Overview

overview

10

Static

static

10

08751be484...2d.dll

windows7-x64

10

08751be484...2d.dll

windows10-2004-x64

10

0a9f79abd4...51.exe

windows7-x64

3

0a9f79abd4...51.exe

windows10-2004-x64

3

0di3x.exe

windows7-x64

10

0di3x.exe

windows10-2004-x64

10

4a30275f14...ab.dll

windows7-x64

10

4a30275f14...ab.dll

windows10-2004-x64

10

2019-09-02...10.exe

windows7-x64

10

2019-09-02...10.exe

windows10-2004-x64

10

2c01b00772...eb.exe

windows7-x64

7

2c01b00772...eb.exe

windows10-2004-x64

7

31.exe

windows7-x64

10

31.exe

windows10-2004-x64

10

3DMark 11 ...on.exe

windows7-x64

3

3DMark 11 ...on.exe

windows10-2004-x64

3

42f9729255...61.exe

windows7-x64

10

42f9729255...61.exe

windows10-2004-x64

10

5da0116af4...18.exe

windows7-x64

7

5da0116af4...18.exe

windows10-2004-x64

10

c2716fcc73...86.exe

windows7-x64

10

c2716fcc73...86.exe

windows10-2004-x64

10

69c56d12ed...6b.exe

windows7-x64

10

69c56d12ed...6b.exe

windows10-2004-x64

10

905d572f23...50.exe

windows7-x64

10

905d572f23...50.exe

windows10-2004-x64

10

948340be97...54.exe

windows7-x64

10

948340be97...54.exe

windows10-2004-x64

10

95560f1a46...f9.dll

windows7-x64

3

95560f1a46...f9.dll

windows10-2004-x64

3

Archive.zi...3e.exe

windows7-x64

8

Archive.zi...3e.exe

windows10-2004-x64

8

Resubmissions

14-12-2024 07:51

241214-jqcj1sxnhr 10

11-12-2024 15:39

241211-s3498stkar 10

07-12-2024 20:12

241207-yy4qsswqej 10

Analysis

  • max time kernel
    150s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2024 15:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    31.exe

  • Size

    12.5MB

  • MD5

    af8e86c5d4198549f6375df9378f983c

  • SHA1

    7ab5ed449b891bd4899fba62d027a2cc26a05e6f

  • SHA256

    7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267

  • SHA512

    137f5a281aa15802e300872fdf93b9ee014d2077c29d30e5a029664eb0991af2afbe1e5c53a9d7bff8f0508393a8b7641c5a97b4b0e0061befb79a93506c94e1

  • SSDEEP

    393216:oKzkshyIMtAcwzhQ/CceAocPwz3fwnjWKlDc8F6tB:BzkmSmzS/Be/cPquj7D36r

Score
10/10
agenttesladharmaformbookgoziqakbotraccoon86920224w9zagilenetbankercryptonedefense_evasiondiscoveryexecutionimpactkeyloggerpackerpersistenceransomwareratrezer0rm3spywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.0

Campaign

w9z

Decoy

crazzysex.com

hanferd.com

gteesrd.com

bayfrontbabyplace.com

jicuiquan.net

relationshiplink.net

ohchacyberphoto.com

kauegimenes.com

powerful-seldom.com

ketotoken.com

make-money-online-success.com

redgoldcollection.com

hannan-football.com

hamptondc.com

vllii.com

aa8520.com

platform35markethall.com

larozeimmo.com

oligopoly.net

llhak.info

Extracted

Family

gozi

Attributes
  • exe_type

    loader

Extracted

Family

gozi

Botnet

86920224

C2

https://sibelikinciel.xyz

Attributes
  • build

    300869

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
serpent.plain

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook family
    formbook
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Gozi family
    gozi
  • Qakbot family
    qakbot
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 2 IoCs
  • Raccoon family
    raccoon
  • AgentTesla payload 5 IoCs
  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Formbook payload 2 IoCs
    rat
  • ReZer0 packer 3 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Renames multiple (89) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Blocklisted process makes network request 20 IoCs
  • Drops file in Drivers directory 1 IoCs
  • System Binary Proxy Execution: InstallUtil 1 TTPs 2 IoCs

    Abuse InstallUtil to proxy execution of malicious code.

