Overview

overview

10

Static

static

10

2024-09-17...at.exe

windows7-x64

10

2024-09-17...at.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    20s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 04:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe

  • Size

    58.1MB

  • MD5

    a36ccf5fb6bc5c1342371a21b33a6f0c

  • SHA1

    2daefc8e9d7a3f7d461a9cc7a2a69e9c87667c83

  • SHA256

    f2c9caab1000afabc5efa9e2b1d25ddfdbebe5d9166b6bff130a501ff27df2c1

  • SHA512

    80f3c9e56cd1f9ba596c93a0742e5f56e7a44fdc678d9c3a19f0e90db9a81ed1ce09e159f61c57c566e47c428986f96bc29b7e1f71941c86961e3f43ab4dcc78

  • SSDEEP

    1572864:TLOrJXzVj0mz3uu2etPQiWmoh8rb28CQG2Y:TLqJXBj0kuu3IDmnrb5Y

Score
10/10
agentteslacobaltstrikemodiloaderraccoonxmrig2ca5558c9ec8037d24a611513d7bd076backdoorbootkitdiscoveryevasionexecutionkeyloggerminerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

raccoon

Botnet

2ca5558c9ec8037d24a611513d7bd076

C2

https://192.153.57.177:80

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V2 payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • ModiLoader Second Stage 2 IoCs
  • XMRig Miner payload 30 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks for any installed AV software in registry 1 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 2 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 64 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\!m.bat" "
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\anti.exe
        anti.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:232
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K fence.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im explorer.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:216
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4544
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2428
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4640
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1692
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4080
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2704
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3660
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3652
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1188
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:640
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4960
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2736
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1340
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2864
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3588
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:912
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:680
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2136
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3116
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4808
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4728
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3332
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4264
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1652
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3924
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2940
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2192
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2316
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3116
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3688
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1900
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5628
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:6080
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5568
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im shutdown.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:6120
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5392
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im werfault.exe
          4⤵
            PID:6732
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /im shutdown.exe
            4⤵
            • Kills process with taskkill
            PID:5384
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /im taskmgr.exe
            4⤵
            • Kills process with taskkill
            PID:6668
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /im werfault.exe
            4⤵
            • Kills process with taskkill
            PID:6428
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /im shutdown.exe
            4⤵
              PID:7052
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              PID:6276
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im werfault.exe
              4⤵
                PID:3840
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im shutdown.exe
                4⤵
                • Kills process with taskkill
                PID:4736
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im taskmgr.exe
                4⤵
                • Kills process with taskkill
                PID:5544
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im werfault.exe
                4⤵
                • Kills process with taskkill
                PID:7100
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im shutdown.exe
                4⤵
                  PID:6744
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  PID:6308
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im werfault.exe
                  4⤵
                    PID:6664
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im shutdown.exe
                    4⤵
                      PID:6624
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im taskmgr.exe
                      4⤵
                        PID:2400
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im werfault.exe
                        4⤵
                        • Kills process with taskkill
                        PID:1028
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im shutdown.exe
                        4⤵
                          PID:3360
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im taskmgr.exe
                          4⤵
                            PID:6656
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im werfault.exe
                            4⤵
                            • Kills process with taskkill
                            PID:1648
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im shutdown.exe
                            4⤵
                              PID:2276
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im taskmgr.exe
                              4⤵
                                PID:1960
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im werfault.exe
                                4⤵
                                  PID:6728
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im shutdown.exe
                                  4⤵
                                  • Kills process with taskkill
                                  PID:6808
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im taskmgr.exe
                                  4⤵
                                  • Kills process with taskkill
                                  PID:6872
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im werfault.exe
                                  4⤵
                                    PID:6940
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im shutdown.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:6924
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im taskmgr.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:6548
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im werfault.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:4108
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im shutdown.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:3720
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im taskmgr.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:6640
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im werfault.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:1936
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im shutdown.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:6408
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im taskmgr.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:6280
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im werfault.exe
                                    4⤵
                                      PID:3788
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im shutdown.exe
                                      4⤵
                                      • Kills process with taskkill
                                      PID:6744
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im taskmgr.exe
                                      4⤵
                                      • Kills process with taskkill
                                      PID:7056
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im werfault.exe
                                      4⤵
                                      • Kills process with taskkill
                                      PID:636
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im shutdown.exe
                                      4⤵
                                      • Kills process with taskkill
                                      PID:3744
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im taskmgr.exe
                                      4⤵
                                      • Kills process with taskkill
                                      PID:3636
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im werfault.exe
                                      4⤵
                                      • Kills process with taskkill
                                      PID:6580
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im shutdown.exe
                                      4⤵
                                        PID:5356
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im taskmgr.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:6080
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im werfault.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:5452
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im shutdown.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:6300
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im taskmgr.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:5348
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im werfault.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:6488
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im shutdown.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:680
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im taskmgr.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:6536
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im werfault.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:6852
                                    • C:\Windows\SysWOW64\cipher.exe
                                      cipher /k /h /e C:\Users\Admin\Desktop\*
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1496
                                    • C:\Windows\SysWOW64\cipher.exe
                                      cipher C:\Users\Admin\Desktop\*
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3960
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\doc.html
                                      3⤵
                                      • Manipulates Digital Signatures
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                      • Suspicious use of FindShellTrayWindow
                                      PID:404
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe4d7546f8,0x7ffe4d754708,0x7ffe4d754718
                                        4⤵
                                          PID:2132
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
                                          4⤵
                                            PID:1184
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
                                            4⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4868
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1508 /prefetch:8
                                            4⤵
                                              PID:4200
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
                                              4⤵
                                                PID:3088
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                                                4⤵
                                                  PID:2900
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
                                                  4⤵
                                                    PID:4192
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
                                                    4⤵
                                                      PID:3540
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
                                                      4⤵
                                                        PID:1992
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
                                                        4⤵
                                                          PID:224
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                                                          4⤵
                                                            PID:5800
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                                                            4⤵
                                                              PID:5808
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
                                                              4⤵
                                                                PID:5496
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
                                                                4⤵
                                                                  PID:5448
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
                                                                  4⤵
                                                                    PID:5536
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
                                                                    4⤵
                                                                      PID:4556
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
                                                                      4⤵
                                                                        PID:4768
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,7454884180649843373,4645933724423965759,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6352 /prefetch:2
                                                                        4⤵
                                                                          PID:6340
                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\butdes.exe
                                                                        butdes.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2456
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-A83RS.tmp\butdes.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-A83RS.tmp\butdes.tmp" /SL5="$20160,2719719,54272,C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\butdes.exe"
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4524
                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\flydes.exe
                                                                        flydes.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3912
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-R1RO2.tmp\flydes.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-R1RO2.tmp\flydes.tmp" /SL5="$20164,595662,54272,C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\flydes.exe"
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1240
                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\i.exe
                                                                        i.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:3128
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout 3
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Delays execution with timeout.exe
                                                                        PID:2476
                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\gx.exe
                                                                        gx.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4312
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8D067C87\setup.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zS8D067C87\setup.exe --server-tracking-blob=MzY5Njg4ZTc1OTE1MjcyMTMxZmYwZTk4ODU3ZWE4Mjk0NjQ0Nzc5MjcxMWY4OGZhOThlNTU5YmNlNzA1NmJiOTp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9OTF9VVlJfMzczNiZlZGl0aW9uPXN0ZC0yJnV0bV9jb250ZW50PTM3MzZfJnV0bV9pZD0wNTgwYWM0YWUyOTA0ZDA3ODNkOTQxNWE0NWRhZGFkYSZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRnJ1JTJGZ3glM0ZlZGl0aW9uJTNEc3RkLTIlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZ1dG1fbWVkaXVtJTNEcGElMjZ1dG1fY2FtcGFpZ24lM0RQV05fTkxfVVZSXzM3MzYlMjZ1dG1fY29udGVudCUzRDM3MzZfJTI2dXRtX2lkJTNEMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9MDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEmZGxfdG9rZW49NzAwOTYzNzgiLCJ0aW1lc3RhbXAiOiIxNzI1ODAyMjIzLjgwMDQiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTI4LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEyOC4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9OTF9VVlJfMzczNiIsImNvbnRlbnQiOiIzNzM2XyIsImlkIjoiMDU4MGFjNGFlMjkwNGQwNzgzZDk0MTVhNDVkYWRhZGEiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiI0ODkyOGFmMC1jZDc3LTQ0NDctYTQyNy1kNzY5ODRmOGQ5NGMifQ==
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Enumerates connected drives
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1248
                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8D067C87\setup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\7zS8D067C87\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.115 --initial-client-data=0x320,0x324,0x328,0x2fc,0x32c,0x6ed71b54,0x6ed71b60,0x6ed71b6c
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5192
                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5348
                                                                          • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170406431\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170406431\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
                                                                            5⤵
                                                                              PID:3972
                                                                            • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170406431\assistant\assistant_installer.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170406431\assistant\assistant_installer.exe" --version
                                                                              5⤵
                                                                                PID:2624
                                                                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170406431\assistant\assistant_installer.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170406431\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x204f48,0x204f58,0x204f64
                                                                                  6⤵
                                                                                    PID:5848
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\bundle.exe
                                                                              bundle.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:540
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\rckdck.exe
                                                                              rckdck.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1592
                                                                              • C:\Users\Admin\AppData\Local\Temp\is-9SQ4C.tmp\is-MO2E2.tmp
                                                                                "C:\Users\Admin\AppData\Local\Temp\is-9SQ4C.tmp\is-MO2E2.tmp" /SL4 $40112 "C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\rckdck.exe" 6123423 52736
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:748
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\avg.exe
                                                                              avg.exe
                                                                              3⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Checks for any installed AV software in registry
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2528
                                                                              • C:\Users\Admin\AppData\Local\Temp\ajE40A.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\ajE40A.exe" /relaunch=8 /was_elevated=1 /tagdata
                                                                                4⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Checks for any installed AV software in registry
                                                                                • Writes to the Master Boot Record (MBR)
                                                                                • Checks SCSI registry key(s)
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:5708
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\telamon.exe
                                                                              telamon.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4864
                                                                              • C:\Users\Admin\AppData\Local\Temp\is-24S2R.tmp\telamon.tmp
                                                                                "C:\Users\Admin\AppData\Local\Temp\is-24S2R.tmp\telamon.tmp" /SL5="$200D6,1520969,918016,C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\telamon.exe"
                                                                                4⤵
                                                                                • Loads dropped DLL
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5184
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\tt-installer-helper.exe" --getuid > "C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\~execwithresult.txt""
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:5508
                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\tt-installer-helper.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\tt-installer-helper.exe" --getuid
                                                                                    6⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:6020
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\telamon.exe > "C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\~execwithresult.txt""
                                                                                  5⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:5300
                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\tt-installer-helper.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\telamon.exe
                                                                                    6⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5460
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\stopwatch.exe
                                                                              stopwatch.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:5096
                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\gadget.msi"
                                                                              3⤵
                                                                              • Enumerates connected drives
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:5464
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\g_.exe
                                                                              g_.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:6100
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\t.exe
                                                                              t.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:6128
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\g.exe
                                                                              g.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:5244
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\e.exe
                                                                              e.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:5416
                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                              attrib +s +h C:\GAB
                                                                              3⤵
                                                                              • Sets file to hidden
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Views/modifies file attributes
                                                                              PID:5448
                                                                            • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\Bootstraper.exe
                                                                              Bootstraper.exe
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5732
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\SalaNses'"
                                                                                4⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:5168
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
                                                                                4⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5020
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                                                                                4⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3656
                                                                              • C:\SalaNses\soles.exe
                                                                                "C:\SalaNses\soles.exe"
                                                                                4⤵
                                                                                  PID:6372
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\dng.html
                                                                                3⤵
                                                                                  PID:4332
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4d7546f8,0x7ffe4d754708,0x7ffe4d754718
                                                                                    4⤵
                                                                                      PID:6052
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout 10
                                                                                    3⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:6504
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /K proxy.bat
                                                                                    3⤵
                                                                                      PID:6716
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /f /im explorer.exe
                                                                                        4⤵
                                                                                          PID:6976
                                                                                      • C:\Windows\SysWOW64\notepad.exe
                                                                                        "C:\Windows\System32\notepad.exe" "C:\GAB\23890.CompositeFont"
                                                                                        3⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:3444
                                                                                      • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\GAB\23890.ini
                                                                                        3⤵
                                                                                        • Opens file in notepad (likely ransom note)
                                                                                        PID:116
                                                                                      • C:\Windows\SysWOW64\fontview.exe
                                                                                        "C:\Windows\System32\fontview.exe" C:\GAB\23890.ttc
                                                                                        3⤵
                                                                                          PID:6740
                                                                                        • C:\Windows\SysWOW64\fontview.exe
                                                                                          "C:\Windows\System32\fontview.exe" C:\GAB\23890.TTF
                                                                                          3⤵
                                                                                            PID:6828
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\cobstrk.exe
                                                                                            cobstrk.exe
                                                                                            3⤵
                                                                                              PID:6808
                                                                                              • C:\Windows\System\wyPIpXd.exe
                                                                                                C:\Windows\System\wyPIpXd.exe
                                                                                                4⤵
                                                                                                  PID:7060
                                                                                                • C:\Windows\System\mRNihfJ.exe
                                                                                                  C:\Windows\System\mRNihfJ.exe
                                                                                                  4⤵
                                                                                                    PID:6452
                                                                                                  • C:\Windows\System\kCFpeji.exe
                                                                                                    C:\Windows\System\kCFpeji.exe
                                                                                                    4⤵
                                                                                                      PID:3688
                                                                                                    • C:\Windows\System\ZJwDcYI.exe
                                                                                                      C:\Windows\System\ZJwDcYI.exe
                                                                                                      4⤵
                                                                                                        PID:3372
                                                                                                      • C:\Windows\System\dAPaGMO.exe
                                                                                                        C:\Windows\System\dAPaGMO.exe
                                                                                                        4⤵
                                                                                                          PID:3504
                                                                                                        • C:\Windows\System\JVqnGnx.exe
                                                                                                          C:\Windows\System\JVqnGnx.exe
                                                                                                          4⤵
                                                                                                            PID:6600
                                                                                                          • C:\Windows\System\PnIMphy.exe
                                                                                                            C:\Windows\System\PnIMphy.exe
                                                                                                            4⤵
                                                                                                              PID:5220
                                                                                                            • C:\Windows\System\iuECFhQ.exe
                                                                                                              C:\Windows\System\iuECFhQ.exe
                                                                                                              4⤵
                                                                                                                PID:5856
                                                                                                              • C:\Windows\System\YDKOCiC.exe
                                                                                                                C:\Windows\System\YDKOCiC.exe
                                                                                                                4⤵
                                                                                                                  PID:6820
                                                                                                                • C:\Windows\System\bFhwYsI.exe
                                                                                                                  C:\Windows\System\bFhwYsI.exe
                                                                                                                  4⤵
                                                                                                                    PID:3892
                                                                                                                  • C:\Windows\System\DZwZQfz.exe
                                                                                                                    C:\Windows\System\DZwZQfz.exe
                                                                                                                    4⤵
                                                                                                                      PID:6664
                                                                                                                    • C:\Windows\System\dTRvwXk.exe
                                                                                                                      C:\Windows\System\dTRvwXk.exe
                                                                                                                      4⤵
                                                                                                                        PID:5580
                                                                                                                      • C:\Windows\System\rPCgBoJ.exe
                                                                                                                        C:\Windows\System\rPCgBoJ.exe
                                                                                                                        4⤵
                                                                                                                          PID:5620
                                                                                                                        • C:\Windows\System\mbGqJHg.exe
                                                                                                                          C:\Windows\System\mbGqJHg.exe
                                                                                                                          4⤵
                                                                                                                            PID:5360
                                                                                                                          • C:\Windows\System\rOdkbmA.exe
                                                                                                                            C:\Windows\System\rOdkbmA.exe
                                                                                                                            4⤵
                                                                                                                              PID:6580
                                                                                                                            • C:\Windows\System\lrcXntX.exe
                                                                                                                              C:\Windows\System\lrcXntX.exe
                                                                                                                              4⤵
                                                                                                                                PID:6776
                                                                                                                              • C:\Windows\System\xQdSzwn.exe
                                                                                                                                C:\Windows\System\xQdSzwn.exe
                                                                                                                                4⤵
                                                                                                                                  PID:6624
                                                                                                                                • C:\Windows\System\FjoxOXa.exe
                                                                                                                                  C:\Windows\System\FjoxOXa.exe
                                                                                                                                  4⤵
                                                                                                                                    PID:6040
                                                                                                                                  • C:\Windows\System\OILsBPf.exe
                                                                                                                                    C:\Windows\System\OILsBPf.exe
                                                                                                                                    4⤵
                                                                                                                                      PID:6576
                                                                                                                                    • C:\Windows\System\WTHAPvX.exe
                                                                                                                                      C:\Windows\System\WTHAPvX.exe
                                                                                                                                      4⤵
                                                                                                                                        PID:5200
                                                                                                                                      • C:\Windows\System\ibjhKDU.exe
                                                                                                                                        C:\Windows\System\ibjhKDU.exe
                                                                                                                                        4⤵
                                                                                                                                          PID:5680
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\jaf.exe
                                                                                                                                        jaf.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:6876
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /K des.bat
                                                                                                                                          3⤵
                                                                                                                                            PID:3708
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\file.exe
                                                                                                                                            file.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:6980
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:6260
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\PurchaseOrder.exe
                                                                                                                                                PurchaseOrder.exe
                                                                                                                                                3⤵
                                                                                                                                                  PID:6792
                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\PurchaseOrder.exe"
                                                                                                                                                    4⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:2748
                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TESAYt.exe"
                                                                                                                                                    4⤵
                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                    PID:2084
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TESAYt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC75.tmp"
                                                                                                                                                    4⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:6316
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4148
                                                                                                                                              • C:\Windows\system32\efsui.exe
                                                                                                                                                efsui.exe /efs /keybackup
                                                                                                                                                1⤵
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                PID:868
                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x308 0x4cc
                                                                                                                                                1⤵
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:4004
                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:3608
                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3940
                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:5596
                                                                                                                                                  • C:\Windows\System32\sihclient.exe
                                                                                                                                                    C:\Windows\System32\sihclient.exe /cv vFT40nm+FU6JKjOp+2LR3g.0.2
                                                                                                                                                    1⤵
                                                                                                                                                      PID:224
                                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1524

