azorult | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
113s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

azorult agilenet defense_evasion discovery infostealer persistence trojan upx

Malware Config

Extracted

Family

azorult

http://boglogov.site/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Azorult family
azorult

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit32.exe"	Fagot.a.exe

Adds policy Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winlogon = "C:\\heap41a\\svchost.exe C:\\heap41a\\std.txt"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\status = "present"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
2756	ddraw32.dll
804	ddraw32.dll
4352	svchost.exe
1500	svchost.exe
2128	svchost.exe
1448	svchost.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	Fagot.a.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/5728-1116-0x00000000024E0000-0x00000000024F4000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartUp = "C:\\Windows\\Maria.doc .exe"	Bezilom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost32 = "C:\\Windows\\system32\\dllhost32.exe"	Fagot.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Manager = "C:\\Windows\\system32\\winmants.exe"	Mantas.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\heap41a\Offspring\autorun.inf	svchost.exe
File opened for modification	C:\heap41a\offspring\autorun.inf	svchost.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\autochk.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ntkrnlpa.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ctfmon.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\services.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\wowexec.exe	Fagot.a.exe
File created	C:\WINDOWS\SysWOW64\userinit.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\dllhost32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\logon.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\win.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\recover.exe	Fagot.a.exe
File opened for modification	C:\Windows\SysWOW64\winmants.exe	Mantas.exe
File created	C:\windows\SysWOW64\dumprep.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\imapi.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\MDM.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\systray.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\userinit32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\shutdown.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\wuauclt.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\winmants.exe	Mantas.exe
File created	C:\Windows\SysWOW64\ddraw32.dll	Bumerang.exe
File opened for modification	C:\Windows\SysWOW64\userinit32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\regedit.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\alg.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\chcp.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\progman.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ntoskrnl.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\chkntfs.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\bootok.exe	Fagot.a.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4228-281-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4228-287-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x0007000000023e78-283.dat	upx
behavioral1/memory/804-290-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2756-292-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/804-298-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x0007000000023e94-333.dat	upx
behavioral1/memory/4352-345-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/1500-361-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/1448-372-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2128-371-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/1396-374-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/1500-369-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/4352-359-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/files/0x0007000000023eb4-393.dat	upx
behavioral1/memory/1396-1111-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/1448-1152-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2128-1151-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2128-1173-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/1448-1174-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2128-1274-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/1448-1275-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2128-1287-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/1448-1289-0x0000000000400000-0x0000000000486000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Kazaa\My shared folder\lesbian.scr	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\quake3.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\GCN Emulator.exe	Mantas.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\broken.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Doom-Install.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Gamecube Emulator.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Visual Boy Advance .exe	Mantas.exe
File opened for modification	C:\Program Files\KazaaLite\My shared folder\sweet.jpg	Mantas.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	WScript.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\lesbian.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\runhidden.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\StarCraft No CD Crack.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\SnagIt .exe	Mantas.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	WScript.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\blowjob.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\MSBlaster Patch.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\XBOX Emulator.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Kazaa Media Desktop .exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Pop-Up Stopper .exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\iMesh .exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Morpheus .exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Spybot - Search & Destroy .exe	Mantas.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\child porn.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\cdcrack.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Xeon XBOX Emulator.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Warcraft III NoCD Crack.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\ICQ Lite .exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\rom.exe	Mantas.exe
File opened for modification	C:\Program Files\KazaaLite\My shared folder\blowjob.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\setup.exe	Mantas.exe
File opened for modification	C:\Program Files\KazaaLite\My shared folder\heart.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\cdkey.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\PerAntivirus Crack.exe	Mantas.exe
File opened for modification	C:\Program Files\KazaaLite\My shared folder\lesbian.jpg	Mantas.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\anal sex.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\nocd crack.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Trillian .exe	Mantas.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	WScript.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\ilikeyou.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\kazaalite.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\secret.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Wolfenstein.exe	Mantas.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	WScript.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\sweet.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Gamecube.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Norton Antivirus Crack.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Nero.exe	Mantas.exe