    defense_evasion
  • Checks QEMU agent file 2 TTPs 14 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 41 IoCs
  • Loads dropped DLL 64 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Drops desktop.ini file(s) 13 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious use of SetThreadContext 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\31.exe
      "C:\Users\Admin\AppData\Local\Temp\31.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\system32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\10D2.tmp\10D3.tmp\10D4.bat C:\Users\Admin\AppData\Local\Temp\31.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Program Files\Java\jre7\bin\javaw.exe
          "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"
          4⤵
            PID:2900
          • C:\Users\Admin\AppData\Roaming\2.exe
            C:\Users\Admin\AppData\Roaming\2.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2924
            • C:\Users\Admin\AppData\Roaming\2.exe
              C:\Users\Admin\AppData\Roaming\2.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:2120
          • C:\Users\Admin\AppData\Roaming\3.exe
            C:\Users\Admin\AppData\Roaming\3.exe
            4⤵
            • Checks QEMU agent file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            PID:2256
            • C:\Users\Admin\AppData\Roaming\3.exe
              C:\Users\Admin\AppData\Roaming\3.exe
              5⤵
              • Checks QEMU agent file
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:1576
          • C:\Users\Admin\AppData\Roaming\4.exe
            C:\Users\Admin\AppData\Roaming\4.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:544
            • C:\Windows\SysWOW64\regsvr32.exe
              C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@544
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3732
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f0
                6⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:3624
          • C:\Users\Admin\AppData\Roaming\5.exe
            C:\Users\Admin\AppData\Roaming\5.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2620
          • C:\Users\Admin\AppData\Roaming\6.exe
            C:\Users\Admin\AppData\Roaming\6.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:1244
          • C:\Users\Admin\AppData\Roaming\7.exe
            C:\Users\Admin\AppData\Roaming\7.exe
            4⤵
            • Checks QEMU agent file
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious use of SetWindowsHookEx
            PID:1548
          • C:\Users\Admin\AppData\Roaming\8.exe
            C:\Users\Admin\AppData\Roaming\8.exe
            4⤵
            • System Binary Proxy Execution: InstallUtil
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:872
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1596
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
                6⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:3584
            • C:\Users\Admin\AppData\Roaming\feeed.exe
              "C:\Users\Admin\AppData\Roaming\feeed.exe"
              5⤵
              • System Binary Proxy Execution: InstallUtil
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2756
              • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4540
          • C:\Users\Admin\AppData\Roaming\9.exe
            C:\Users\Admin\AppData\Roaming\9.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2876
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2EED.tmp"
              5⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3060
            • C:\Users\Admin\AppData\Roaming\9.exe
              "{path}"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4944
          • C:\Users\Admin\AppData\Roaming\10.exe
            C:\Users\Admin\AppData\Roaming\10.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:1012
          • C:\Users\Admin\AppData\Roaming\11.exe
            C:\Users\Admin\AppData\Roaming\11.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:1724
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
              dw20.exe -x -s 476
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1760
          • C:\Users\Admin\AppData\Roaming\12.exe
            C:\Users\Admin\AppData\Roaming\12.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:536
          • C:\Users\Admin\AppData\Roaming\13.exe
            C:\Users\Admin\AppData\Roaming\13.exe
            4⤵
            • Checks QEMU agent file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            PID:332
            • C:\Users\Admin\AppData\Roaming\13.exe
              C:\Users\Admin\AppData\Roaming\13.exe
              5⤵
              • Checks QEMU agent file
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:3332
              • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
                "C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"
                6⤵
                • Checks QEMU agent file
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                PID:3764
                • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
                  "C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"
                  7⤵
                  • Checks QEMU agent file
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:3984
          • C:\Users\Admin\AppData\Roaming\14.exe
            C:\Users\Admin\AppData\Roaming\14.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:2972
          • C:\Users\Admin\AppData\Roaming\15.exe
            C:\Users\Admin\AppData\Roaming\15.exe
            4⤵
            • Checks QEMU agent file
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious use of SetWindowsHookEx
            PID:2036
          • C:\Users\Admin\AppData\Roaming\16.exe
            C:\Users\Admin\AppData\Roaming\16.exe
            4⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops desktop.ini file(s)
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious behavior: EnumeratesProcesses
            PID:1256
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              5⤵
                PID:1824
                • C:\Windows\system32\mode.com
                  mode con cp select=1251
                  6⤵
                    PID:3864
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin delete shadows /all /quiet
                    6⤵
                    • Interacts with shadow copies
                    PID:3304
              • C:\Users\Admin\AppData\Roaming\17.exe
                C:\Users\Admin\AppData\Roaming\17.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                PID:1004
              • C:\Users\Admin\AppData\Roaming\18.exe
                C:\Users\Admin\AppData\Roaming\18.exe
                4⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:2112
              • C:\Users\Admin\AppData\Roaming\19.exe
                C:\Users\Admin\AppData\Roaming\19.exe
                4⤵
                • Checks QEMU agent file
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of SetWindowsHookEx
                PID:1944
              • C:\Users\Admin\AppData\Roaming\20.exe
                C:\Users\Admin\AppData\Roaming\20.exe
                4⤵
                • Checks QEMU agent file
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of SetWindowsHookEx
                PID:1056
              • C:\Users\Admin\AppData\Roaming\21.exe
                C:\Users\Admin\AppData\Roaming\21.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                PID:956
                • C:\Users\Admin\AppData\Roaming\21.exe
                  "{path}"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1248
              • C:\Users\Admin\AppData\Roaming\22.exe
                C:\Users\Admin\AppData\Roaming\22.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1988
              • C:\Users\Admin\AppData\Roaming\23.exe
                C:\Users\Admin\AppData\Roaming\23.exe
                4⤵
                • Checks QEMU agent file
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of SetWindowsHookEx
                PID:1088
              • C:\Users\Admin\AppData\Roaming\24.exe
                C:\Users\Admin\AppData\Roaming\24.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1696
                • C:\Users\Admin\AppData\Roaming\24.exe
                  "{path}"
                  5⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3952
              • C:\Users\Admin\AppData\Roaming\25.exe
                C:\Users\Admin\AppData\Roaming\25.exe
                4⤵
                • Checks QEMU agent file
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of SetWindowsHookEx
                PID:884
              • C:\Users\Admin\AppData\Roaming\26.exe
                C:\Users\Admin\AppData\Roaming\26.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1544
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2DE4.tmp"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:5068
                • C:\Users\Admin\AppData\Roaming\26.exe
                  "{path}"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4604
              • C:\Users\Admin\AppData\Roaming\27.exe
                C:\Users\Admin\AppData\Roaming\27.exe
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious behavior: EnumeratesProcesses
                PID:1792
                • C:\Users\Admin\AppData\Roaming\27.exe
                  C:\Users\Admin\AppData\Roaming\27.exe /C
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3828
                • C:\Users\Admin\AppData\Roaming\Microsoft\Errce\rpyae.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Errce\rpyae.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: MapViewOfSection
                  PID:3584
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Errce\rpyae.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Errce\rpyae.exe /C
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3448
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2724
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fzxykpt /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I fzxykpt" /SC ONCE /Z /ST 15:19 /ET 15:31
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:4028
              • C:\Users\Admin\AppData\Roaming\28.exe
                C:\Users\Admin\AppData\Roaming\28.exe
                4⤵
                • Checks QEMU agent file
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of SetWindowsHookEx
                PID:2488
              • C:\Users\Admin\AppData\Roaming\29.exe
                C:\Users\Admin\AppData\Roaming\29.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                PID:2932
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@2932
                  5⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1036
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f0
                    6⤵
                    • Blocklisted process makes network request
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3808
              • C:\Users\Admin\AppData\Roaming\30.exe
                C:\Users\Admin\AppData\Roaming\30.exe
                4⤵
                • Drops startup file
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2592
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3424
              • C:\Users\Admin\AppData\Roaming\31.exe
                C:\Users\Admin\AppData\Roaming\31.exe
                4⤵
                • Checks QEMU agent file
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of SetWindowsHookEx
                PID:2272
          • C:\Windows\SysWOW64\autoconv.exe
            "C:\Windows\SysWOW64\autoconv.exe"
            2⤵
              PID:1040
            • C:\Windows\SysWOW64\raserver.exe
              "C:\Windows\SysWOW64\raserver.exe"
              2⤵
              • Adds policy Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:988
              • C:\Windows\SysWOW64\cmd.exe
                /c del "C:\Users\Admin\AppData\Roaming\2.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2196
            • C:\Windows\SysWOW64\wscript.exe
              "C:\Windows\SysWOW64\wscript.exe"
              2⤵
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:3428
              • C:\Windows\SysWOW64\cmd.exe
                /c del "C:\Users\Admin\AppData\Roaming\18.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:3760
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3788
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {95369C51-C270-4439-8AC3-BE0F2AB8D89B} S-1-5-18:NT AUTHORITY\System:Service:
            1⤵
              PID:1588