                                                                                                                                                      Network

                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                      Reconnaissance

                                                                                                                                                      Resource Development

                                                                                                                                                      Initial Access

                                                                                                                                                      Execution

                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                      1
                                                                                                                                                      T1059

                                                                                                                                                      PowerShell

                                                                                                                                                      1
                                                                                                                                                      T1059.001

                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                      1
                                                                                                                                                      T1053

                                                                                                                                                      Scheduled Task

                                                                                                                                                      1
                                                                                                                                                      T1053.005

                                                                                                                                                      Persistence

                                                                                                                                                      Pre-OS Boot

                                                                                                                                                      1
                                                                                                                                                      T1542

                                                                                                                                                      Bootkit

                                                                                                                                                      1
                                                                                                                                                      T1542.003

                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                      1
                                                                                                                                                      T1053

                                                                                                                                                      Scheduled Task

                                                                                                                                                      1
                                                                                                                                                      T1053.005

                                                                                                                                                      Privilege Escalation

                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                      1
                                                                                                                                                      T1053

                                                                                                                                                      Scheduled Task

                                                                                                                                                      1
                                                                                                                                                      T1053.005

                                                                                                                                                      Defense Evasion

                                                                                                                                                      Hide Artifacts

                                                                                                                                                      2
                                                                                                                                                      T1564

                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                      2
                                                                                                                                                      T1564.001

                                                                                                                                                      Pre-OS Boot

                                                                                                                                                      1
                                                                                                                                                      T1542

                                                                                                                                                      Bootkit

                                                                                                                                                      1
                                                                                                                                                      T1542.003

                                                                                                                                                      Subvert Trust Controls

                                                                                                                                                      1
                                                                                                                                                      T1553

                                                                                                                                                      SIP and Trust Provider Hijacking

                                                                                                                                                      1
                                                                                                                                                      T1553.003