File opened for modification	C:\Program Files\KazaaLite\My shared folder\ilikeyou.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\maphack.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\aimbot.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Ad-aware .exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\WinMX .exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\epsxe.exe	Mantas.exe
File opened for modification	C:\Program Files\KazaaLite\My shared folder\0m1a2n3t4a7s8.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\winamp.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\DivX.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Windows XP Service Pack Cracked.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Microsoft Patch.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Direct DVD Copier.exe	Mantas.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\mantas.jpg	Mantas.exe
File opened for modification	C:\Program Files\Kazaa\My shared folder\two teens fucking.jpg	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\FruityLoops Setup.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\FlashFXP Crack.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Msn Hack.exe	Mantas.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Maria.doc .exe	Bezilom.exe
File opened for modification	C:\Windows\Maria.doc .exe	Bezilom.exe
File created	C:\Windows\NOTEPAD.EXE	Fagot.a.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2756	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bezilom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mantas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bumerang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddraw32.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heap41A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main	Fagot.a.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.blacksnake.com"	Fagot.a.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{43286FEA-6997-4543-803E-60A20C473DE5}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F1CBBA3D-683A-4612-97EB-AF035E3B6218}\1.0\Flags	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.7\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\NumMethods	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{c942fc26-bea8-4b65-8b60-62a523d5fcd6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C78D010B-C706-4A74-9E8E-4A634BE760FC}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADE2EEB9-FC85-4F5B-B5D9-D431B4AAC31A}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51973C12-CB0C-11D0-B5C9-00A0244A0E7A}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5946584a-99dc-5ea9-a7a0-f2d1ddb98c70}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\javascript	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F6F94D22-78C2-11D2-8FFE-00C04FA38314}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ec0f39fc-6959-5423-9e1a-f7cb8e845ca1}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A60384F6-3712-4CB3-BC46-81E6402FEE99}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A2D5134-6C59-4E08-A0E0-34E5222F86D7}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71301ACE-093C-42C6-B0DB-AD1F75A65445}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DF1343F-9AA4-4DC7-99FA-6469254B020C}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41DC24D8-6B81-41C4-832C-FE172CB3A582}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CD06992-50AA-11D1-B8F0-00A0C9259304}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5477469E-83B1-11D2-8B49-00A0C9B7C9C4}\2.4	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3720D29-8D6D-4448-8CC4-1CAACA5673F6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{de729fb6-a7fc-57d5-be45-38c33ffd9757}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A38EF241-AF3E-49A9-8533-0E35B6794D40}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8255A6DA-C295-48C3-A4DA-DAE510B5C193}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F23F552E-810D-4D84-B027-49FB55BF6443}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C16E7DB2-286B-402F-94BF-00DD7CAD2B91}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFD074F8-3A54-4FB3-8771-277D3E2031C5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5DEF5A1-FFB6-4E68-B3D8-A12AC60FDA54}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4097972-8570-452A-9446-A6E71B7D1549}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51973C25-CB0C-11D0-B5C9-00A0244A0E7A}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{503ae511-184c-4608-bd41-41d4502b8356}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{edd253f8-4ebd-56e5-9592-3c09375ebdc4}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF409217-79B9-4FB3-9F9C-9C13DBCEE658}\NumMethods	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7E66F28-035A-401A-AFC7-2E300BD29711}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{671ECD53-3291-4EAB-9FB4-079E11E4E894}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\zapfile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0002E157-0000-0000-C000-000000000046}\5.3	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D081E337-12DB-4146-8986-A3A46BA5DE5C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5B20820-E233-11D2-9037-00C04FA302A1}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\HelpDir	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D215781D-019E-4FA0-903D-0CDCDE13A4F5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDD01F1E-F883-4B39-B8D8-A20F52F2A66B}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B5EEC44-51AA-4210-B84F-1938B8576D8D}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5477469E-83B1-11D2-8B49-00A0C9B7C9C4}\2.0\0\win64	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0\HELPDIR	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDD01F1E-F883-4B39-B8D8-A20F52F2A66B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD39102B-4B69-4495-8F29-E0B25C4A8855}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EB-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{521B4726-04E9-47E7-B3A5-CD93A7F74F5B}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B91B3BD-9E21-4266-A9C2-67DD011A2357}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D1E341F3-4E36-58C5-92BF-DD33092E390C}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D1E341F3-4E36-58C5-92BF-DD33092E390C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7405D1D-E24B-44E0-B707-D8A5A4E1641B}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80CD1A63-37A5-43D3-80A3-CCD23E8FECEE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77FF7000-C3D0-49C0-956F-C662E232E5BB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A625EA4-A89F-4EB2-A45A-9AD4E37D4B00}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91CE54EE-C67C-4B46-A4FF-99416F27A8BF}\1.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF6D3520-E8D9-4E8C-BB75-CFFA7B03C633}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEE00915-E393-11D1-BB03-00C04FB6C4A6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCCF3654-F2C1-405B-B167-682E0A3E9A20}	Fagot.a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3432	msedge.exe
3432	msedge.exe
2152	identity_helper.exe
2152	identity_helper.exe
3188	msedge.exe
3188	msedge.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe
2180	Fagot.a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4048	Bezilom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 544	3432	msedge.exe	83
PID 3432 wrote to memory of 544	3432	msedge.exe	83
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 4936	3432	msedge.exe	84
PID 3432 wrote to memory of 3200	3432	msedge.exe	85
PID 3432 wrote to memory of 3200	3432	msedge.exe	85
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86
PID 3432 wrote to memory of 312	3432	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8037e46f8,0x7ff8037e4708,0x7ff8037e4718
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5360 /prefetch:2
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3624 /prefetch:2
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,352875225519354292,14876982785377454040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5272 /prefetch:2
  2⤵
  PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4884