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Windows Management Instrumentation

            1
            T1047

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Direct Volume Access

            1
            T1006

            Indicator Removal

            2
            T1070

            File Deletion

            2
            T1070.004

            Modify Registry

            3
            T1112

            System Binary Proxy Execution

            1
            T1218

            InstallUtil

            1
            T1218.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Inhibit System Recovery

            2
            T1490

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\10D2.tmp\10D3.tmp\10D4.bat
              Filesize

              755B

              MD5

              ba36077af307d88636545bc8f585d208

              SHA1

              eafa5626810541319c01f14674199ab1f38c110c

              SHA256

              bec099c24451b843d1b5331686d5f4a2beff7630d5cd88819446f288983bda10

              SHA512

              933c2e5de3bc180db447e6864d7f0fa01e796d065fcd8f3d714086f49ec2f3ae8964c94695959beacf07d5785b569fd4365b7e999502d4afa060f4b833b68d80

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Cab71E7.tmp
              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Tar7351.tmp
              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\1.jar
              Filesize

              9KB

              MD5

              a5d6701073dbe43510a41e667aaba464

              SHA1

              e3163114e4e9f85ffd41554ac07030ce84238d8c

              SHA256

              1d635c49289d43e71e2b10b10fbb9ea849a59eacedfdb035e25526043351831c

              SHA512

              52f711d102cb50fafefc2a9f2097660b950564ff8e9324471b9bd6b7355321d60152c78f74827b05b6332d140362bd2c638b8c9cdb961431ab5114e01851fbe4