                                                                                                                                                      Credential Access

                                                                                                                                                      Unsecured Credentials

                                                                                                                                                      1
                                                                                                                                                      T1552

                                                                                                                                                      Credentials In Files

                                                                                                                                                      1
                                                                                                                                                      T1552.001

                                                                                                                                                      Discovery

                                                                                                                                                      Browser Information Discovery

                                                                                                                                                      1
                                                                                                                                                      T1217

                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                      2
                                                                                                                                                      T1120

                                                                                                                                                      Query Registry

                                                                                                                                                      4
                                                                                                                                                      T1012

                                                                                                                                                      Software Discovery

                                                                                                                                                      1
                                                                                                                                                      T1518

                                                                                                                                                      Security Software Discovery

                                                                                                                                                      1
                                                                                                                                                      T1518.001

                                                                                                                                                      System Information Discovery

                                                                                                                                                      5
                                                                                                                                                      T1082

                                                                                                                                                      System Location Discovery

                                                                                                                                                      1
                                                                                                                                                      T1614

                                                                                                                                                      System Language Discovery

                                                                                                                                                      1
                                                                                                                                                      T1614.001

                                                                                                                                                      Lateral Movement

                                                                                                                                                      Collection

                                                                                                                                                      Data from Local System

                                                                                                                                                      1
                                                                                                                                                      T1005

                                                                                                                                                      Command and Control

                                                                                                                                                      Web Service

                                                                                                                                                      1
                                                                                                                                                      T1102

                                                                                                                                                      Exfiltration

                                                                                                                                                      Impact

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • C:\GAB\23890.CompositeFont
                                                                                                                                                        Filesize

                                                                                                                                                        42KB

                                                                                                                                                        MD5

                                                                                                                                                        8f64a583b0823bfc2fdf7277e67b5e16

                                                                                                                                                        SHA1

                                                                                                                                                        f8029c828d0aef58f8818b866f1f7f1ec2f095b8

                                                                                                                                                        SHA256

                                                                                                                                                        b637a0f9031088d08147f397836fe1c16b15c70db696db4ddea05ec5b95b4f91

                                                                                                                                                        SHA512

                                                                                                                                                        e8c7941c8a42f6408b0071c7f0ea06a226757d3a07e3943738296c5dd5e5e60d682424182f0d788f42a5758f1c76ef1ec89901acc43799833234f09f3b4278a2

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.TTF
                                                                                                                                                        Filesize

                                                                                                                                                        576KB

                                                                                                                                                        MD5

                                                                                                                                                        827269f80df8d46c42ed03cbd4762562

                                                                                                                                                        SHA1

                                                                                                                                                        3487a26dbbb819e83fcf1de8f5a73fee8ae8fec8

                                                                                                                                                        SHA256

                                                                                                                                                        cc2cbfe8d858822373aa3a0715f2d3af30598df815623c2a7ec34c1093393f18

                                                                                                                                                        SHA512

                                                                                                                                                        7af7d249dad25496c511d679af6ed22473b82a9304b776157d08958f9b4ebcbc1a1c20b74c29cab0cc4f5a4443fc845e4c748cbd506c32ee055f63c0da6f982e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.TTF
                                                                                                                                                        Filesize

                                                                                                                                                        320KB

                                                                                                                                                        MD5

                                                                                                                                                        c0e588f964f1b1ba66a0a09eb2427446

                                                                                                                                                        SHA1

                                                                                                                                                        43e212a58dc93c7f1fd28642b08181ac70cb6c31

                                                                                                                                                        SHA256

                                                                                                                                                        9f75d2d34cb0eba1ffd132c302a86e0d237fe1a8938b962a55c719a068806d7e

                                                                                                                                                        SHA512

                                                                                                                                                        906d931b06b2b5566c80342acca59a66be76338057b61b41508cf64598a196d9b47d8f4714bd995591bb90d311fc6d7cfed733b6a07b3e2851a401f2d6d6341c

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.TTF
                                                                                                                                                        Filesize

                                                                                                                                                        256KB

                                                                                                                                                        MD5

                                                                                                                                                        619ae16e89205048cb74df283b1ed4ef

                                                                                                                                                        SHA1

                                                                                                                                                        6f0b4f2cbd44260574c69f60d7bfcf2b9a6a9af7

                                                                                                                                                        SHA256

                                                                                                                                                        a8f12b9d498bc8d9fae2af142cff6f1a919e05f646c58f5842c7ed25fdd09a4a

                                                                                                                                                        SHA512

                                                                                                                                                        d8c90260c3ffa2bfe328e2fbd5f478af2ed2d4d6a837789fa7a9704236d62661cc4cfc3193c95a673bed4ce1408c627ea681e267f09c92f0f6d7ad6fd7ad0648

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.TTF
                                                                                                                                                        Filesize

                                                                                                                                                        192KB

                                                                                                                                                        MD5

                                                                                                                                                        15e547d15f7d512a56b7fe72f0727c03

                                                                                                                                                        SHA1

                                                                                                                                                        e5cadd12c9d3bcc9439c61794e3043bb38a13428

                                                                                                                                                        SHA256

                                                                                                                                                        edcc492e43ab3b09824efb51c09635221adc4338bd3ad5a8eeac21765d5fbea3

                                                                                                                                                        SHA512

                                                                                                                                                        8355635554f760e565b4f8053fcb5e813d3accfbc7ef702339d77cf0a00696321602e65cd5dbe40df1a99f818ed5cc03343f1a69a9c6bb8869d312ed696627ef

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.TTF
                                                                                                                                                        Filesize

                                                                                                                                                        5.4MB

                                                                                                                                                        MD5

                                                                                                                                                        6b5f7fa6170505943e457161f3890d3d

                                                                                                                                                        SHA1

                                                                                                                                                        c8f0ba2157d1034dd37899372d21a4ab08ec79dc

                                                                                                                                                        SHA256

                                                                                                                                                        f7969912f294d1de64efb4400df0b241b710ec06131304fa16a9d4c3c306fc67

                                                                                                                                                        SHA512

                                                                                                                                                        1147d93974aaf089859eceeea8ca73cf6520e692c9066bf01c1669d09b7a9f8080c45dd49048a912839a1bc199d5b2d4645c38af6a949801b673d2fd5da6df56

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.TTF
                                                                                                                                                        Filesize

                                                                                                                                                        320KB

                                                                                                                                                        MD5

                                                                                                                                                        56fcc9adc0a509558071c685209c160b

                                                                                                                                                        SHA1

                                                                                                                                                        baeeac4dda8e6f4ef8c29f3633128d9cc2b8816e

                                                                                                                                                        SHA256

                                                                                                                                                        d1719222e45f0a0ab738c1b44ab7d474a13b1f7c501bf521c26aeccfef281414

                                                                                                                                                        SHA512

                                                                                                                                                        fa3454e8ea0abcfc41fe021a8fa2613cb250878f78651777a60ac25186fbc0bf5e769c98bbe32aecd00824d8f6ebbbe69ab4b47f5d71dcbbd6a98ddc3aa7df47

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.TTF
                                                                                                                                                        Filesize

                                                                                                                                                        224KB

                                                                                                                                                        MD5

                                                                                                                                                        8924123111f4a88ec9a4541aa713db53

                                                                                                                                                        SHA1

                                                                                                                                                        342cd5a4ce1d036d72ead842478d3ac2514760f9

                                                                                                                                                        SHA256

                                                                                                                                                        d71f81c83ec63eaa32d36d5df7be1d9e71d3ea9150f47cebda2924923cbbf18a

                                                                                                                                                        SHA512

                                                                                                                                                        c02ee1f193fb9f5bf1adee4bf6fea02db1f718ec74c6900419cccdc52e4d1ad6e5c540716c717655153f69b0a4daa6b3832ec9222f803efb181ac8954a032c8f

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.TTF
                                                                                                                                                        Filesize

                                                                                                                                                        34KB

                                                                                                                                                        MD5

                                                                                                                                                        9e2ee65661bee40438d514fe592bfcf8

                                                                                                                                                        SHA1

                                                                                                                                                        140a77e69329638a5c53dc01fbcfe0ce9ab93423

                                                                                                                                                        SHA256

                                                                                                                                                        ac9ee085920a3d8b076d5e0c61dc9df42c4bac28d1fc968344f9ceddb3972f69

                                                                                                                                                        SHA512

                                                                                                                                                        3b3c7ff00d8f12cea48008a2e95c194f7fc64ee96425a3cfefb8b65a9f7dad66fa16104ec1cf96ac6892426e5e8ab59dab91e3d56d76f58753b80f8ac48f2612

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        MD5

                                                                                                                                                        b0ac2d09abc0efc32b28b7e364659a15

                                                                                                                                                        SHA1

                                                                                                                                                        33738efa553c7dcb30a94055b24fd1a16616bc27

                                                                                                                                                        SHA256

                                                                                                                                                        a0e5dbe96d1cae29501b481cd98a1eac5f0f662aa367aa9712a419c3c32f4284

                                                                                                                                                        SHA512

                                                                                                                                                        25853b53eb7c6115546cf59c276142f5aa2e54718f18f98402fa7267cd685601280b2e9f903a4c4e16c74e531bf591f0355fee29b0c702e0c15ba6e00899329f

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        12KB

                                                                                                                                                        MD5

                                                                                                                                                        dcfe71d27bf49ba16fde0d1945bfb4a2

                                                                                                                                                        SHA1

                                                                                                                                                        86b3d8696b5da354ef42c8ab4a9d21cdaaf0dda1

                                                                                                                                                        SHA256

                                                                                                                                                        eacbfca9a5ef05a108ef5337c773d82a43398bb8ea177e5ebeef62934dd75811

                                                                                                                                                        SHA512

                                                                                                                                                        4da8efcfd4a77e230c61a527eb96b5193b9f5ddc0d476dfca8ce6ba7143ac5c8a1fd8b673cc2c7b554dae42ec01364a178f64532b6de17d44dce07b3089869c3

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        58KB

                                                                                                                                                        MD5

                                                                                                                                                        2b715a1f340a4704fe4c6f48bdf2aa26

                                                                                                                                                        SHA1

                                                                                                                                                        927d2e65a46200c75348a24f78ee4561474a1abf

                                                                                                                                                        SHA256

                                                                                                                                                        3aed0f6ec1e924e669df63b57619656c45814ae8f7bfa481066ccb291c3f8f5c

                                                                                                                                                        SHA512

                                                                                                                                                        6eb2975cb4a3de4eab7d3808e38a9821de5994490302767ad531fd31144116264878d709f131e3e99d26c41208fc0ebee3bd6779766bc92e8c9aa10d4f19a672