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bezilom.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bezilom.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bumerang.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bumerang.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4228
- C:\Windows\SysWOW64\ddraw32.dll
  C:\Windows\system32\ddraw32.dll
  2⤵
  - Executes dropped EXE
  PID:2756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 324
    3⤵
    - Program crash
    PID:2996
- C:\Windows\SysWOW64\ddraw32.dll
  C:\Windows\system32\ddraw32.dll :C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bumerang.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2756 -ip 2756
1⤵
PID:3012

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Fagot.a.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Fagot.a.exe"
1⤵
- Modifies WinLogon for persistence
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2180

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\HeadTail.vbs"
1⤵
- Drops file in Program Files directory
PID:4100

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Heap41A.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Heap41A.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4076
- C:\Users\Admin\AppData\Local\Temp\MicrosoftPowerPoint\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\MicrosoftPowerPoint\svchost.exe" MicrosoftPowerPoint\install.txt
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  PID:4352
- - C:\heap41a\svchost.exe
    C:\heap41a\svchost.exe C:\heap41a\std.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1500
  - - C:\heap41a\svchost.exe
      C:\heap41a\svchost.exe C:\heap41a\script1.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2128
  - - C:\heap41a\svchost.exe
      C:\heap41a\svchost.exe C:\heap41a\reproduce.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1448

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Mantas.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Mantas.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1396

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Netres.a.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Netres.a.exe"
1⤵
PID:3776

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Nople.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Nople.exe"
1⤵
PID:4228

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Lokibot.exe"
1⤵
PID:5728

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Azorult.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Stealer\Azorult.exe"
1⤵
PID:5896
- C:\ProgramData\Microsoft\Intel\wini.exe
  C:\ProgramData\Microsoft\Intel\wini.exe -pnaxui
  2⤵
  PID:1488
- C:\programdata\install\cheat.exe
  C:\programdata\install\cheat.exe -pnaxui
  2⤵
  PID:5568
- C:\programdata\install\ink.exe
  C:\programdata\install\ink.exe
  2⤵
  PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start appidsvc
  2⤵
  PID:5788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start appmgmt
  2⤵
  PID:5772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config appidsvc start= auto
  2⤵
  PID:404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config appmgmt start= auto
  2⤵
  PID:5996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete swprv
  2⤵
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop mbamservice
  2⤵
  PID:2680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop bytefenceservice
  2⤵
  PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete bytefenceservice
  2⤵
  PID:6044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete mbamservice
  2⤵
  PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete crmsvc
  2⤵
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete "windows node"
  2⤵
  PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop Adobeflashplayer
  2⤵
  PID:5160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete AdobeFlashPlayer
  2⤵
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop MoonTitle
  2⤵
  PID:1196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete MoonTitle"
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop AudioServer
  2⤵
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete AudioServer"
  2⤵
  PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop clr_optimization_v4.0.30318_64
  2⤵
  PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete clr_optimization_v4.0.30318_64"
  2⤵
  PID:5248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop MicrosoftMysql
  2⤵
  PID:5272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete MicrosoftMysql
  2⤵
  PID:5172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
  2⤵
  PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
  2⤵
  PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
  2⤵
  PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
  2⤵
  PID:5888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
  2⤵
  PID:5376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Service" dir=in action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
  2⤵
  PID:1120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Shadow Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
  2⤵
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Security Service" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
  2⤵
  PID:5444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Recovery Services" dir=out action=allow program="C:\ProgramData\WindowsTask\MicrosoftHost.exe" enable=yes
  2⤵
  PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM

Filesize
33KB

MD5
b56f101011d0d42df34f0d91b304176f

SHA1
b82ccfe7a538987d94137fdb6af52c714d7964da

SHA256
2c3d88d6a9262d2478e45a96d57170f01a90528606b44a35b780ea2dc55df06e

SHA512
1784834b12c4fdf983db1b2f2c336c7f2b93cc8a26d52f491245fb69e975ef339c2d17ecbc4381681cdf11cb18bd0a2366c4319fef846453e7e82e23c1834342

Download Submit
C:\ProgramData\install\cheat.exe

Filesize
4.5MB

MD5
c097289ee1c20ac1fbddb21378f70410

SHA1
d16091bfb972d966130dc8d3a6c235f427410d7f

SHA256
b80857cd30e6ec64e470480aae3c90f513115163c74bb584fa27adf434075ab2

SHA512
46236dba79489272b6b7f9649fb8be5beb4a0b10776adf7b67ef3a9f969a977cde7a99b1b154b4b9142eb1bf72abcadbfd38abaef1eb88d7d03c646645517d0d

Download Submit
C:\ProgramData\install\ink.exe

Filesize
112KB

MD5
ef3839826ed36f3a534d1d099665b909

SHA1
8afbee7836c8faf65da67a9d6dd901d44a8c55ca

SHA256
136590cb329a56375d6336b12878e18035412abf44c60bebdaa6c37840840040

SHA512
040c7f7b7a28b730c6b7d3fabc95671fe1510dac0427a49af127bdeb35c8643234730bf3824f627050e1532a0283895bd41fd8a0f5ac20a994accf81a27514f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
150B

MD5
d11a04f067b4f7187c62e940ff9f73c5

SHA1
0d8efe877828b9afa3765129df424cf1bb8fad3f

SHA256
28639984fe655686819cc10d58bc3d60114fe977a93e5ead4daba85e89eb7e4e

SHA512
4491a4e2acba5f14512ac99b9cec82e66ad5e33d1de3f7ad94089b72d1fdb6be79f9d0223902e1fbd9f3b66c4e038b9d421511291ff13abf9a6db9fb64178984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\81558c54-6b0b-40fd-a010-7aa280764086.dmp

Filesize
825KB

MD5
c504a500b16885d90b97406df5eefdd1

SHA1
4fa4943d71d677c28390aac8318ab2664f4855b4

SHA256
0af8ec41336faa61c3b7e9463955d440bb48afe3c1e3fe36ddcd097805ef617e

SHA512
d2ed7e30a4bca4edfbec68ebe83a4c362a5dd0d7819588bda614ca700c88293d87dd2db1dcf448ce5f916849fac792ea8d7a8a1652b161db315f928dd60bde86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
50d5ad3165c72b813f8744e3413a96b3

SHA1
3900e46f2075a7088bdee2a4fd17977d05ff90d8

SHA256
9369c8950ef09d4b84df59453ce2e202b12ae67abf825a865f656002bfe3e072

SHA512
11ca4d96a159ea471922658c3bb956777c0a44e056ad89078524d22f8d6cb4bae010db7ccd6f23f7a67e24530c39ac646838c9b2ad665478eb6fdf00a47880ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
63999ae535c91a83c40e8b3edbd22a0b

SHA1
a19f6e2ec5acccf531b0240e58666f86542e9b27

SHA256
d187331615eaf27622b89438e62c2884c50d0d7de55c4754f980ac2184acac3c

SHA512
626a3f5f7b1a14c59f1f0456aeb0ba45c0f978c769ecd94408c931389eccf6847ed5de5ade2f87a3981ade77cd4e1878338aca66a2b4dbe726bd616fda81345d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
72d8b549c047805a5315df059bb1539a

