valleyrat | 194845853f864088bc9fae5c0b2f692f6d6b1564f41111041247b3f86d356f30

Analysis

user interaction
yes
max time kernel
599s
max time network
593s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
-A2026804002105.zip
Size 4.0MB
Sample260804-w3tehsxdkf
SHA256 194845853f864088bc9fae5c0b2f692f6d6b1564f41111041247b3f86d356f30
MD5 2eba26f01155a443a3924b45dba0639b
SHA1 1ac8d260ecc57999531dab27cf1c07fd92eb168c
SHA512 13e28844416dfb629f10879e9d0ceb6d8e57487ffdd09df1194ee70776d4c7ce3017a20969a4af868e31f5f1735c26b9a5154301f139807ab69edfe48977148d
SSDEEP 98304:6xP4M/QQ38TSOsK+/UfyoFfeLOALt9+Q3k2uuy8ct2BsNpQ2j++:6z/18TWK+sfy6MjLrH02uuy8ct2BP2jp
TLSH
T14E163353C0387EB2C2CCB37162E2D9C96099D551C0B2E8B3F277958F9CD69522E6B44B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution valleyrat

Malware Config

Signatures

Family: valleyrat
valleyrat

Windows_Trojan_Winos_464b8a2e 5 IoCs

resource	yara_rule
behavioral2/memory/4244-33-0x0000000004A50000-0x0000000004AA8000-memory.dmp	Windows_Trojan_Winos_464b8a2e
behavioral2/memory/4244-34-0x0000000004A50000-0x0000000004AA8000-memory.dmp	Windows_Trojan_Winos_464b8a2e
behavioral2/memory/4244-36-0x0000000004A50000-0x0000000004AA8000-memory.dmp	Windows_Trojan_Winos_464b8a2e
behavioral2/memory/4244-37-0x0000000004A50000-0x0000000004AA8000-memory.dmp	Windows_Trojan_Winos_464b8a2e
behavioral2/memory/4244-38-0x0000000004A50000-0x0000000004AA8000-memory.dmp	Windows_Trojan_Winos_464b8a2e

https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign 6 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c521-16.dat	WinosStager
behavioral2/memory/4244-33-0x0000000004A50000-0x0000000004AA8000-memory.dmp	WinosStager
behavioral2/memory/4244-34-0x0000000004A50000-0x0000000004AA8000-memory.dmp	WinosStager
behavioral2/memory/4244-36-0x0000000004A50000-0x0000000004AA8000-memory.dmp	WinosStager
behavioral2/memory/4244-37-0x0000000004A50000-0x0000000004AA8000-memory.dmp	WinosStager
behavioral2/memory/4244-38-0x0000000004A50000-0x0000000004AA8000-memory.dmp	WinosStager

Executes dropped EXE 2 IoCs

pid	Process
4244	MicrosoftEdgeComRegisterShellARM64.exe
3332	MicrosoftEdgeComRegisterShellARM64.exe

Loads dropped DLL 2 IoCs

pid	Process
4244	MicrosoftEdgeComRegisterShellARM64.exe
3332	MicrosoftEdgeComRegisterShellARM64.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\I:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\K:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\P:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Q:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\S:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\T:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\W:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\D:	ComputerDefaults.exe
File opened (read-only)	\??\M:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\N:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Y:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Z:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\R:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\G:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\J:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\O:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\U:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\X:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\B:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\L:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\V:	MicrosoftEdgeComRegisterShellARM64.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	icanhazip.com
25	icanhazip.com

Discovers running processes 1 TTPs 9 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1424	tasklist.exe
4944	tasklist.exe
5984	tasklist.exe
3536	tasklist.exe
4940	tasklist.exe
4776	tasklist.exe
1720	tasklist.exe
4116	tasklist.exe
5760	tasklist.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5804	cmd.exe
3988	cmd.exe
3148	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	3332	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeComRegisterShellARM64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vat.N0.20260804110703.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeComRegisterShellARM64.exe