              Download Submit

            • C:\Users\Admin\AppData\Roaming\10.exe
              Filesize

              412KB

              MD5

              68f96da1fc809dccda4235955ca508b0

              SHA1

              f182543199600e029747abb84c4448ac4cafef82

              SHA256

              34b63aa5d2cff68264891f11e8d6875a38ff28854e9723b1db9c154a5abe580c

              SHA512

              8512aa47d9d2062a8943239ab91a533ad0fa2757aac8dba53d240285069ddbbff8456df20c58e063661f7e245cb99ccbb49c6f9a81788d46072d5c8674da40f7

              Download Submit

            • C:\Users\Admin\AppData\Roaming\11.exe
              Filesize

              358KB

              MD5

              9d4da0e623bb9bb818be455b4c5e97d8

              SHA1

              9bc2079b5dd2355f4d98a2fe9879b5db3f2575b0

              SHA256

              091ff5f5bab1cbb2d27a32fedaff1f64dd4004e4a68665e8d606e28585d928a8

              SHA512

              6e6fab5f4a045349717762ff782527e778b40c5f41ce32428c63aea0dd6e8b73bfdaf3ac55474275f716e9f84632906196edafc4337d816055a69b2ea0904e37

              Download Submit

            • C:\Users\Admin\AppData\Roaming\12.exe
              Filesize

              203KB

              MD5

              192830b3974fa27116c067f019747b38

              SHA1

              469fd8a31d9f82438ab37413dae81eb25d275804

              SHA256

              116e5f36546b2ec14aba42ff69f2c9e18ecde3b64abb44797ac9efc6c6472bff

              SHA512

              74ebe5adb71c6669bc39fc9c8359cc6bc9bb1a77f5de8556a1730de23104fe95ec7a086c19f39706286b486314deafd7e043109414fd5ce0584f2fbbc6d0658a

              Download Submit

            • C:\Users\Admin\AppData\Roaming\13.exe
              Filesize

              68KB

              MD5

              349f49be2b024c5f7232f77f3acd4ff6

              SHA1

              515721802486abd76f29ee6ed5b4481579ab88e5

              SHA256

              262d38348a745517600abe0719345c6d17c8705dd3b4d67e7a545a94b9388b60

              SHA512

              a6c9a96c7738f6408c28b1579009167136ce9d3d68deb4c02f57324d800bce284f5d63a9d589651e8ab37b2ac17bf94e9bd59c63aaa3b66f0891e55ba7d646a0

              Download Submit

            • C:\Users\Admin\AppData\Roaming\14.exe
              Filesize

              496KB

              MD5

              9acd34bcff86e2c01bf5e6675f013b17

              SHA1

              59bc42d62fbd99dd0f17dec175ea6c2a168f217a

              SHA256

              384fef8417014b298dca5ae9e16226348bda61198065973537f4907ac2aa1a60

              SHA512

              9de65becdfc9aaab9710651376684ee697015f3a8d3695a5664535d9dfc34f2343ce4209549cbf09080a0b527e78a253f19169d9c6eb6e4d4a03d1b31ded8933

              Download Submit

            • C:\Users\Admin\AppData\Roaming\15.exe
              Filesize

              64KB

              MD5

              d43d9558d37cdac1690fdeec0af1b38d

              SHA1

              98e6dfdd79f43f0971c0eaa58f18bce0e8cbf555

              SHA256

              501c921311164470ca8cb02e66146d8e3f36baa54bfc3ecb3a1a0ed3186ecbc5

              SHA512

              9a357c1bbc153ddc017da08c691730a47ab0ff50834cdc69540ede093d17d432789586d8074a4a8816fb1928a511f2a899362bb03feab16ca231adfdc0004aca

              Download Submit

            • C:\Users\Admin\AppData\Roaming\16.exe
              Filesize

              92KB

              MD5

              56ba37144bd63d39f23d25dae471054e

              SHA1

              088e2aff607981dfe5249ce58121ceae0d1db577

              SHA256

              307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3

              SHA512

              6e086bea3389412f6a9fa11e2caa2887db5128c2ad1030685e6841d7d199b63c6d9a76fb9d1ed9116afd851485501843f72af8366537a8283de2f9ab7f3d56f0

              Download Submit

            • C:\Users\Admin\AppData\Roaming\17.exe
              Filesize

              496KB

              MD5

              15a05615d617394afc0231fc47444394

              SHA1

              d1253f7c5b10e7a46e084329c36f7692b41c6d59

              SHA256

              596566f6cb70d55b1b0978a0fab4cffd5049559545fe7ee2fa3897ccbc46c013

              SHA512

              6deea7c0c3795de7360b11fa04384e0956520a3a7bf5405d411b58487a35bba51eaca51c1e2dda910d4159c22179a9161d84da52193e376dfdf6bdfbe8e9f0f1

