C-AE02-0ED346C0E0A8}\scrt.dll

Filesize
5.7MB

MD5
f36f05628b515262db197b15c7065b40

SHA1
74a8005379f26dd0de952acab4e3fc5459cde243

SHA256
67abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31

SHA512
280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8

Download Submit
C:\Users\Admin\AppData\Roaming\TESAYt.exe

Filesize
934KB

MD5
f7f32729079353000cd97b90aa314cc1

SHA1
21dbddeea2b634263c8fbf0d6178a9751d2467b8

SHA256
8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212

SHA512
2c40c12b81e7c377ddf0a6691ebeedc895dcf02c9211a1563b840de735fab77968565b1d3d0c40cc0b2b583fd4bfa1c69f995fca758ea85f548bf5797b5bf847

Download Submit
C:\Windows\System\TOzKZir.exe

Filesize
5.2MB

MD5
34b6d47899e908dc7bc392b0b9f8e0ff

SHA1
f00311bd710c55517d316fd9c13df3963d0999dd

SHA256
da7957c6feaa6ee01a1bb2feff1ed1431dabcbb540d5960d946a4f39905b5622

SHA512
ecfd5768454f7ea3b1deff3efec836707967576eb301693a02561d28f50de332cb31e8489fcac4d87ca8efac2e344ec5b129da9b8644db9bbe1a72d56c72ca9d

Download Submit
memory/440-2204-0x00007FF7BE630000-0x00007FF7BE981000-memory.dmp

Filesize
3.3MB

Download
memory/440-2363-0x00007FF7BE630000-0x00007FF7BE981000-memory.dmp

Filesize
3.3MB

Download
memory/680-380-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1288-386-0x0000000000400000-0x0000000000729000-memory.dmp

Filesize
3.2MB

Download
memory/1852-55-0x0000000005430000-0x00000000054C2000-memory.dmp

Filesize
584KB

Download
memory/1852-52-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/1852-265-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/1852-53-0x0000000000880000-0x0000000000A72000-memory.dmp

Filesize
1.9MB

Download
memory/1852-54-0x00000000052F0000-0x000000000538C000-memory.dmp

Filesize
624KB

Download
memory/1852-56-0x00000000053C0000-0x00000000053CA000-memory.dmp

Filesize
40KB

Download
memory/1852-58-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/1852-57-0x0000000005630000-0x0000000005686000-memory.dmp

Filesize
344KB

Download
memory/2436-2321-0x0000000007380000-0x0000000007423000-memory.dmp

Filesize
652KB

Download
memory/2436-2329-0x0000000007870000-0x0000000007884000-memory.dmp

Filesize
80KB

Download
memory/2436-2282-0x0000000006320000-0x000000000636C000-memory.dmp

Filesize
304KB

Download
memory/2436-2268-0x0000000005E30000-0x0000000006184000-memory.dmp

Filesize
3.3MB

Download
memory/2436-2305-0x000000006B260000-0x000000006B2AC000-memory.dmp

Filesize
304KB

Download
memory/2456-2327-0x0000000007440000-0x0000000007451000-memory.dmp

Filesize
68KB

Download
memory/2456-2306-0x000000006B260000-0x000000006B2AC000-memory.dmp

Filesize
304KB

Download
memory/3100-2255-0x00007FF777A70000-0x00007FF777DC1000-memory.dmp

Filesize
3.3MB

Download
memory/3100-2189-0x00007FF777A70000-0x00007FF777DC1000-memory.dmp

Filesize
3.3MB

Download
memory/3168-287-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3168-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3288-2217-0x00007FF763F50000-0x00007FF7642A1000-memory.dmp

Filesize
3.3MB

Download
memory/3576-383-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3576-175-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4016-2216-0x00007FF7A4580000-0x00007FF7A48D1000-memory.dmp

Filesize
3.3MB

Download
memory/4192-2218-0x00007FF78DC50000-0x00007FF78DFA1000-memory.dmp

Filesize
3.3MB

Download
memory/4236-289-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4492-290-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4520-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4520-288-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4860-1-0x0000000000AF0000-0x0000000000B3A000-memory.dmp

Filesize
296KB

Download
memory/4860-256-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

Filesize
4KB

Download
memory/4860-261-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/4860-3-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/4860-2-0x0000000005420000-0x0000000005444000-memory.dmp