Delays execution with timeout.exe 9 IoCs

defense_evasion

pid	Process
5424	timeout.exe
612	timeout.exe
4432	timeout.exe
6044	timeout.exe
2308	timeout.exe
4468	timeout.exe
4864	timeout.exe
5440	timeout.exe
1172	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5976	taskkill.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open\command	Vat.N0.20260804110703.EXE
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open\command	Vat.N0.20260804110703.EXE
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell	Vat.N0.20260804110703.EXE
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open	Vat.N0.20260804110703.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open	Vat.N0.20260804110703.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell	Vat.N0.20260804110703.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings	Vat.N0.20260804110703.EXE
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings	Vat.N0.20260804110703.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-1668793073-1147019296-3234184967-3446/SystemAppData/MicrosoftEdgeComRegisterShellARM64.exe"	Vat.N0.20260804110703.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "̀"	Vat.N0.20260804110703.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLoadDriverPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTakeOwnershipPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncBasePriorityPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTcbPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	5976	taskkill.exe
Token: SeDebugPrivilege	1424	tasklist.exe
Token: SeDebugPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreateTokenPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeAssignPrimaryTokenPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLockMemoryPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncreaseQuotaPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeMachineAccountPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTcbPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSecurityPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTakeOwnershipPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLoadDriverPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemProfilePrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemtimePrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeProfSingleProcessPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncBasePriorityPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreatePagefilePrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreatePermanentPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeBackupPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeRestorePrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeShutdownPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeAuditPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemEnvironmentPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeChangeNotifyPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeRemoteShutdownPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeUndockPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSyncAgentPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeEnableDelegationPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeManageVolumePrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeImpersonatePrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreateGlobalPrivilege	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: 31	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: 32	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: 33	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: 34	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: 35	4244	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	5984	tasklist.exe
Token: SeDebugPrivilege	5760	tasklist.exe
Token: SeDebugPrivilege	3536	tasklist.exe
Token: SeDebugPrivilege	4940	tasklist.exe
Token: SeDebugPrivilege	4776	tasklist.exe
Token: SeDebugPrivilege	1720	tasklist.exe
Token: SeDebugPrivilege	4116	tasklist.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4608	Vat.N0.20260804110703.EXE
4244	MicrosoftEdgeComRegisterShellARM64.exe
4244	MicrosoftEdgeComRegisterShellARM64.exe
3332	MicrosoftEdgeComRegisterShellARM64.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 5804	4608	Vat.N0.20260804110703.EXE	98
PID 5804 wrote to memory of 5176	5804	cmd.exe	100
PID 5176 wrote to memory of 4244	5176	ComputerDefaults.exe	101
PID 4244 wrote to memory of 5976	4244	MicrosoftEdgeComRegisterShellARM64.exe	102
PID 4244 wrote to memory of 3988	4244	MicrosoftEdgeComRegisterShellARM64.exe	105
PID 3988 wrote to memory of 3148	3988	cmd.exe	107
PID 3148 wrote to memory of 1424	3148	cmd.exe	108
PID 3148 wrote to memory of 1468	3148	cmd.exe	109
PID 3148 wrote to memory of 4468	3148	cmd.exe	110
PID 3148 wrote to memory of 4944	3148	cmd.exe	116
PID 3148 wrote to memory of 1740	3148	cmd.exe	117
PID 3148 wrote to memory of 5424	3148	cmd.exe	118
PID 3148 wrote to memory of 5984	3148	cmd.exe	119
PID 3148 wrote to memory of 5416	3148	cmd.exe	120
PID 3148 wrote to memory of 4864	3148	cmd.exe	121
PID 3148 wrote to memory of 5760	3148	cmd.exe	122
PID 3148 wrote to memory of 3428	3148	cmd.exe	123
PID 3148 wrote to memory of 5440	3148	cmd.exe	124
PID 3148 wrote to memory of 3536	3148	cmd.exe	132
PID 3148 wrote to memory of 2424	3148	cmd.exe	133
PID 3148 wrote to memory of 612	3148	cmd.exe	134
PID 3148 wrote to memory of 4940	3148	cmd.exe	135
PID 3148 wrote to memory of 5452	3148	cmd.exe	136
PID 3148 wrote to memory of 1172	3148	cmd.exe	137
PID 3148 wrote to memory of 4776	3148	cmd.exe	138
PID 3148 wrote to memory of 3840	3148	cmd.exe	139
PID 3148 wrote to memory of 4432	3148	cmd.exe	140
PID 3148 wrote to memory of 1720	3148	cmd.exe	141
PID 3148 wrote to memory of 908	3148	cmd.exe	142
PID 3148 wrote to memory of 6044	3148	cmd.exe	143
PID 3148 wrote to memory of 4116	3148	cmd.exe	144
PID 3148 wrote to memory of 2120	3148	cmd.exe	145
PID 3148 wrote to memory of 2308	3148	cmd.exe	146

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\-A2026804002105.zip
1⤵
PID:3316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3508

\??\D:\Vat.N0.20260804110703.EXE
"D:\Vat.N0.20260804110703.EXE"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Windows\System32\ComputerDefaults.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\SysWOW64\ComputerDefaults.exe
    C:\Windows\System32\ComputerDefaults.exe
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\ProgramData\S-1-5-21-1668793073-1147019296-3234184967-3446\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
      "MicrosoftEdgeComRegisterShellARM64.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5976
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\8821E12759AD7B6395C.CMD
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3988
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C C:\Users\Admin\AppData\Local\Temp\8821E12759AD7B6395C.CMD
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4944
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5424
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5984
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4864
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5760
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5440
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:612
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1172
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3840
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:908
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:6044
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2308