              Download Submit

            • C:\Users\Admin\AppData\Roaming\18.exe
              Filesize

              411KB

              MD5

              bf15960dd7174427df765fd9f9203521

              SHA1

              cb1de1df0c3b1a1cc70a28629ac51d67901b17aa

              SHA256

              9187706072f008a27c26421791f57ec33a59b44b012500b2db3eeb48136fb2da

              SHA512

              7e8b9907233234440135f27ad813db97e20790baf8cb92949ae9185fa09cb4b7b0da35b6da2b33f3ac64a33545f32f959d90d73f7a6a4f14988c8ac3fd005074

              Download Submit

            • C:\Users\Admin\AppData\Roaming\19.exe
              Filesize

              64KB

              MD5

              ff96cd537ecded6e76c83b0da2a6d03c

              SHA1

              ec05b49da2f8d74b95560602b39db3943de414cb

              SHA256

              7897571671717742304acde430e5959c09fd9c29fbbe808105f00a1f663927ac

              SHA512

              24a827fda9db76c030852ef2db73c6b75913c9ee55e130a3c9a7c6ff7aff0fb7192ff1c47cd266b91500a04657b2da61a5fc00e48e7fbc27a6cbc9b7d91daa4b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\2.exe
              Filesize

              680KB

              MD5

              715c838e413a37aa8df1ef490b586afd

              SHA1

              4aef3a0036f9d2290f7a6fa5306228abdbc9e6e1

              SHA256

              4c21a70dbc6b9bc5e1ee1e7506ee205eecdb14cc45571423e6bcc86dbe4001e7

              SHA512

              af13c0efb1552bbfbb517e27ff70a00cba5c230e3d2e707bd28a9ccce40e0402793c4ecc32ba1418f19a3744b78b89e5c8709eae3ad5f883c474832c182de861

              Download Submit

            • C:\Users\Admin\AppData\Roaming\20.exe
              Filesize

              64KB

              MD5

              ddcdc714bedffb59133570c3a2b7913f

              SHA1

              d21953fa497a541f185ed87553a7c24ffc8a67ce

              SHA256

              be3e6008dde30cb959b90a332a79931b889216a9483944dc5c0d958dec1b8e46

              SHA512

              a1d728751490c6cf21f9597c6df6f8db857c28d224b2d03e6d25ce8f17557accbd8ef2972369337b9d3305d5b9029001e5300825c23ce826884dcee55b37562c

              Download Submit

            • C:\Users\Admin\AppData\Roaming\21.exe
              Filesize

              388KB

              MD5

              9a7f746e51775ca001efd6ecd6ca57ea

              SHA1

              7ea50de8dd8c82a7673b97bb7ccd665d98de2300

              SHA256

              c4c308629a06c9a4af93fbd747ed2421e2ff2460347352366e51b91d19737400

              SHA512

              20cd6af47a92b396ae565e0a21d3acaa0d3a74bcdccc1506a55dea891da912b03256ba9900c2c089fe44d71210e3c100ba4601cf4d6c9b492a2ce0d323d4c57f

              Download Submit

            • C:\Users\Admin\AppData\Roaming\22.exe
              Filesize

              1.5MB

              MD5

              48e9df7a479e3fd63064ec66e2283a45

              SHA1

              a8dcce44de655a97a3448758b397a37d1f7db549

              SHA256

              c7d8c3c379dcc42fa796b07b6a9155826d39cbd2f264bc68d22a63b17c8ef7df

              SHA512

              6cc839f118cad9982ec998665b409dc297a8cff9b23ec2a9105d15cf58d9adbf46d0048dda76c8e1574f6288d901912b7de373920b68b53dbda43d6075611016

              Download Submit

            • C:\Users\Admin\AppData\Roaming\23.exe
              Filesize

              128KB

              MD5

              0dca3348a8b579a1bfa93b4f5b25cddd

              SHA1

              1ee1bcfd80cd7713093f9c053ef2d8c2cd673cd7

              SHA256

              c430a15c1712a571b0cd3ed0e5dfeefa7e78865a91bdc12e66666cd37c0e9654

              SHA512

              f0a17a940dd1c956f2578ed852e94631a9762fdd825ed5160b3758e427e8efa2ff0bfc83f239976b1d2765fefc8f9182e41c2da8f5746b36d4b7d189cb14a1b8

              Download Submit

            • C:\Users\Admin\AppData\Roaming\24.exe
              Filesize

              399KB

              MD5

              43728c30a355702a47c8189c08f84661

              SHA1

              790873601f3d12522873f86ca1a87bf922f83205

              SHA256

              cecdf155db1d228bc153ebe762d7970bd6a64e81cf5f977343f906a1e1d56e44

              SHA512

              b2d0882d5392007364e5f605c405b98a375e34dec63be5d16d9fae374313336fa13edbb6b8894334afb409833ffc0dbbc9be3d7b4263bdf5b77dbff9f2182e1e