Filesize
144KB

Download
memory/4860-4-0x0000000005B50000-0x00000000060F4000-memory.dmp

Filesize
5.6MB

Download
memory/4860-2136-0x0000000074F80000-0x0000000075730000-memory.dmp

Filesize
7.7MB

Download
memory/4860-0-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

Filesize
4KB

Download
memory/5112-375-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5112-158-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5280-2225-0x00007FF78A6F0000-0x00007FF78AA41000-memory.dmp

Filesize
3.3MB

Download
memory/5636-590-0x00007FF7CE330000-0x00007FF7CE357000-memory.dmp

Filesize
156KB

Download
memory/5636-376-0x00007FF7CE330000-0x00007FF7CE357000-memory.dmp

Filesize
156KB

Download
memory/5676-371-0x00007FF7162E0000-0x00007FF716309000-memory.dmp

Filesize
164KB

Download
memory/5676-567-0x00007FF7162E0000-0x00007FF716309000-memory.dmp

Filesize
164KB

Download
memory/5720-381-0x00007FF6E90D0000-0x00007FF6E90F6000-memory.dmp

Filesize
152KB

Download
memory/5868-384-0x00007FF7D03C0000-0x00007FF7D03E6000-memory.dmp

Filesize
152KB

Download
memory/5984-387-0x0000000000050000-0x000000000006C000-memory.dmp

Filesize
112KB

Download
memory/5984-393-0x0000000008F70000-0x0000000008F7E000-memory.dmp

Filesize
56KB

Download
memory/5984-392-0x0000000008F90000-0x0000000008FC8000-memory.dmp

Filesize
224KB

Download
memory/5984-391-0x00000000096E0000-0x00000000096E8000-memory.dmp

Filesize
32KB

Download
memory/6052-2365-0x00007FF7A4CC0000-0x00007FF7A5011000-memory.dmp

Filesize
3.3MB

Download
memory/6052-2223-0x00007FF7A4CC0000-0x00007FF7A5011000-memory.dmp

Filesize
3.3MB

Download
memory/6080-2188-0x00007FF7DEEB0000-0x00007FF7DF201000-memory.dmp

Filesize
3.3MB

Download
memory/6112-619-0x00000000078B0000-0x00000000078E2000-memory.dmp

Filesize
200KB

Download
memory/6112-776-0x0000000007F80000-0x0000000007F88000-memory.dmp

Filesize
32KB

Download
memory/6112-389-0x0000000003330000-0x0000000003366000-memory.dmp

Filesize
216KB

Download
memory/6112-390-0x0000000005AA0000-0x00000000060C8000-memory.dmp

Filesize
6.2MB

Download
memory/6112-410-0x00000000063B0000-0x0000000006416000-memory.dmp

Filesize
408KB

Download
memory/6112-411-0x00000000064C0000-0x0000000006814000-memory.dmp

Filesize
3.3MB

Download
memory/6112-409-0x0000000006340000-0x00000000063A6000-memory.dmp

Filesize
408KB

Download
memory/6112-408-0x0000000005A60000-0x0000000005A82000-memory.dmp

Filesize
136KB

Download
memory/6112-430-0x00000000068F0000-0x000000000690E000-memory.dmp

Filesize
120KB

Download
memory/6112-431-0x0000000006C00000-0x0000000006C4C000-memory.dmp

Filesize
304KB

Download
memory/6112-620-0x0000000066D90000-0x0000000066DDC000-memory.dmp

Filesize
304KB

Download
memory/6112-692-0x0000000007E60000-0x0000000007E71000-memory.dmp

Filesize
68KB

Download
memory/6112-771-0x0000000007FA0000-0x0000000007FBA000-memory.dmp

Filesize
104KB

Download
memory/6112-633-0x00000000078F0000-0x000000000790E000-memory.dmp

Filesize
120KB

Download
memory/6112-634-0x0000000007910000-0x00000000079B3000-memory.dmp

Filesize
652KB

Download
memory/6112-758-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

Filesize
80KB

Download
memory/6112-647-0x00000000082A0000-0x000000000891A000-memory.dmp

Filesize
6.5MB

Download
memory/6112-749-0x0000000007E90000-0x0000000007E9E000-memory.dmp