SHA1
3df3770c14379441be3be79eac28f5a1344cdada

SHA256
beb758c4229b5c555242bde07bb5e88edd0d43be725dd68c8a4f33e6eddf10f6

SHA512
0bee533bd41e2226f9e971c9e4b75dee9d8d8ea545bc8a119d3a3c31bbea9f4c30b0ae3dcb58cfeca103ec4880171d2d63c676ac7a4a71b990e4a5ad376fe4fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed4129c401ddcedb65e85d899b619a11

SHA1
a3249e03d91a1585d0ff1acb0ed0cfc9a6cfbbd5

SHA256
d2e92251cb4c0d9e3da88838c5bf304357f35b16989b176a89f0300a34b81758

SHA512
8487bf6119f1cd57e2f3c1f696a7ffbb550fb109cca4b09e51a0a39fd37f58a2d6aa78a18dd222d41fd3971d151873a239b33040b786ba62ad840a252a1785c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d3e32b2d7c82e56e13a780bf5aa5de2

SHA1
c9101d2d3cfff914f456191a724b350d079578aa

SHA256
42567e13cb01b0bc7e89b5cb6d8d75cb8071e4ec612fc41c411f8d437a67788b

SHA512
f03cadd041773366815875e943e7040040ab41ca3f5e96bc6c8476b9cd54e834866888e3ef3ddf0a6596f881ef4b97258162c96991c3a70b13f6defffceea24f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9776c6e26249498ec63b98af7e04b9bb

SHA1
927f74cb2e90c69aa66084585a103d32c76ff479

SHA256
00c5c8dc87da363498fbb9a5f37f2c61e8fe1ebb721fe52a9a7adc7d60e1fb1b

SHA512
7ed41f9213d7cb2a4b51fcd251f92126f0634c34953e6bb9b885ce4d58ad51b49b0cf40c7a9b97b7237d89f88984483e51c011d88616e5fd9a497fe5126ba495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27f07fdd4eb4bf96e913591bf2c5488e

SHA1
f79e68f20f91593ac2c14d03ab553eee579ac266

SHA256
5d393b8cad7751d37a13040667aad9d67f2a71508a118d2c271de5ad1e2fec40

SHA512
7555519c97910d79a3bcd1e71f0295f1b709d92b18c5fc9d486cf8a436350d0d300fe76fe4023047358dc74170b88dc5fa355b1ea6c5848cfe0e800198b42e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
109f1a07aa294ef4222260ecd04d47f5

SHA1
bc11c170c3751397e311a6b288c4c53bba1f37a5

SHA256
3ea4fdb7be16107fc1886e1535778da1f582022406d6ec16cccb67504c491ca2

SHA512
c3010ccf53a5ed17a35206cd7dbe7c3d77b1f3c7407ce1005ba4e6faed7d378d4c50883136707b522fbb59d3bb404fb147f7867639e3bb7dc085e3f704d482f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58027c.TMP

Filesize
1KB

MD5
4cd17f7c86c41805afe822a7a9baebb1

SHA1
fbc6e1e46b8f7170a3b78332aed72302599bddcb

SHA256
e75ad906a8fd4ee373a96b2073dceebcc5e3277bd21d19818431ebadcab8d1d6

SHA512
8293a33148f0908eabdaa2e5d7be68ff329ffc1f0af6e2f5478b4069a19e7e2c3e121ecc669d9577d41cd955dddb9757400fdd082542701ecf23549fdfc5ad9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9216d5d0486772516c764677c9e2dda6

SHA1
4f29d262f8d011424f469709b1b9023ad4088dba

SHA256
2a71b2906ff9b9b8eddf98de28bbf5f3bbbd63fd3af7e163793f1508bf6ab344

SHA512
b93379c1ae31d81cb82873d3389b1993abb6beba1f76aa3dd7c9935a4a16d159ae52c1863887056a060d4c08e1316307efbf0e44c98ce385a4da1674e0064f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
2cab2d95eac558320737af47438db77f