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        82KB

                                                                                                                                                        MD5

                                                                                                                                                        5972eeea7971170eb72cab2fc85c2b17

                                                                                                                                                        SHA1

                                                                                                                                                        d327d96bd78c5e851e065d053829abbb370c0c09

                                                                                                                                                        SHA256

                                                                                                                                                        9677467feb714a89de457e262ff6647708b7de66127671b77f7e1e92aa0c2f41

                                                                                                                                                        SHA512

                                                                                                                                                        c55c5217271f29bd3a7a130daa5e5711eff65630127f90112a26bb4ba3dbf416059f9424606bc1998ff4eec874c18767a395e20c3dc516a00079b2c5a7221ed3

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        12KB

                                                                                                                                                        MD5

                                                                                                                                                        40f8022c3fe4e1cc97bb794e1b519b3f

                                                                                                                                                        SHA1

                                                                                                                                                        7ff107451b67b2d432db4706c697a9391c13a6f4

                                                                                                                                                        SHA256

                                                                                                                                                        6b16818c057024f588f4f423cb1f50d24e092fca3c9b5c8c1943cf5b3ea70759

                                                                                                                                                        SHA512

                                                                                                                                                        08a85d0203a0534067538ba0c1f40273409f61f212269cb3095df1defc114ff007efcb4c3c4897a345cda17db16c98b88ae61100b9e4636862d26edb8a402ba3

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        7KB

                                                                                                                                                        MD5

                                                                                                                                                        6e78ea1629ed74deed4190d87aecbbea

                                                                                                                                                        SHA1

                                                                                                                                                        c1e6e0eea7d9e7b7e693530ed43cc271567e5bf1

                                                                                                                                                        SHA256

                                                                                                                                                        9ae1c525224824cbb209b46c64d19cfac121f1bee266a9924ec5319f7ea45295

                                                                                                                                                        SHA512

                                                                                                                                                        60be03a64880316b9d8c1dac2e9884dd1bf764ceba0be2c47a114cec20c285f6a925dcfd4f1f855f863775e6896ad8e9239ed45523ac317c4388449dd93509d6

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        6KB

                                                                                                                                                        MD5

                                                                                                                                                        8a5dbabcb9b11e3e0c527b93e69d5e4d

                                                                                                                                                        SHA1

                                                                                                                                                        c47add614ece5ed16ca456bac08b1f2cbaccfec9

                                                                                                                                                        SHA256

                                                                                                                                                        824ea3f5eabd9c3b8e0041e78935feb65545f58760ce0c47a0d938ad75f8e241

                                                                                                                                                        SHA512

                                                                                                                                                        ddcb3520d68321e6372630cb34473c7b310ffed1263cde8e1059837e63e42e7a7e644537044dee774e9ea3e912e485f2630bc106233e039ea925355ec29921c0

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        11KB

                                                                                                                                                        MD5

                                                                                                                                                        f450c5ca28b425ffa6710530ee9a1e9e

                                                                                                                                                        SHA1

                                                                                                                                                        4e922b3f0c318a9a13b81f094a4beb478400674d

                                                                                                                                                        SHA256

                                                                                                                                                        35b071f3eca3ce103268adf701117138087cd194605110563655635ce7f0a6f3

                                                                                                                                                        SHA512

                                                                                                                                                        03d9bce643aeda7e39202ffd4ec75127b33015a7abbe976bb01d22ec40433235f700cae5206b4f1832b3f35ddaabc44c65f066fea26d054073e00c8b8f2737a6

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        MD5

                                                                                                                                                        9d2bf033acde5a212f6f5404d490e169

                                                                                                                                                        SHA1

                                                                                                                                                        a0e28adf40a9d06710d20071dcaba2569b91b1dd

                                                                                                                                                        SHA256

                                                                                                                                                        93e7c6c123d9b53a2d933f63093b4b85302023517f56abf057f9ef8a94d83b8b

                                                                                                                                                        SHA512

                                                                                                                                                        8dcb0dd9dc72c2de61e26932b72d5923a43b0f512e8d2df5334f478a78ee80f492bb8cb193dd3a314a6a19dd95e4899b40e7b76c3b1f767f5e8b46d1b1b3c00d

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        9KB

                                                                                                                                                        MD5

                                                                                                                                                        46ef27810a6f255f6b4cd012324c904f

                                                                                                                                                        SHA1

                                                                                                                                                        b4d83b70456eede709abc2539b842107ee93f4e5

                                                                                                                                                        SHA256

                                                                                                                                                        0c71013d47cad93acf49bed71a1ba589ac42027ca5ac4b3d06e682ca5f3419ff

                                                                                                                                                        SHA512

                                                                                                                                                        e04c9d1873a9fb92f1ac42e9f46f25e90e25b653d25e608478fe9ba1cf2efe1336f196d9eac5472bb3fbfcb61c2fdb599db9ac30c6f4c15b2da37bc359ac3d6e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.fon
                                                                                                                                                        Filesize

                                                                                                                                                        9KB

                                                                                                                                                        MD5

                                                                                                                                                        e7629d2374443b7e604c831de1fee8f1

                                                                                                                                                        SHA1

                                                                                                                                                        6aee8b0dc09f9e2e07bfa9ee4e609988efa8e2ac

                                                                                                                                                        SHA256

                                                                                                                                                        c95c0ab1d348a4c4a8b009b348e688fc9b97b967104f750afcff20a981fe4ca1

                                                                                                                                                        SHA512

                                                                                                                                                        c81d1ada7d26b1d0f3fa137af8cfbe30a9d24402ed15ef3d0bda3b81593a3ec2ce201b8fc98c3eec3a99d5e403c20d5aa7fb9afc0047d009c7d09003b1d5ace9

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.ttc
                                                                                                                                                        Filesize

                                                                                                                                                        5.8MB

                                                                                                                                                        MD5

                                                                                                                                                        f617df59ad479872b7f65bb81fd59350

                                                                                                                                                        SHA1

                                                                                                                                                        cc61df1b84bbe024691d1c5f6b59dfe74643d7f5

                                                                                                                                                        SHA256

                                                                                                                                                        ef4fa2fc9548b4aa84c8340f3cc167f7ac5522a90f6d62b3e56818515d9ee7e1

                                                                                                                                                        SHA512

                                                                                                                                                        40c0e5aa2b3beb6c2c4633ec02e16b42d4bccb00673ae39e6c373f5ae2f68d10b12ba08277847f6123902b22318399060b77f8c76b812cd0a154493755737e24

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\GAB\23890.ttc
                                                                                                                                                        Filesize

                                                                                                                                                        13.0MB

                                                                                                                                                        MD5

                                                                                                                                                        e868c731ec770c425dbc74881b3ca936

                                                                                                                                                        SHA1

                                                                                                                                                        a8dc99a2e0bc3360f8441243aab13fe7279a759a

                                                                                                                                                        SHA256

                                                                                                                                                        1e5a4b342c6417bb9352e8c29cb839413987a06438e7b48fd0320925827f289c

                                                                                                                                                        SHA512

                                                                                                                                                        51bbdbcd06bc41c1ef6a589ca2b6300f1f9350d11b8bfa60605c7a68a0d6a714998bec6060cbc3b27dd2d1485d57f344890b0278d7313dbdb5593334ceea3b49

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\SalaNses\soles.exe
                                                                                                                                                        Filesize

                                                                                                                                                        1.2MB

                                                                                                                                                        MD5

                                                                                                                                                        acebc69ae67997867002990dae3f699d

                                                                                                                                                        SHA1

                                                                                                                                                        8483b45b2faaa21ad548e72fb49ae3a08143334e

                                                                                                                                                        SHA256

                                                                                                                                                        f545fbcf52e694eaed07f7869ee67d1dffea29a3769e2482f5eccb3c21148442

                                                                                                                                                        SHA512

                                                                                                                                                        6c9f88407ffbf228f44270c28d0eeba804a8f3198454becebdd5f2d13eda5c1f0407f1e98569bbcd490225a10ba6e1917c1af1971bd1f636a71250b602dcbf28

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        55540a230bdab55187a841cfe1aa1545

                                                                                                                                                        SHA1

                                                                                                                                                        363e4734f757bdeb89868efe94907774a327695e

                                                                                                                                                        SHA256

                                                                                                                                                        d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                                                                                                                                                        SHA512

                                                                                                                                                        c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
                                                                                                                                                        Filesize

                                                                                                                                                        230B

                                                                                                                                                        MD5

                                                                                                                                                        312f5b3c9cb52e82d768657b3d05250b

                                                                                                                                                        SHA1

                                                                                                                                                        09a1045d28c05c307f939fe57a5166437c42a914

                                                                                                                                                        SHA256

                                                                                                                                                        624d35479a49e43dd5981bf67495b4fe82e44e5a42f2f546def404874397632a

                                                                                                                                                        SHA512

                                                                                                                                                        ace0f99ecc8bda33f6eb9698d33c48622f1ed5d85eaa7c3c0750a9ded0fd5b3ca4db1e6aa2a978ee8bb02ff2034d05dc5dad3cc68ff19c7b77161378087726cb

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                        Filesize

                                                                                                                                                        152B

                                                                                                                                                        MD5

                                                                                                                                                        4dd2754d1bea40445984d65abee82b21

                                                                                                                                                        SHA1

                                                                                                                                                        4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                                                                                                                                        SHA256

                                                                                                                                                        183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                                                                                                                                        SHA512

                                                                                                                                                        92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                        Filesize

                                                                                                                                                        152B

                                                                                                                                                        MD5

                                                                                                                                                        ecf7ca53c80b5245e35839009d12f866

                                                                                                                                                        SHA1

                                                                                                                                                        a7af77cf31d410708ebd35a232a80bddfb0615bb

                                                                                                                                                        SHA256

                                                                                                                                                        882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                                                                                                                                        SHA512

                                                                                                                                                        706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                        Filesize