              Download Submit

            • C:\Users\Admin\AppData\Roaming\25.exe
              Filesize

              64KB

              MD5

              4bbcdf7f9deb1025ca56fa728d1fff48

              SHA1

              bdc80dfb759c221a850ac29664a27efd8d718a89

              SHA256

              d2c49ce7e49109214a98eaa2d39f0749c1e779bd139af1cadae55e1ccb55753b

              SHA512

              ea78c4935864dcddbf6f0516e1d5c095c4814ac988ccc038d0dc11c1fab7127ded45ff35b12bad845422c20f45311101706f0ef14cb1d629277ae276a2535383

              Download Submit

            • C:\Users\Admin\AppData\Roaming\26.exe
              Filesize

              576KB

              MD5

              c3da5cb8e079024e6d554be1732c51cf

              SHA1

              e8f4499366fe67c9ae6fd1f5acbf56a9b956d4c3

              SHA256

              d7479a2f9f080742d17077fb4ccfc24583fa7a35842ba505cd43ed266734ce1f

              SHA512

              2395e084aef01c2a3f18524ee2c860f21e785849ce588a6ac7f58b45b6f7ba6dd25c052c49cc41dd72b3ebb7d476d88787aa273af82afc6fe17eb9e0ad4d7043

              Download Submit

            • C:\Users\Admin\AppData\Roaming\27.exe
              Filesize

              627KB

              MD5

              3d2c6861b6d0899004f8abe7362f45b7

              SHA1

              33855b9a9a52f9183788b169cc5d57e6ad9da994

              SHA256

              dbe95b94656eb0173998737fb5e733d3714c8e3b58226a1a038ca85257c8b064

              SHA512

              19b28a05d6e0d6026fb47a20e2ff43bfdf32387ee823053dcd4878123b20730c0ea65d01ff25080c484f67eeedb2caa45b4b5eb01a3a3bb2d3bc5246cc73aa6e

              Download Submit

            • C:\Users\Admin\AppData\Roaming\28.exe
              Filesize

              64KB

              MD5

              2ef457653d8aeb241637c8358b39863f

              SHA1

              578ed06d6c32c44f69a2c2454f289fb0a5591f30

              SHA256

              dcffe599c886878ed4bed045140bd13d7bc9bd5085163ea00857aa09a93f4060

              SHA512

              16f98c1d29b8cfaaf3003c5264ca6b4363764c351d5106919eaf2c3bfab26e0fb189dd0e0b82b4d294ba5f3fe535d71cd25c93c2bf9fd27d84c2dd0a2bc99b69

              Download Submit

            • C:\Users\Admin\AppData\Roaming\29.exe
              Filesize

              2.6MB

              MD5

              0009efe13eaf4dd3d091bc6e9ca7c1e7

              SHA1

              f2be84149784db1d1b7746afde07d781805bd35f

              SHA256

              de30d86cff3d838162aa88112a946dfb3af84005dda6bbc70cee15e8dff70ba3

              SHA512

              cf96410d5a528b52d92c37fac77ff3a8326ad6c2b3bbe00b44d55c758c5521870b9149b2fe8f743e6e7d90259eab5b3d19ed253abb8bea7660530c9b9ea70405

              Download Submit

            • C:\Users\Admin\AppData\Roaming\3.exe
              Filesize

              64KB

              MD5

              d2e2c65fc9098a1c6a4c00f9036aa095

              SHA1

              c61b31c7dbebdd57a216a03a3dc490a3ea9f5abd

              SHA256

              4d7421e6d0ac81e2292bcff52f7432639c4f434519db9cf2985b46a0069b2be8

              SHA512

              b5bd047ca4ee73965719669b29478a9d33665752e1dbe0f575a2da759b90819e64125675da749624b2d8c580707fd6a932685ab3962b5b88353981e857fe9793

              Download Submit

            • C:\Users\Admin\AppData\Roaming\30.exe
              Filesize

              1.4MB

              MD5

              fc44b935b0188657684c40113f7ab81c

              SHA1

              76c4a1262eb49daa55a24aadd7e3a48f2c22abd2

              SHA256

              f5b2489109d68b6ac83b453b8df1c7e1e9ec2636e162efdbaab4d27c1ce2dd69

              SHA512

              95cdf42503a546b8c3de9c1d0f0ffc5fca9955739591e011ec1dfd8b5c83492bc14261bbb042275f281cc12b59edb071e3dd72dad64c11481d118910a6052f9a

              Download Submit

            • C:\Users\Admin\AppData\Roaming\31.exe
              Filesize

              64KB

              MD5

              4c4f3c4c8145b2bb3f79dc1a79f013a9

              SHA1

              9b1d80f6f950d30d134537f16f1f24fb66a41543

              SHA256

              f9f9b4e7abf29743486aeb210d474fee24b38a0e2f97d082ab0fe3dabc14b47b

              SHA512

              7c842577871a8bdf80a3da9dad91dea92dce764c00c874c821cbe2998a0a9d9921f0efb28bd5465deef02a6a6fdcb682a75b25976d7fac421fad8bf39d1c6c37