SHA1
9494ed4a69db95ca03a5a0adc1f0b93f533581e3

SHA256
a21ea72577ecad15c089e7586eb6815c3ed4e967f2c2f52a7f36cd8b3fd05890

SHA512
71f2cb1af7ff30374d5d8409f0c759f10d956cc4369866243d72ef91ca240ab279fdb741992866b840b30d6bce1a63d24a0a1b0621f3b9ffe7184a28030d2931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c087d8dc-cc2e-4e1a-bf45-37c414953817.tmp

Filesize
11KB

MD5
de44ec893d3d130ce63fefde27bd1737

SHA1
7014c3ad1e6190905554fbacc7c7538fe6a1f59e

SHA256
d85acc0a17715bcb8dca7c8c39a4eee5aaeffd6506be016347ad6e7c8de2c930

SHA512
4ad91d7a0ed44737249d9d0aa232b86146c48f23daf43fd937bb6ceb7f721d095322bf43e6de111ec2a0ae5bab829847e30d3749d9b806bf21ee5422dd11a1b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftPowerPoint\2.mp3

Filesize
55KB

MD5
996867ee0cfd71ede0cda93e57789c75

SHA1
15abbe1362ca9ae1889ea56d3ea07f793ee76665

SHA256
c3d83fa6b168c9c53b7f9f4324be6f8053e47047e63199c05665a6bad5a587ed

SHA512
e4c3505e9f3c3f4469c858f08e612982e0a24b05b0c3e5aee5c63cd028b48f232c4e7470be50f3443f80b09aa74f2f9e59fc78fd8aba52777a1811033fb6cf00

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftPowerPoint\Icon.ico

Filesize
318B

MD5
e4231534c2813fda3a98d6d6b5b8b3b5

SHA1
c22ac56a296756120228cfe77fcc17b9000934c9

SHA256
143c93447046030853857088e31ee6c121d63fdfd03f10d36dfdcf6f0634ba43

SHA512
59aa526796c7e1de9bf2074fecae7b7520f34fd0f523bbb4c1f111b1b289f0a5bb7b94dc73fd8fec6187076c10d87a56273a09c79c718e388fcbaf5f0dd676cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftPowerPoint\Install.txt

Filesize
8KB

MD5
c0f4dbba918d1c7507f21463c422f29e

SHA1
daf5a4e8b449dddd98cfa54c75098c150576a8f6

SHA256
4fb1eb0cab27dba73bb042ddfbe470e7c75da6a126d934c3a5650959a7afc849

SHA512
fd50f5a631f394fb3d8220c1af4dcc79f66814c56727e3d845fe02ff8dc320927d430177b826f29cff49b55446a52e11be208de76a3f78d02e6b217906c7464a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftPowerPoint\pathList.txt

Filesize
52B

MD5
0508bce1cc472b6b9e899a51e6d16a67

SHA1
bfeecf6312f868157503c5a9acf31ccc656e9229

SHA256
7786563108861b5f45b09745fca9d139f1a8d2db29d63f4a2db67e90096baed5

SHA512
6c5bceada4ce2f612d6b887a6ecb082ba6ac3b2e0f42fab77a7c23e297f2d1fe9fbed1b5da6d974229dcce8091be720ce8345b9ee737149ab41dae196d626634

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftPowerPoint\svchost.exe

Filesize
233KB

MD5
155e389a330dd7d7e1b274b8e46cdda7

SHA1
6445697a6db02e1a0e76efe69a3c87959ce2a0d8

SHA256
6390a4374f8d00c8dd4247e271137b2fa6259e0678b7b8bd29ce957058fd8f05

SHA512
df8d78cf27e4a384371f755e6d0d7333c736067aeeb619e44cbc5d88381bdcbc09a9b8eeb8aafb764fc1aaf39680e387b3bca73021c6af5452c0b2e03f0e8091

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut7EFE.tmp

Filesize
4.5MB

MD5
f9a9b17c831721033458d59bf69f45b6

SHA1
472313a8a15aca343cf669cfc61a9ae65279e06b

SHA256
9276d1bb2cd48fdf46161deaf7ad4b0dbcef9655d462584e104bd3f2a8c944ce

SHA512
653a5c77ada9c4b80b64ae5183bc43102b32db75272d84be9201150af7f80d96a96ab68042a17f68551f60a39053f529bee0ec527e20ab5c1d6c100a504feda8