                                                                                                                                                        144B

                                                                                                                                                        MD5

                                                                                                                                                        c481b7883a4b8d7454900f708991f0f9

                                                                                                                                                        SHA1

                                                                                                                                                        cd28238c2837b5e4c221818f99f0a7364881322f

                                                                                                                                                        SHA256

                                                                                                                                                        ba949d0c956d071eee4d6ea69d3c9cea6a76085a9fd564391e8c2eb261fbbaed

                                                                                                                                                        SHA512

                                                                                                                                                        b8bc1d774b4ab52590c41db2ba73fb68020c87581188e7a1b56b369df8278df3fe4a5360365d1e8c3b3605c69371482990648a2b29ef8ee4131890797900d733

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                        Filesize

                                                                                                                                                        3KB

                                                                                                                                                        MD5

                                                                                                                                                        8f607ecf72846f6ec09d8e65672b2379

                                                                                                                                                        SHA1

                                                                                                                                                        c9f878e50c9d7bb34f8e39b6100d374fb759a71d

                                                                                                                                                        SHA256

                                                                                                                                                        b0fb170d3295011187dd97616a8b877a5c84015cc832b097dfec58e68eda1e64

                                                                                                                                                        SHA512

                                                                                                                                                        9f9eeff4ae1efc8fe246a4138322c69471ca56b92415f1b5665c6f5cd8298f4664b3381cfa62aca8f03e6ba630c552a067f906df2d4160c7561a007c799a0cc2

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                        Filesize

                                                                                                                                                        5KB

                                                                                                                                                        MD5

                                                                                                                                                        9750fe635cce803bd28ac010f4fa2108

                                                                                                                                                        SHA1

                                                                                                                                                        1db1074f00523631821fb1a709d6a2a0ae3c7b06

                                                                                                                                                        SHA256

                                                                                                                                                        757ba3adf25ff258c8152e36544eb81bf64ddc5707b33f04c780be0bb7ce1cf7

                                                                                                                                                        SHA512

                                                                                                                                                        059cde7e3f2d4e801b7d9f0692b12ffb0ee8364e631d26095d35aa256383b661f2855d3b047f82a0b9eaad981c451a57c6e838e16e9b5c930f8f72a56a4ae93b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                        Filesize

                                                                                                                                                        6KB

                                                                                                                                                        MD5

                                                                                                                                                        4d370855574e8f553ec71761d5efb43f

                                                                                                                                                        SHA1

                                                                                                                                                        3625c7868da896ec27f4a13adf77935f3e52f352

                                                                                                                                                        SHA256

                                                                                                                                                        44f97e6dd6d0e6f0b2fdb10f82726e46aca93c6f1534fb622aa5161c0a24e6a5

                                                                                                                                                        SHA512

                                                                                                                                                        59a80c71e9e20ca5daab7f040c347b5b5c41c283a8221280c5d11d95563f928c10748544fea8be80e9203fda4028037a7db91ef14280b06749ebda2823c31751

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                        Filesize

                                                                                                                                                        16B

                                                                                                                                                        MD5

                                                                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                        SHA1

                                                                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                        SHA256

                                                                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                        SHA512

                                                                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        Filesize

                                                                                                                                                        10KB

                                                                                                                                                        MD5

                                                                                                                                                        b04a427f1d025835cc8eed9d69037a31

                                                                                                                                                        SHA1

                                                                                                                                                        0870d3e9c20ec28ae324029fd18b857202ef33ad

                                                                                                                                                        SHA256

                                                                                                                                                        c7c711261015afbc5567b8317864f1423d713c97bc8d793ec76d7268916e71fd

                                                                                                                                                        SHA512

                                                                                                                                                        2181b5f0f4d6fe43230623c97a3d822fe3987d4eafe1c05db12ce9bc4031e9e527b6d915d80e4d6b135137f62759f33cee89110d98b72e72649aebc74a5bfa70

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                        Filesize

                                                                                                                                                        10KB

                                                                                                                                                        MD5

                                                                                                                                                        c0c360be86b660b0a6bfc801ca041435

                                                                                                                                                        SHA1

                                                                                                                                                        08be06d0eb896efc79473eedef96ffcee1ecd90a

                                                                                                                                                        SHA256

                                                                                                                                                        09b0af622cb8c107f93d39739a5338bffb73cddfee3f4f10afa14d709c8070ca

                                                                                                                                                        SHA512

                                                                                                                                                        57de3d1aeeede5fbe113b01370f80a68446d4e06c55d541d412eb61b5c6f0bc8db8d2236e0a0bb7c1e231bc632c507a5846a1d2d18d67f5acb495f0f76d843f8

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202409170406431\additional_file0.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.4MB

                                                                                                                                                        MD5

                                                                                                                                                        e9a2209b61f4be34f25069a6e54affea

                                                                                                                                                        SHA1

                                                                                                                                                        6368b0a81608c701b06b97aeff194ce88fd0e3c0

                                                                                                                                                        SHA256

                                                                                                                                                        e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

                                                                                                                                                        SHA512

                                                                                                                                                        59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\!m.bat
                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        d295fd5b892b165427abecd1b5aac987

                                                                                                                                                        SHA1

                                                                                                                                                        ec1bb8ab7bb5ffd6d1c971fde332dab00f78cf5b

                                                                                                                                                        SHA256

                                                                                                                                                        855a00d99d2cb67512ca1fb49a9954bc085ed9ada3a2d2226757bb347e2cad58

                                                                                                                                                        SHA512

                                                                                                                                                        800d97dfdb1ef9923c82bf31a77b4cad49bf886aa055d5ee7f4396bc6bcd597a9e638ccdd1cd4878de7d8d273d60228604f97ee6e5b07668002fb08e9636f289

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\anti.exe
                                                                                                                                                        Filesize

                                                                                                                                                        1.9MB

                                                                                                                                                        MD5

                                                                                                                                                        cb02c0438f3f4ddabce36f8a26b0b961

                                                                                                                                                        SHA1

                                                                                                                                                        48c4fcb17e93b74030415996c0ec5c57b830ea53

                                                                                                                                                        SHA256

                                                                                                                                                        64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

                                                                                                                                                        SHA512

                                                                                                                                                        373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\avg.exe
                                                                                                                                                        Filesize

                                                                                                                                                        5.8MB

                                                                                                                                                        MD5

                                                                                                                                                        0dc93e1f58cbb736598ce7fa7ecefa33

                                                                                                                                                        SHA1

                                                                                                                                                        6e539aab5faf7d4ce044c2905a9c27d4393bae30

                                                                                                                                                        SHA256

                                                                                                                                                        4ec941f22985fee21d2f9d2ae590d5dafebed9a4cf55272b688afe472d454d36

                                                                                                                                                        SHA512

                                                                                                                                                        73617da787e51609ee779a12fb75fb9eac6ed6e99fd1f4c5c02ff18109747de91a791b1a389434edfe8b96e5b40340f986b8f7b88eac3a330b683dec565a7eff

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\bundle.exe
                                                                                                                                                        Filesize

                                                                                                                                                        429KB

                                                                                                                                                        MD5

                                                                                                                                                        ae4581af98a5b38bce860f76223cb7c9

                                                                                                                                                        SHA1

                                                                                                                                                        6aa1e2cce517e5914a47816ef8ca79620e50e432

                                                                                                                                                        SHA256

                                                                                                                                                        7c4b329a4018dc7e927a7d1078c846706efae6e6577f6809defaa51b636e7267

                                                                                                                                                        SHA512

                                                                                                                                                        11ad90a030999bbb727dbfde7943d27f2442c247633cde5f9696e89796b0f750f85a9be96f01fa3fd1ec97653a334b1376d6bb76d9e43424cabe3a03893ecf04

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\butdes.exe
                                                                                                                                                        Filesize

                                                                                                                                                        2.8MB

                                                                                                                                                        MD5

                                                                                                                                                        1535aa21451192109b86be9bcc7c4345

                                                                                                                                                        SHA1

                                                                                                                                                        1af211c686c4d4bf0239ed6620358a19691cf88c

                                                                                                                                                        SHA256

                                                                                                                                                        4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

                                                                                                                                                        SHA512

                                                                                                                                                        1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\code.js
                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        MD5

                                                                                                                                                        016bf2cf2bad527f1f1ea557408cb036

                                                                                                                                                        SHA1

                                                                                                                                                        23ab649b9fb99da8db407304ce9ca04f2b50c7b4

                                                                                                                                                        SHA256

                                                                                                                                                        17bb814cfaa135628fd77aa8a017e4b0dcd3c266b8cdca99e4d7de5d215643c0

                                                                                                                                                        SHA512

                                                                                                                                                        ac2d4f51b0b1da3c544f08b7d0618b50514509841f81bc9dad03329d5c1a90e205795a51ca59522d3aa660fb60faae19803eceeeea57f141217a6701a70510e7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\doc.html
                                                                                                                                                        Filesize

                                                                                                                                                        15KB

                                                                                                                                                        MD5

                                                                                                                                                        5622e7755e5f6585a965396b0d528475

                                                                                                                                                        SHA1

                                                                                                                                                        b059dc59658822334e39323b37082374e8eeaac4

                                                                                                                                                        SHA256

                                                                                                                                                        080cb8ef0cbf5a5de9163b365eec8b29538e579f14a9caa45c0f11bc173c4147

                                                                                                                                                        SHA512

                                                                                                                                                        62f5abda3473ca043bf126eed9d0bcc0f775b5ac5f85b4fe52d1d656f476f62188d22cf79b229059a5d05e9258980c787cb755f08ca86e24e5f48655b5447f8e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\download.jpg
                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        MD5

                                                                                                                                                        01a5131931ef35acecbe557ba13f3954

                                                                                                                                                        SHA1

                                                                                                                                                        c7afc7590d469432704d963ffcee31ad8bcfc175

                                                                                                                                                        SHA256

                                                                                                                                                        d364872ddde28d81d23bb3b08f9e86f921b542f3a35fcaf12549cf5666462bd0

                                                                                                                                                        SHA512

                                                                                                                                                        ce32352484d676bd0f47c24808707c603fe9f09e41afd63d90f07599f13a5e32c73b0970a9964632f76f5843dda87a033340ee12fadd87b9f219329d0c69b02e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\fence.bat
                                                                                                                                                        Filesize