              Download Submit

            • C:\Users\Admin\AppData\Roaming\4.exe
              Filesize

              2.6MB

              MD5

              ec7506c2b6460df44c18e61d39d5b1c0

              SHA1

              7c3e46cd7c93f3d9d783888f04f1607f6e487783

              SHA256

              4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d

              SHA512

              cf16f6e5f90701a985f2a2b7ad782e6e1c05a7b6dc0e644f7bdd0350f717bb4c9e819a8e9f383da0324b92f354c74c11b2d5827be42e33f861c233f3baab687e

              Download Submit

            • C:\Users\Admin\AppData\Roaming\5.exe
              Filesize

              11KB

              MD5

              4fcc5db607dbd9e1afb6667ab040310e

              SHA1

              48af3f2d0755f0fa644fb4b7f9a1378e1d318ab9

              SHA256

              6fb0eacc8a7abaa853b60c064b464d7e87b02ef33d52b0e9a928622f4e4f37c7

              SHA512

              a46ded4552febd7983e09069d26ab2885a8087a9d43904ad0fedcc94a5c65fe0124bbf0a7d3e7283cb3459883e53c95f07fa6724b45f3a9488b147de42221a26

              Download Submit

            • C:\Users\Admin\AppData\Roaming\6.exe
              Filesize

              227KB

              MD5

              cf04c482d91c7174616fb8e83288065a

              SHA1

              6444eb10ec9092826d712c1efad73e74c2adae14

              SHA256

              7b01d36ac9a77abfa6a0ddbf27d630effae555aac9ae75b051c6eedaf18d1dcf

              SHA512

              3eca1e17e698c427bc916465526f61caee356d7586836b022f573c33a6533ce4b4b0f3fbd05cc2b7b44568e814121854fdf82480757f02d925e293f7d92a2af6

              Download Submit

            • C:\Users\Admin\AppData\Roaming\7.exe
              Filesize

              64KB

              MD5

              42d1caf715d4bd2ea1fade5dffb95682

              SHA1

              c26cff675630cbc11207056d4708666a9c80dab5

              SHA256

              8ea389ee2875cc95c5cd2ca62ba8a515b15ab07d0dd7d85841884cbb2a1fceea

              SHA512

              b21a0c4b19ffbafb3cac7fad299617ca5221e61cc8d0dca6d091d26c31338878b8d24fe98a52397e909aaad4385769aee863038f8c30663130718d577587527f

              Download Submit

            • C:\Users\Admin\AppData\Roaming\8.exe
              Filesize

              666KB

              MD5

              dea5598aaf3e9dcc3073ba73d972ab17

              SHA1

              51da8356e81c5acff3c876dffbf52195fe87d97f

              SHA256

              8ec9516ac0a765c28adfe04c132619170e986df07b1ea541426be124fb7cfd2c

              SHA512

              a6c674ba3d510120a1d163be7e7638f616eedb15af5653b0952e63b7fd4c2672fafc9638ab7795e76b7f07d995196437d6c35e5b8814e9ad866ea903f620e81e

              Download Submit

            • C:\Users\Admin\AppData\Roaming\9.exe
              Filesize

              744KB

              MD5

              ea88f31d6cc55d8f7a9260245988dab6

              SHA1

              9e725bae655c21772c10f2d64a5831b98f7d93dd

              SHA256

              33f77b1bca36469dd734af67950223a7b1babd62a25cb5f0848025f2a68b9447

              SHA512

              5952c4540b1ae5f2db48aaae404e89fb477d233d9b67458dd5cecc2edfed711509d2e968e6af2dbb3bd2099c10a4556f7612fc0055df798e99f9850796a832ad

              Download Submit

            • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp307659117960\node-v13.13.0-win-x64\node_modules\npm\docs\public\cli-commands\npm-bugs\index.html
              Filesize

              42KB

              MD5

              d0fcb234527b62597027adfe909a58d1

              SHA1

              e46877bfb15bbdb029aaa7777b952b3b30b0695c

              SHA256

              fa6dae131ec446c7a489fff6ef3d6952f8e34cf113eb3df7c8c643697492f617

              SHA512

              c7850e31c0a7cdd810fa778400a519d5ce34499fa8f660aac5288a88b72badefbb2e657fda3db9260ea442b7b930da1011b181b101d117410428af04fc0e78a1

              Download Submit

            • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp307659117960\node-v13.13.0-win-x64\node_modules\npm\node_modules\cliui\node_modules\strip-ansi\license
              Filesize

              1KB

              MD5

              5ad87d95c13094fa67f25442ff521efd

              SHA1

              01f1438a98e1b796e05a74131e6bb9d66c9e8542

              SHA256

              67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

              SHA512

              7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

              Download Submit

            • C:\Users\Admin\qnodejs-node-v13.13.0-win-x64.tmp307659117960\node-v13.13.0-win-x64\node_modules\npm\node_modules\crypto-random-string\license
              Filesize