Download Submit
C:\Users\Admin\Documents\install.exe

Filesize
40KB

MD5
53f25f98742c5114eec23c6487af624c

SHA1
671af46401450d6ed9c0904402391640a1bddcc2

SHA256
7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705

SHA512
f460775308b34552c930c3f256cef1069b28421673d71e3fa2712b0467485861a98285925ae49f1adea1faf59265b964c873c12a3bb5de216122ac20084e1048

Download Submit
C:\Users\Admin\Documents\sweet.jpg

Filesize
23KB

MD5
58b1840b979ae31f23aa8eb3594d5c17

SHA1
6b28b8e047cee70c7fa42715c552ea13a5671bbb

SHA256
b2bb460aa299c6064e7fc947bff314e0f915c6ee6f8f700007129e3b6a314f47

SHA512
13548e5900bddc6797d573fcca24cec1f1eefa0662e9d07c4055a3899460f4e135e1c76197b57a49b452e61e201cb86d1960f3e8b00828a2d0031dc9aa78666a

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Bolbi.vbs

Filesize
80KB

MD5
14da34c98fb358457c69bf69e8397e91

SHA1
58403035d71e38a4557ceeea63dd77facdc3918a

SHA256
fcb50cdd2be67660cafc81b7a2f1842e77bec0dd74c11e1c916599c9582642df

SHA512
c254fd912358566b8028cbf5454b175149e49bbf55840db5b54662b7ea50ed4ef429a2546b77e55dc111978af0a41d9393c8ab5f0284227d36edee827f399007

Download Submit
C:\Windows\Maria.doc .exe

Filesize
28KB

MD5
8e9d7feb3b955e6def8365fd83007080

SHA1
df7522e270506b1a2c874700a9beeb9d3d233e23

SHA256
94d2b1da2c4ce7db94ee9603bc2f81386032687e7c664aff6460ba0f5dac0022

SHA512
4157a5628dc7f47489be2c30dbf2b14458a813eb66e942bba881615c101df25001c09afb9a54f88831fa4c1858f42d897f8f55fbf6b4c1a82d2509bd52ba1536

Download Submit
C:\Windows\SysWOW64\ddraw32.dll

Filesize
22KB

MD5
f1ac5c806ed1e188c54e0861cbf1f358

SHA1
b2a2895a0eae5e2ef8d10ed0f079d0fcfea9585a

SHA256
87b7d23ab8720f1087d50a902244cbbdc25245b29da9bfa54698a4545b82afc4

SHA512
ddb61b46a71db7401984e1917f0ef1498883cff76f0a98ff8d65acb08b6d7181511ca57a1e23c7482fc9d26afcf48b662896375b80eff4b2e0d08b7b55d9b98f

Download Submit
C:\Windows\SysWOW64\ntkrnlpa.exe

Filesize
373KB

MD5
30cdab5cf1d607ee7b34f44ab38e9190

SHA1
d4823f90d14eba0801653e8c970f47d54f655d36

SHA256
1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

SHA512
b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

Download Submit
C:\heap41a\driveList.txt

Filesize
72B

MD5
343c6f5dcbc9f70509a2659b6dcca34e

SHA1
573ce994df7f433ba8d897a03b8beebc1a1e80b7

SHA256
375c1af6f2d1fec8595df303bced33d9f80da01fea7d4968e24ef64dfccf78bd

SHA512
4b92a1a45c2f1d00eaa58feda3a0de94d91727824c5ec5472f0eb4ba0ee8edfcae8f05b01bacba5263e870f79e5737137f75434e009260d53853b7f86f94ba4e

Download Submit
C:\heap41a\reproduce.txt

Filesize
834B

MD5
4caff3a1fff3c9a4184dc586cf232265

SHA1
95603f1d5febc408dd421b96f8cc7d65b617d073

SHA256
dbc040d5f5261175089971582de1761569f6e1bd1f5dfc14cb4d7810cf192d6b

SHA512
dab3dbf898e8acb3e55c4411363f807be9ff67c20ef44c8d1505de689f8ba66e4beb7c57ee2fb0e04db1fb89b810beda6e854cd6063c84821f7ca827266ee95b