                                                                                                                                                        167B

                                                                                                                                                        MD5

                                                                                                                                                        6465a5431e01a80bf71aca9e9698e5b0

                                                                                                                                                        SHA1

                                                                                                                                                        d56ed108f13a6c49d57f05e2bf698778fd0b98dc

                                                                                                                                                        SHA256

                                                                                                                                                        1c5f05fecfc1f4fd508f1d3bbb93a47e8b8196b9eded5de7152a6fa57ca7580f

                                                                                                                                                        SHA512

                                                                                                                                                        db7f64b8af595d0bf6fd142471868df6d29ec7cfbb49a7e0da63d9bc8ca8f319e4c41f2c7baeafe17a3679861163400ccb36c18617982b244aaf482e9c264e55

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\flydes.exe
                                                                                                                                                        Filesize

                                                                                                                                                        833KB

                                                                                                                                                        MD5

                                                                                                                                                        b401505e8008994bf2a14fdf0deac874

                                                                                                                                                        SHA1

                                                                                                                                                        e4f7f375b1e88dd71a0274a997ed5d9491bde068

                                                                                                                                                        SHA256

                                                                                                                                                        6bcf6b84d71737787e3cc8d9d0eed9720f388cc2d0337832a7e8ca3c6f455a41

                                                                                                                                                        SHA512

                                                                                                                                                        1bca98547ecf5a98d42b1d77cff50ca79ee560c893b2470aeb86887fef6e40a5ccdb72956f04a1d2a862827eebd3b7746e3043f3e6209597dcde9385ed55cc11

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\fries.jpg
                                                                                                                                                        Filesize

                                                                                                                                                        12KB

                                                                                                                                                        MD5

                                                                                                                                                        c4d9d3cd21ef4de91abc95f99c4bc7dc

                                                                                                                                                        SHA1

                                                                                                                                                        b2cf457237c44c824068727b8440fe6a352a360c

                                                                                                                                                        SHA256

                                                                                                                                                        6fd1c3bde9a6a478e39d1cf2121e980c0bcf59454fe1673d707aa70170953bc9

                                                                                                                                                        SHA512

                                                                                                                                                        d10fbb0bdfb30160484950aa58bd2f97c38cf2d0914550b4041c9acd273e8013920ef1ee74216f92437a44ab81111a4c70ed3dc2df680ee4d187c22557900ee7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\g_.exe
                                                                                                                                                        Filesize

                                                                                                                                                        69KB

                                                                                                                                                        MD5

                                                                                                                                                        3cb72c753dd5e198792d1e0be81f7e2b

                                                                                                                                                        SHA1

                                                                                                                                                        8a55b72a998bf8362a12f68ee8c4801a5a24754c

                                                                                                                                                        SHA256

                                                                                                                                                        be9d8772b360ca8054929e5f057413b69932ca8e521e6c696e0fb6b371e8cb97

                                                                                                                                                        SHA512

                                                                                                                                                        008ed2e26fb4f41e9bb245130cc8f285744ccf737adeffc4c78cb11c03261f906cfd50b5b9e78f2c17dc2b8a01d83554e93f4960370064af87e84322cc78ee70

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\gadget.msi
                                                                                                                                                        Filesize

                                                                                                                                                        23.4MB

                                                                                                                                                        MD5

                                                                                                                                                        906ad3937f0abd2e5383dc162340496b

                                                                                                                                                        SHA1

                                                                                                                                                        d63fe621af79e1468ee0cf52e119ffd21775ca8a

                                                                                                                                                        SHA256

                                                                                                                                                        821e33cf757bd01bec6703796c01726e6674b8de3bc1e7ea834318039e46909e

                                                                                                                                                        SHA512

                                                                                                                                                        624d76f7905f57679b647cfc676aa8c55cac72d6baa60db7d5ae45662de5da55f856f64adca382b315810088e757903f6c051685fcc83fe330016a8a95754d79

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\gx.exe
                                                                                                                                                        Filesize

                                                                                                                                                        3.1MB

                                                                                                                                                        MD5

                                                                                                                                                        80bf3bf3b76c80235d24f7c698239089

                                                                                                                                                        SHA1

                                                                                                                                                        7f6071b502df985580e7c469c6d092472e355765

                                                                                                                                                        SHA256

                                                                                                                                                        2b95e56af10406fbd3ecee38dab9e9c4a9b990d087f2ad2d7b1981c087829da2

                                                                                                                                                        SHA512

                                                                                                                                                        076b8b6a80ea15738ce682cc715792546582d7a74f971f94f6b5b9cf8164f01280322baec7f72894ac4b8d63b9f2f6074e8fc5e47880ef6c0b57a47beef3581a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\i.exe
                                                                                                                                                        Filesize

                                                                                                                                                        12KB

                                                                                                                                                        MD5

                                                                                                                                                        cea5426da515d43c88132a133f83ce68

                                                                                                                                                        SHA1

                                                                                                                                                        0c224d0bb777f1e3b186fdf58cc82860d96805cc

                                                                                                                                                        SHA256

                                                                                                                                                        2be7a0865ded1c0bd1f92d5e09bb7b37a9e36a40487a687e0359c93878611a78

                                                                                                                                                        SHA512

                                                                                                                                                        4c1f25147222c84dff513bebf00e828719454ad634ef9380cfc7835f0457a718b4b437ecb60c1fa72a7f83fbb67e1ddfcd225194eedda77034c72f8c752c642c

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\images.jpg
                                                                                                                                                        Filesize

                                                                                                                                                        13KB

                                                                                                                                                        MD5

                                                                                                                                                        49f4fe0c8646909c7cf87adf68d896fd

                                                                                                                                                        SHA1

                                                                                                                                                        9193264c38e5ed9fa0f5be1d79f802cf946a74cf

                                                                                                                                                        SHA256

                                                                                                                                                        9292dfcddc9e88e5dbc095ceeb83ce23400a3405a4d47fffc80656941c87d5ec

                                                                                                                                                        SHA512

                                                                                                                                                        9df4db8c958110cea66f627170919346ed673d3c13aa55292484fc74ebac2864b0292cd4d66d35957b4b2740b2fe30ddfb9d9e04115d655fb58bf39e100d285e

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\nuggets.webp
                                                                                                                                                        Filesize

                                                                                                                                                        32KB

                                                                                                                                                        MD5

                                                                                                                                                        e40209599b592630dcac551daeb6b849

                                                                                                                                                        SHA1

                                                                                                                                                        851150b573f94f07e459c320d72505e52c3e74f0

                                                                                                                                                        SHA256

                                                                                                                                                        3c9aefa00fb2073763e807a7eccac687dcc26598f68564e9f9cf9ffdcd90a2be

                                                                                                                                                        SHA512

                                                                                                                                                        6da5895f2833a18ddb58ba4a9e78dd0b3047475cae248e974dc45d839f02c62772a6ba6dfe51dd9a37f29b7ec9780e799f60f0e476655006dec693164e17eec2

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\rckdck.exe
                                                                                                                                                        Filesize

                                                                                                                                                        6.2MB

                                                                                                                                                        MD5

                                                                                                                                                        a79fb1a90fb3d92cf815f2c08d3ade6d

                                                                                                                                                        SHA1

                                                                                                                                                        25e5e553af5e2d21b5cfc70ba41afb65202f6fd5

                                                                                                                                                        SHA256

                                                                                                                                                        43759b0c441fd4f71fe5eeb69f548cd2eb40ac0abfa02ea3afc44fbddf28dc16

                                                                                                                                                        SHA512

                                                                                                                                                        82aa45337987c4f344361037c6ca8cf4fbf0fc1e5079ac03f54f3184354792965f6f3b28bd2ab7b511d21f29859e2832fc6b6122a49ddecde12afc7e26fd62dd

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\stopwatch.exe
                                                                                                                                                        Filesize

                                                                                                                                                        68KB

                                                                                                                                                        MD5

                                                                                                                                                        338a4b68d3292aa22049a22e9292e2a2

                                                                                                                                                        SHA1

                                                                                                                                                        9595e6f6d5e18a3e71d623ac4012e7633b020b29

                                                                                                                                                        SHA256

                                                                                                                                                        490d833205f9dfe4f1950d40c845489aa2d2039a77ab10473384986f8442ea6f

                                                                                                                                                        SHA512

                                                                                                                                                        06bc6463b65508d050c945d5bf08078eecd6982c74c7bab2a6722b99523189d24f530c10c05577e0dbd5b46e896d472112d036023ef5e576e2a8f9401b8668a5

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\t.exe
                                                                                                                                                        Filesize

                                                                                                                                                        62KB

                                                                                                                                                        MD5

                                                                                                                                                        9e0c60453cdea093fa4c6762f9b1fda9

                                                                                                                                                        SHA1

                                                                                                                                                        02dfa74e42739c4e8a9a0534273f6a89b51f1dd3

                                                                                                                                                        SHA256

                                                                                                                                                        269c6da90935306778f4f76005d1f00b49703f8819b60e2764cc14a5abc9a781

                                                                                                                                                        SHA512

                                                                                                                                                        fc499cb6b98529c7a856c9ec7198f2a6d00d0c0d6b16e826913ab8dca2602f6700e3956749d3316484b94e6867f54cf99aa77f23375ea6c5ea75daa88c91aa96

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_a36ccf5fb6bc5c1342371a21b33a6f0c_cobalt-strike_cobaltstrike_hijackloader_karagany_mafia_poet-rat_2d713c1f-35f0-4d2e-a8a8-83e649b3fe8e\telamon.exe
                                                                                                                                                        Filesize

                                                                                                                                                        2.3MB

                                                                                                                                                        MD5

                                                                                                                                                        6a80889e81911157ca27df5bc5ac2e09

                                                                                                                                                        SHA1

                                                                                                                                                        02ac28dd7124317e294fac847a05b69411c9cdb2

                                                                                                                                                        SHA256

                                                                                                                                                        0b74c13914f712fce5bb41c25a443c4214a97792bdbb6fea05b98350901405ff

                                                                                                                                                        SHA512

                                                                                                                                                        329ec105834f4531386090074994e5c4ddbdaf4cc4801956b675e258e9167f9e70cf31b8d636d119b59b57af0912decdc259d12999842008cec807a967c89aef

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8D067C87\setup.exe
                                                                                                                                                        Filesize