Filesize
56KB

Download
memory/6112-648-0x0000000007C60000-0x0000000007C7A000-memory.dmp

Filesize
104KB

Download
memory/6112-665-0x0000000007CD0000-0x0000000007CDA000-memory.dmp

Filesize
40KB

Download
memory/6112-682-0x0000000007EE0000-0x0000000007F76000-memory.dmp

Filesize
600KB

Download
memory/6120-696-0x0000000066D90000-0x0000000066DDC000-memory.dmp

Filesize
304KB

Download
memory/6128-672-0x0000000066D90000-0x0000000066DDC000-memory.dmp

Filesize
304KB

Download
memory/6228-2181-0x00007FF7F49B0000-0x00007FF7F4D01000-memory.dmp

Filesize
3.3MB

Download
memory/6228-2248-0x00007FF7F49B0000-0x00007FF7F4D01000-memory.dmp

Filesize
3.3MB

Download
memory/6244-2125-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/6244-2126-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/6320-2214-0x00007FF7A42E0000-0x00007FF7A4631000-memory.dmp

Filesize
3.3MB

Download
memory/6336-2213-0x00007FF77A840000-0x00007FF77AB91000-memory.dmp

Filesize
3.3MB

Download
memory/6384-2215-0x00007FF679CF0000-0x00007FF67A041000-memory.dmp

Filesize
3.3MB

Download
memory/6480-2219-0x00007FF7EB700000-0x00007FF7EBA51000-memory.dmp

Filesize
3.3MB

Download
memory/6484-2221-0x00007FF60C2A0000-0x00007FF60C5F1000-memory.dmp

Filesize
3.3MB

Download
memory/6508-2220-0x00007FF67B190000-0x00007FF67B4E1000-memory.dmp

Filesize
3.3MB

Download
memory/6520-1063-0x0000000000E20000-0x00000000011DB000-memory.dmp

Filesize
3.7MB

Download
memory/6520-1508-0x0000000000E20000-0x00000000011DB000-memory.dmp

Filesize
3.7MB

Download
memory/6556-2224-0x00007FF64A2D0000-0x00007FF64A621000-memory.dmp

Filesize
3.3MB

Download
memory/6608-2222-0x00007FF6A9F10000-0x00007FF6AA261000-memory.dmp

Filesize
3.3MB

Download
memory/6628-2123-0x0000000000240000-0x000000000032A000-memory.dmp

Filesize
936KB

Download
memory/6628-2202-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/6628-2250-0x00000000061D0000-0x0000000006252000-memory.dmp

Filesize
520KB

Download
memory/6640-2124-0x00000000052A0000-0x00000000052C2000-memory.dmp

Filesize
136KB

Download
memory/6640-2121-0x0000000000A20000-0x0000000000BC2000-memory.dmp

Filesize
1.6MB

Download
memory/6640-2122-0x0000000005520000-0x0000000005602000-memory.dmp

Filesize
904KB

Download
memory/6824-2244-0x00007FF71FC70000-0x00007FF71FFC1000-memory.dmp

Filesize
3.3MB

Download
memory/6824-2137-0x000002B74D2D0000-0x000002B74D2E0000-memory.dmp

Filesize
64KB

Download
memory/6824-2117-0x00007FF71FC70000-0x00007FF71FFC1000-memory.dmp

Filesize
3.3MB

Download
memory/6928-2328-0x0000000006710000-0x0000000006760000-memory.dmp

Filesize
320KB

Download
memory/6928-2258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/7000-2226-0x00007FF66D160000-0x00007FF66D4B1000-memory.dmp

Filesize
3.3MB

Download
memory/7008-2208-0x00007FF6BC830000-0x00007FF6BCB81000-memory.dmp

Filesize
3.3MB

Download
memory/7024-2212-0x00007FF75ADD0000-0x00007FF75B121000-memory.dmp

Filesize
3.3MB

Download
memory/7092-2118-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/7092-2247-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/7148-2198-0x00007FF64F290000-0x00007FF64F5E1000-memory.dmp

Filesize
3.3MB

Download
memory/7148-2249-0x00007FF64F290000-0x00007FF64F5E1000-memory.dmp

Filesize
3.3MB

Download