              1KB

              MD5

              940fdc3603517c669566adb546f6b490

              SHA1

              df8b7ea6dff65e7dd31a4e2f852fb6f2b45b7aa3

              SHA256

              6b18e4f3ea8443739a64c95ecf793b45e4a04748da67e4a1479c3f4bba520bd6

              SHA512

              9e2cf5b0c3105c7ec24b8382a9c856fc3d41a6903f9817f57f87f670073884c366625bc7dee6468bb4cbd0c0f3b716f9c7c597058098141e5a325632ea736452

              Download Submit

            • memory/544-804-0x0000000003180000-0x00000000033F7000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/872-144-0x0000000000430000-0x0000000000444000-memory.dmp

              Filesize

              80KB

              Download

            • memory/872-137-0x0000000000D80000-0x0000000000E2C000-memory.dmp

              Filesize

              688KB

              Download

            • memory/872-1176-0x0000000000560000-0x0000000000568000-memory.dmp

              Filesize

              32KB

              Download

            • memory/872-1604-0x00000000007C0000-0x00000000007C8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/872-160-0x0000000000440000-0x0000000000448000-memory.dmp

              Filesize

              32KB

              Download

            • memory/988-152-0x0000000000870000-0x000000000088C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/1012-1177-0x0000000000400000-0x0000000002DE1000-memory.dmp

              Filesize

              41.9MB

              Download

            • memory/1244-328-0x0000000000280000-0x0000000000290000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1544-1175-0x00000000006F0000-0x0000000000752000-memory.dmp

              Filesize

              392KB

              Download

            • memory/1544-2739-0x0000000000480000-0x0000000000488000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1544-1156-0x0000000000BF0000-0x0000000000C88000-memory.dmp

              Filesize

              608KB

              Download

            • memory/1544-2807-0x0000000004FA0000-0x0000000004FF6000-memory.dmp

              Filesize

              344KB

              Download

            • memory/1696-1171-0x0000000000AE0000-0x0000000000B4A000-memory.dmp

              Filesize

              424KB

              Download

            • memory/1696-2931-0x0000000005130000-0x0000000005188000-memory.dmp

              Filesize

              352KB

              Download

            • memory/1988-743-0x000000000D970000-0x000000000DB0A000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/1988-327-0x0000000000270000-0x0000000000276000-memory.dmp

              Filesize

              24KB

              Download

            • memory/1988-1393-0x00000000003A0000-0x00000000003A6000-memory.dmp

              Filesize

              24KB

              Download

            • memory/1988-325-0x0000000001170000-0x00000000012F4000-memory.dmp

              Filesize

              1.5MB

              Download

            • memory/2112-2435-0x0000000000750000-0x00000000007A2000-memory.dmp

              Filesize

              328KB

              Download

            • memory/2112-1170-0x0000000001390000-0x00000000013FE000-memory.dmp

              Filesize

              440KB

              Download

            • memory/2112-2530-0x0000000000C10000-0x0000000000C50000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2120-170-0x0000000000400000-0x000000000042D000-memory.dmp

              Filesize

              180KB

              Download

            • memory/2120-101-0x0000000000400000-0x000000000042D000-memory.dmp

              Filesize

              180KB

              Download

            • memory/2120-150-0x0000000000430000-0x000000000052B000-memory.dmp

              Filesize

              1004KB

              Download

            • memory/2756-4173-0x0000000000B00000-0x0000000000BAC000-memory.dmp

              Filesize

              688KB

              Download

            • memory/2876-312-0x00000000010E0000-0x000000000119E000-memory.dmp

              Filesize

              760KB

              Download

            • memory/2876-2858-0x0000000000E80000-0x0000000000ED8000-memory.dmp

              Filesize

              352KB

              Download

            • memory/2900-435-0x0000000000430000-0x0000000000431000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2900-155-0x0000000000430000-0x0000000000431000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2900-468-0x0000000000430000-0x0000000000431000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2900-178-0x0000000000430000-0x0000000000431000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2924-96-0x0000000000400000-0x00000000004B0000-memory.dmp

              Filesize

              704KB

              Download

            • memory/2924-93-0x0000000000220000-0x0000000000221000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2924-95-0x000000000045E000-0x0000000000465000-memory.dmp

              Filesize

              28KB

              Download

            • memory/2924-651-0x0000000000400000-0x00000000004B0000-memory.dmp

              Filesize

              704KB

              Download

            • memory/2972-1165-0x0000000000400000-0x0000000002DF6000-memory.dmp

              Filesize

              42.0MB

              Download

            • memory/3424-4470-0x0000000000080000-0x00000000000D2000-memory.dmp

              Filesize

              328KB

              Download

            • memory/3952-3583-0x0000000000400000-0x0000000000452000-memory.dmp

              Filesize

              328KB

              Download

            • memory/4540-10771-0x0000000000400000-0x0000000000452000-memory.dmp

              Filesize

              328KB

              Download

            • memory/4604-10955-0x0000000000400000-0x0000000000450000-memory.dmp

              Filesize

              320KB

              Download

            • memory/4944-10889-0x0000000000400000-0x0000000000452000-memory.dmp

              Filesize

              328KB

              Download