                                                                                                                                                        6.4MB

                                                                                                                                                        MD5

                                                                                                                                                        defd30ea336650cc29c0c79fad6fa6b5

                                                                                                                                                        SHA1

                                                                                                                                                        935d871ed86456c6dd3c83136dc2d1bda5988ff3

                                                                                                                                                        SHA256

                                                                                                                                                        015a13bd912728e463df6807019b1914dffc3e6735830472e3287150a02e13f4

                                                                                                                                                        SHA512

                                                                                                                                                        8c6ebbf398fb44ff2254db5a7a2ffbc8803120fa93fa6b72c356c6e8eca45935ab973fe3c90d52d5a7691365caf5b41fe2702b6c76a61a0726faccc392c40e54

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2409170406427801248.dll
                                                                                                                                                        Filesize

                                                                                                                                                        5.9MB

                                                                                                                                                        MD5

                                                                                                                                                        640ed3115c855d32ee1731c54702eab7

                                                                                                                                                        SHA1

                                                                                                                                                        1ac749b52794cbadfec8d9219530e9a79fc9427c

                                                                                                                                                        SHA256

                                                                                                                                                        29b4cabc7a0e9dffbc2395b976749be0aad88357dd3b1d7e0cfc9b0c645421a3

                                                                                                                                                        SHA512

                                                                                                                                                        bebe55fdbb363b78c4a6371304f65b89e03a03cee5a8ebceee1681261d8df64a0de36888ed763c3a607ae2732ab54e2e41edb624f37a7fdf8755c40e6bb96f53

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mimk1fs.3r1.ps1
                                                                                                                                                        Filesize

                                                                                                                                                        60B

                                                                                                                                                        MD5

                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                        SHA1

                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                        SHA256

                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                        SHA512

                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\idp.dll
                                                                                                                                                        Filesize

                                                                                                                                                        232KB

                                                                                                                                                        MD5

                                                                                                                                                        55c310c0319260d798757557ab3bf636

                                                                                                                                                        SHA1

                                                                                                                                                        0892eb7ed31d8bb20a56c6835990749011a2d8de

                                                                                                                                                        SHA256

                                                                                                                                                        54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

                                                                                                                                                        SHA512

                                                                                                                                                        e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-7QK2U.tmp\tt-installer-helper.exe
                                                                                                                                                        Filesize

                                                                                                                                                        404KB

                                                                                                                                                        MD5

                                                                                                                                                        5b4c8e63be988b83b09e13e9d1d74bb9

                                                                                                                                                        SHA1

                                                                                                                                                        bcb242f54ee83f232df6b871aebc0f3d44e434c6

                                                                                                                                                        SHA256

                                                                                                                                                        8ae877bd5f45975d827280bee2e19021c3401b5ba069df0e556f6911798adb4d

                                                                                                                                                        SHA512

                                                                                                                                                        a31f9e24a4a27847516808b24f312d4df6b865eb421f84d8d4fc022bdb309e08e5648c52c13772a48456c578f3771d232539c7d30132a82a08e8ebbabcbffa0b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-9SQ4C.tmp\is-MO2E2.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        659KB

                                                                                                                                                        MD5

                                                                                                                                                        5aa68bb2bf3b994bda93834ad34e7963

                                                                                                                                                        SHA1

                                                                                                                                                        0156732d5dd48feacfab3aa07764061d73b9116c

                                                                                                                                                        SHA256

                                                                                                                                                        a90bfd9874c3e60650dba4c286b97ccdb375a456b95556feb38f3cba214770aa

                                                                                                                                                        SHA512

                                                                                                                                                        e52fecbba96aa911552ef0e11d5d044ec44caf6e0947f64c9a17b04d846a3e86d19e4dfa5ac981fc98d44f941fda3a697c1d23ac6e8ef162f4bcdde9142f22f7

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-A83RS.tmp\butdes.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        688KB

                                                                                                                                                        MD5

                                                                                                                                                        c765336f0dcf4efdcc2101eed67cd30c

                                                                                                                                                        SHA1

                                                                                                                                                        fa0279f59738c5aa3b6b20106e109ccd77f895a7

                                                                                                                                                        SHA256

                                                                                                                                                        c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

                                                                                                                                                        SHA512

                                                                                                                                                        06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nseE91A.tmp\CR.History.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        160KB

                                                                                                                                                        MD5

                                                                                                                                                        f310cf1ff562ae14449e0167a3e1fe46

                                                                                                                                                        SHA1

                                                                                                                                                        85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                                                                                        SHA256

                                                                                                                                                        e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                                                                                        SHA512

                                                                                                                                                        1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nseE91A.tmp\CR.History.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        124KB

                                                                                                                                                        MD5

                                                                                                                                                        6cc1665df819088de81854feb0ccc5e8

                                                                                                                                                        SHA1

                                                                                                                                                        cbce30eecb9132b2a0e230e386b0fc9b073a339f

                                                                                                                                                        SHA256

                                                                                                                                                        e22c3437de9707c1e3014b7485825c7c511d4fb7817da31a69da64d08351842c

                                                                                                                                                        SHA512

                                                                                                                                                        01d98138f02c40e616839a80c99a9d090552b8f5ffe626b460f47aa921695e8ace6b6607c2ca67d43bee6dd8ce848bddc94cd12f1d0eef512991d28e65b6960b

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nseE91A.tmp\FF.places.tmp
                                                                                                                                                        Filesize

                                                                                                                                                        5.0MB

                                                                                                                                                        MD5

                                                                                                                                                        1e82b3787b23061611482cee72145da7

                                                                                                                                                        SHA1

                                                                                                                                                        83c11287d68a6f1e5cbb9b39755a85686257fd22

                                                                                                                                                        SHA256

                                                                                                                                                        e86af9a8d23096ac222c9d8416698c962074a9d367abb96680a1bf6c27b619ba

                                                                                                                                                        SHA512

                                                                                                                                                        729268b632b1ce38eb48bea4bd781e886ce04adda5e6ac2608de7023e1ab9e06e7fc304627f9b26e344c42fff603f49713758406002b600e7f844a0541659748

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nseE91A.tmp\Midex.dll
                                                                                                                                                        Filesize

                                                                                                                                                        126KB

                                                                                                                                                        MD5

                                                                                                                                                        2597a829e06eb9616af49fcd8052b8bd

                                                                                                                                                        SHA1

                                                                                                                                                        871801aba3a75f95b10701f31303de705cb0bc5a

                                                                                                                                                        SHA256

                                                                                                                                                        7359ca1befdb83d480fc1149ac0e8e90354b5224db7420b14b2d96d87cd20a87

                                                                                                                                                        SHA512

                                                                                                                                                        8e5552b2f6e1c531aaa9fd507aa53c6e3d2f1dd63fe19e6350c5b6fbb009c99d353bb064a9eba4c31af6a020b31c0cd519326d32db4c8b651b83952e265ffb35

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nseE91A.tmp\thirdparty.dll
                                                                                                                                                        Filesize

                                                                                                                                                        93KB

                                                                                                                                                        MD5

                                                                                                                                                        7b4bd3b8ad6e913952f8ed1ceef40cd4

                                                                                                                                                        SHA1

                                                                                                                                                        b15c0b90247a5066bd06d094fa41a73f0f931cb8

                                                                                                                                                        SHA256

                                                                                                                                                        a49d3e455d7aeca2032c30fc099bfad1b1424a2f55ec7bb0f6acbbf636214754

                                                                                                                                                        SHA512

                                                                                                                                                        d7168f9504dd6bbac7ee566c3591bfd7ad4e55bcac463cecb70540197dfe0cd969af96d113c6709d6c8ce6e91f2f5f6542a95c1a149caa78ba4bcb971e0c12a2

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsuD0FE.tmp\JsisPlugins.dll
                                                                                                                                                        Filesize

                                                                                                                                                        2.1MB

                                                                                                                                                        MD5

                                                                                                                                                        d21ae3f86fc69c1580175b7177484fa7

                                                                                                                                                        SHA1

                                                                                                                                                        2ed2c1f5c92ff6daa5ea785a44a6085a105ae822

                                                                                                                                                        SHA256

                                                                                                                                                        a6241f168cacb431bfcd4345dd77f87b378dd861b5d440ae8d3ffd17b9ceb450

                                                                                                                                                        SHA512

                                                                                                                                                        eda08b6ebdb3f0a3b6b43ef755fc275396a8459b8fc8a41eff55473562c394d015e5fe573b3b134eeed72edff2b0f21a3b9ee69a4541fd9738e880b71730303f

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsuD0FE.tmp\StdUtils.dll
                                                                                                                                                        Filesize

                                                                                                                                                        195KB

                                                                                                                                                        MD5

                                                                                                                                                        34939c7b38bffedbf9b9ed444d689bc9

                                                                                                                                                        SHA1

                                                                                                                                                        81d844048f7b11cafd7561b7242af56e92825697

                                                                                                                                                        SHA256

                                                                                                                                                        b127f3e04429d9f841a03bfd9344a0450594004c770d397fb32a76f6b0eabed0

                                                                                                                                                        SHA512

                                                                                                                                                        bc1b347986a5d2107ad03b65e4b9438530033975fb8cc0a63d8ef7d88c1a96f70191c727c902eb7c3e64aa5de9ce6bb04f829ceb627eda278f44ca3dd343a953

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsuD0FE.tmp\jsis.dll
                                                                                                                                                        Filesize

                                                                                                                                                        127KB

                                                                                                                                                        MD5

                                                                                                                                                        2027121c3cdeb1a1f8a5f539d1fe2e28

                                                                                                                                                        SHA1

                                                                                                                                                        bcf79f49f8fc4c6049f33748ded21ec3471002c2

                                                                                                                                                        SHA256

                                                                                                                                                        1dae8b6de29f2cfc0745d9f2a245b9ecb77f2b272a5b43de1ba5971c43bf73a1

                                                                                                                                                        SHA512

                                                                                                                                                        5b0d9966ecc08bcc2c127b2bd916617b8de2dcbdc28aff7b4b8449a244983bfbe33c56f5c4a53b7cf21faf1dbab4bb845a5894492e7e10f3f517071f7a59727c

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsuD0FE.tmp\nsJSON.dll
                                                                                                                                                        Filesize