Download Submit
C:\heap41a\script1.txt

Filesize
3KB

MD5
83dcab5f77dbe3c6309957368da10d79

SHA1
44f588cbe597aae47aea2a4c14389d363269f418

SHA256
82ee86007227f285a1a1827d076c0abfeceb6fcc29960a9972114744fb37e0cd

SHA512
16fc76355027d45e416856bbc2d510acec15a7043f071d97f0c4cbf5752c01360962c31d28a3baff94adc81b4dbce71c15d33ccfa9f987a1df5c7b2e3ef1e034

Download Submit
C:\heap41a\std.txt

Filesize
439B

MD5
ae294ea720e7714ba05305b1eb2c371c

SHA1
f491b0abd1e180438a63890fdfbfc22f24e7be39

SHA256
ccc6e118a00a915962f2944dbc24dd9dd190e1a05923569f8b7c270d0195c9dd

SHA512
dca8c2564c8ee7e08755043a267492ca9a09e0c276bea4b2849905156c449edd31913b9b1ebd5005bda504d96afd873a59aafbef25d2b2e99cf295d7cc2f879d

Download Submit
C:\v1.log

Filesize
621B

MD5
499b7f9ec3a5ac8b6616aa7f3532627d

SHA1
22c313d197228da4b3ce2b174015e98a83823403

SHA256
4cc5e2dddcf8fce138ccb4750f8e6fe74ccca4f2ca9b87f269c8a0e02245796b

SHA512
79680d9e4088c4fac620e9a30a5be1b5bb0f540f7c1478062f6120cc7898864c3fe7ed136cb1f7519516c77a7ad94cb4f576dc7605444be68e7aceab9e893ed6

Download Submit
C:\v1.log

Filesize
169B

MD5
8d9590edca00d7f5729e9c1ae6528e1c

SHA1
d4fbfb5cef65919d054e0d7fd1f702c023d45044

SHA256
ee9ee81f407185677784199d1e14d44e2494f248958f0d00bdd9e9ba2fe7e40d

SHA512
ff2390072551d15eb9abdb85484be88d5eaf7bf4dae9651dc4eabd9956086f45c9c55bf1a18f152c3b8c2c1c829c3bfe40aa041f4c87ee4b9319640a7d23adf4

Download Submit
C:\v1.log

Filesize
347B

MD5
91145866f989a3eb754087c82f2aa038

SHA1
aaf58f8e40bd64f328a84259500d2d1ede5d51b7

SHA256
b30db7920794dfc63eb5a2fecd5f40e14788606f858c8964c3c6de9c3b6bbca6

SHA512
3b90580f6a69d39cf27a943d5c92205ef177aaf2e24ce30e11192a62e24112b7bf8764b2ac861965464422a9692e65e836e3048c208c3cad77331a9e5df165e2

Download Submit
memory/804-290-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/804-298-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1396-374-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1396-1111-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1448-1289-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1448-1152-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1448-1275-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1448-372-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1448-1174-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1500-369-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1500-361-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2128-1151-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2128-371-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2128-1173-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2128-1274-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2128-1287-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2180-1120-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2180-1242-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2756-292-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3776-1193-0x0000000051000000-0x0000000051064000-memory.dmp

Filesize
400KB

Download
memory/3776-1207-0x0000000051000000-0x0000000051064000-memory.dmp

Filesize
400KB

Download
memory/4076-339-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4228-281-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4228-287-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4352-345-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4352-359-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4364-1241-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5728-1116-0x00000000024E0000-0x00000000024F4000-memory.dmp

Filesize
80KB

Download
memory/5728-1115-0x00000000002E0000-0x0000000000332000-memory.dmp

Filesize
328KB

Download
memory/5728-1117-0x00000000052F0000-0x0000000005894000-memory.dmp

Filesize
5.6MB

Download
memory/5728-1194-0x0000000004F00000-0x0000000004F08000-memory.dmp

Filesize
32KB

Download
memory/5728-1196-0x0000000005C60000-0x0000000005DA0000-memory.dmp

Filesize
1.2MB

Download
memory/5728-1195-0x0000000005A80000-0x0000000005B12000-memory.dmp

Filesize
584KB

Download
memory/5728-1197-0x00000000063A0000-0x000000000699E000-memory.dmp

Filesize
6.0MB

Download