                                                                                                                                                        36KB

                                                                                                                                                        MD5

                                                                                                                                                        f840a9ddd319ee8c3da5190257abde5b

                                                                                                                                                        SHA1

                                                                                                                                                        3e868939239a5c6ef9acae10e1af721e4f99f24b

                                                                                                                                                        SHA256

                                                                                                                                                        ddb6c9f8de72ddd589f009e732040250b2124bca6195aa147aa7aac43fc2c73a

                                                                                                                                                        SHA512

                                                                                                                                                        8e12391027af928e4f7dad1ec4ab83e8359b19a7eb0be0372d051dfd2dd643dc0dfa086bd345760a496e5630c17f53db22f6008ae665033b766cbfcdd930881a

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{113D98C8-F185-4159-883D-FD0720761A1F}\scrt.dll
                                                                                                                                                        Filesize

                                                                                                                                                        5.7MB

                                                                                                                                                        MD5

                                                                                                                                                        f36f05628b515262db197b15c7065b40

                                                                                                                                                        SHA1

                                                                                                                                                        74a8005379f26dd0de952acab4e3fc5459cde243

                                                                                                                                                        SHA256

                                                                                                                                                        67abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31

                                                                                                                                                        SHA512

                                                                                                                                                        280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\TESAYt.exe
                                                                                                                                                        Filesize

                                                                                                                                                        934KB

                                                                                                                                                        MD5

                                                                                                                                                        f7f32729079353000cd97b90aa314cc1

                                                                                                                                                        SHA1

                                                                                                                                                        21dbddeea2b634263c8fbf0d6178a9751d2467b8

                                                                                                                                                        SHA256

                                                                                                                                                        8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212

                                                                                                                                                        SHA512

                                                                                                                                                        2c40c12b81e7c377ddf0a6691ebeedc895dcf02c9211a1563b840de735fab77968565b1d3d0c40cc0b2b583fd4bfa1c69f995fca758ea85f548bf5797b5bf847

                                                                                                                                                        Download Submit

                                                                                                                                                      • C:\Windows\System\mRNihfJ.exe
                                                                                                                                                        Filesize

                                                                                                                                                        5.2MB

                                                                                                                                                        MD5

                                                                                                                                                        01f1300576b992743edf66d03422b1cf

                                                                                                                                                        SHA1

                                                                                                                                                        436c8cf2b30098a0fff303f9536064b8b399777d

                                                                                                                                                        SHA256

                                                                                                                                                        d21449a13489d1d091e24c1591997b3f131c6f692a6a3088fe77780c671678d9

                                                                                                                                                        SHA512

                                                                                                                                                        3904340aa6186f454d7e538ac4554b802c35e2ffba723a08fba59ea285ec81f431e8395abce1b5e3f42abeca9aa24d763a284b4d3493e821657ab8d5759268da

                                                                                                                                                        Download Submit

                                                                                                                                                      • memory/232-53-0x0000000005220000-0x00000000052BC000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        624KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/232-54-0x00000000053F0000-0x0000000005482000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        584KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/232-51-0x0000000074400000-0x0000000074BB0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        7.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/232-58-0x0000000005580000-0x00000000055D6000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        344KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/232-52-0x00000000007E0000-0x00000000009D2000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.9MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/232-220-0x0000000074400000-0x0000000074BB0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        7.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/232-56-0x0000000074400000-0x0000000074BB0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        7.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/232-57-0x0000000005320000-0x000000000532A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        40KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/748-442-0x0000000000400000-0x00000000004B4000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        720KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1004-180-0x0000000074400000-0x0000000074BB0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        7.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1004-2155-0x0000000074400000-0x0000000074BB0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        7.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1004-1-0x0000000000890000-0x00000000008DA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        296KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1004-2-0x0000000001410000-0x0000000001434000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1004-0-0x000000007440E000-0x000000007440F000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1004-3-0x0000000074400000-0x0000000074BB0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        7.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1004-161-0x000000007440E000-0x000000007440F000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1004-4-0x0000000005900000-0x0000000005EA4000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        5.6MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1240-295-0x0000000000400000-0x00000000004BC000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        752KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1592-155-0x0000000000400000-0x0000000000413000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        76KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/1592-441-0x0000000000400000-0x0000000000413000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        76KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2084-2290-0x0000000005770000-0x0000000005AC4000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2084-2300-0x00000000060C0000-0x000000000610C000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        304KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2456-293-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2456-74-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3372-2210-0x00007FF7E9280000-0x00007FF7E95D1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3372-2354-0x00007FF7E9280000-0x00007FF7E95D1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3504-2237-0x00007FF678050000-0x00007FF6783A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-582-0x00000000077E0000-0x0000000007812000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        200KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-513-0x0000000006620000-0x000000000663E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        120KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-678-0x0000000007B50000-0x0000000007B61000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        68KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-651-0x00000000079B0000-0x00000000079BA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        40KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-585-0x00000000673F0000-0x000000006743C000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        304KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-410-0x0000000005F80000-0x0000000005FE6000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        408KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-642-0x0000000007FA0000-0x000000000861A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        6.5MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-643-0x0000000007950000-0x000000000796A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        104KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-1052-0x0000000007B80000-0x0000000007B8E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-1062-0x0000000007B90000-0x0000000007BA4000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-1071-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        104KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-1076-0x0000000007BD0000-0x0000000007BD8000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        32KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-595-0x0000000006C00000-0x0000000006C1E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        120KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-409-0x0000000005F10000-0x0000000005F76000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        408KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-598-0x0000000007820000-0x00000000078C3000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        652KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-670-0x0000000007BE0000-0x0000000007C76000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        600KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-514-0x0000000006AD0000-0x0000000006B1C000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        304KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-408-0x0000000005D70000-0x0000000005D92000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        136KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3656-414-0x0000000006030000-0x0000000006384000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3688-2350-0x00007FF66C250000-0x00007FF66C5A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3688-2193-0x00007FF66C250000-0x00007FF66C5A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3892-2220-0x00007FF6A88A0000-0x00007FF6A8BF1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3892-2361-0x00007FF6A88A0000-0x00007FF6A8BF1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3912-294-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/3912-67-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4148-2280-0x0000000000400000-0x0000000000440000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        256KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4148-2331-0x00000000063B0000-0x0000000006400000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        320KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4524-296-0x0000000000400000-0x00000000004BC000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        752KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/4864-515-0x0000000000400000-0x00000000004ED000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        948KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5020-365-0x00000000058C0000-0x0000000005EE8000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        6.2MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5020-364-0x00000000030B0000-0x00000000030E6000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        216KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5020-599-0x00000000673F0000-0x000000006743C000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        304KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5168-632-0x00000000673F0000-0x000000006743C000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        304KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5184-516-0x0000000000400000-0x0000000000729000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.2MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5200-2240-0x00007FF6143A0000-0x00007FF6146F1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5220-2352-0x00007FF6812D0000-0x00007FF681621000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5220-2238-0x00007FF6812D0000-0x00007FF681621000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5244-258-0x00007FF6C9550000-0x00007FF6C9576000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        152KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5360-2228-0x00007FF7CFD20000-0x00007FF7D0071000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5416-260-0x00007FF638320000-0x00007FF638346000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        152KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5580-2224-0x00007FF60A040000-0x00007FF60A391000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5620-2226-0x00007FF6C2100000-0x00007FF6C2451000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5680-2236-0x00007FF6672A0000-0x00007FF6675F1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5732-359-0x0000000005F10000-0x0000000005F18000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        32KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5732-366-0x0000000005E90000-0x0000000005EC8000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        224KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5732-367-0x0000000005E70000-0x0000000005E7E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5732-279-0x0000000000960000-0x000000000097C000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        112KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5856-2218-0x00007FF7293C0000-0x00007FF729711000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/5856-2358-0x00007FF7293C0000-0x00007FF729711000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6040-2231-0x00007FF7C2560000-0x00007FF7C28B1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6100-548-0x00007FF7AC4D0000-0x00007FF7AC4F9000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        164KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6100-249-0x00007FF7AC4D0000-0x00007FF7AC4F9000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        164KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6128-563-0x00007FF7D0F00000-0x00007FF7D0F27000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        156KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6128-253-0x00007FF7D0F00000-0x00007FF7D0F27000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        156KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6260-2131-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        88KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6260-2130-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        88KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6372-1359-0x0000000000320000-0x00000000006DB000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6372-631-0x0000000000320000-0x00000000006DB000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.7MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6452-2177-0x00007FF6BE850000-0x00007FF6BEBA1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6452-2270-0x00007FF6BE850000-0x00007FF6BEBA1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6576-2233-0x00007FF6CAD40000-0x00007FF6CB091000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6576-2362-0x00007FF6CAD40000-0x00007FF6CB091000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6580-2229-0x00007FF674E90000-0x00007FF6751E1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6600-2215-0x00007FF7522E0000-0x00007FF752631000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6600-2356-0x00007FF7522E0000-0x00007FF752631000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6624-2239-0x00007FF74CA70000-0x00007FF74CDC1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6664-2232-0x00007FF6D1730000-0x00007FF6D1A81000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6776-2235-0x00007FF668830000-0x00007FF668B81000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6792-2234-0x0000000005880000-0x0000000005890000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6792-2133-0x0000000000C30000-0x0000000000D1A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        936KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6792-2271-0x0000000006EE0000-0x0000000006F62000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        520KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6808-2245-0x00007FF7FA640000-0x00007FF7FA991000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6808-2124-0x00007FF7FA640000-0x00007FF7FA991000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6808-2134-0x0000027F2D150000-0x0000027F2D160000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6820-2219-0x00007FF6F1E50000-0x00007FF6F21A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6876-2260-0x0000000000400000-0x0000000000451000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        324KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6876-2125-0x0000000000400000-0x0000000000451000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        324KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6980-2128-0x0000000002630000-0x0000000002652000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        136KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6980-2126-0x0000000000200000-0x00000000003A2000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.6MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/6980-2127-0x0000000004DA0000-0x0000000004E82000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        904KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/7060-2348-0x00007FF7EDE80000-0x00007FF7EE1D1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/7060-2266-0x00007FF7EDE80000-0x00007FF7EE1D1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/7060-2156-0x00007FF7EDE80000-0x00007FF7EE1D1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.3MB

                                                                                                                                                        Download