C:\ProgramData\S-1-5-21-1668793073-1147019296-3234184967-3446\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
C:\ProgramData\S-1-5-21-1668793073-1147019296-3234184967-3446\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1460
  2⤵
  - Program crash
  PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3332 -ip 3332
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\ProgramData\S-1-5-21-1668793073-1147019296-3234184967-3446\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
Size 3.5MB
SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
MD5 c185dbe4fcb5da174009ada3aa4822c3
SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
TLSH
T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfCORe8.dLL

Path C:\ProgramData\S-1-5-21-1668793073-1147019296-3234184967-3446\SystemAppData\pdfCORe8.dLL
Size 3.8MB
SHA256 f856bcab6dc2d2c4a047202d301f23b6b9e9ffe5ef5c85b5431bff69442ae95f
MD5 7125e2d1c3f52a4217adbe4140a1c36f
SHA1 08a9b79fd07a624aa9d74eb76059d2a89ba08bf1
SHA512 3f2537b9486cfbbe376c7d8d28315efb804713f061dc5f624b8705eb41a8be8d50ec082aca325f56c789477144da7bf0bb792bd3cce9598f9df04e81be54fafb
SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxLArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxLArDMxLkfIsEs
TLSH
T15006D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 727B
SHA256 dc2b74355ccbf980b546d102d07f62ae3754965fde8bcb1c9532efefe23f6066
MD5 c3c568bfd24897b041f3cb9d25451a96
SHA1 8a899b0ec566e3e215fadfe13d7979f0cd61aa40
SHA512 1dddebb74270f87e035cc635d43f360f0ff6f698d790342a3409138f929f3f42a30720df01c5417e76d26be738e3335031a2c31ab45b7d3922bb5da2372a9dc9
TLSH
T1830194D30A5888D02E248E0465F4B45335EAD01435FF6ED72929498F22EE378D8BE458
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
MD5 2b5a8554c5d49029302e9f94d82f4f89
SHA1 82fb3450db1f737cb748fd5ac2ab277401951cb4
SHA512 ebb0c882ed5371a5fe14d5841b680727ff54fc7f5191b1cda4a7f7f5520789512e0b448d0e42b522c484eaaa3c4ee7c1f575cd2a9b78d47b1cfd21650cf9a565
TLSH
T11EF0D43F59BB645258138D1D29EEC5B361F4998E01C64C7D307958B146673CE904F00E
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
Size 727B
SHA256 9ae2e1c28447bfe69ff169012d873d11a0c43001af635b114493e8177e7e9373
MD5 e640a2aa40e65ccf8ae5c06fc697b3ec
SHA1 cbb210a91e4db8e6257acbec1a3e871694ccf7b0
SHA512 652b298f4d3fed401a2794dc3c731583d7904bbbe7401e8de2e1c32842b6d81282533ca9d2d14d169b160bd81784462ec7a8eef339b5414f1afa58fad3761353
TLSH
T1A80194C99DBCF2068D02EEE0DE28E270749353084E36074B0324043D6D4BBD285D9D42
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 895f3912ab7d818c60f98dfe7195fdcc1d1544a4eec908350eac31e7bf0fbcdc
MD5 89bddf9601cbb5370e6a637f6fee4b1b
SHA1 ab00f9b883840df145e17395a40a3b029785a66f
SHA512 aa06f3ea4f0ac3f519574b4bb4828db97cfb7fc6194243605fed3cb97f9e6c6d327fe5130b72fffc48aa5e1b7edfb2a137b14b878803fec508e9ecd9aaf71992
TLSH
T1220199834DD09774340019098BEDC070769E405F7D850795B7A8145B42F7467C183D0D
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
Size 727B
SHA256 53c60c9910c857fa3f02c1db2a222d556998d9914fb472f4e3324b39be887813
MD5 520b189a6d3e6f328898d98bb7105d6f
SHA1 bb479bc92117f57e5576e29f6b649a4b0ffc99cf
SHA512 32c9b881be5eeb391a0e8e3fce13bba7600ee9d47e46e3bd81beefa90ef20b16a112c18918de71e30f1bfe11c8b9315af8cb84ca2d4acbd9e5b36460b36680c1
TLSH
T10A01158104E76EE4E90C8DD46175E4B4B8ABABD408858D19121C41AF0676FB96F4613D
MD5 SHA1 SHA512 TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 400B
SHA256 78f0188dafe09e10c1bde7100ae2a5c9c9f02709d7eb507f645838701f3c2ddd
MD5 3dc698965220d161c6e4d36daf52b915
SHA1 4c16f5cb58446a33da44ae377a504b5320f8a15d
SHA512 becbcc4a9964536213ddb950bf948a3e150027ce8d5912c85a2ad379fcb89606b08f0f76ca0193a1f953ef131bc18981c6e3e2127468740d7523b279ed79fff2
TLSH
T18BE0C0241FF5013DF356C5764FC1B4125C0EF1469840C7A00F90870C9A05F000D524B5
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 293f3549cf606054253681b191b3607364bfb3f01bfd33d5b25980580e68a107
MD5 812523c62799c2249d7fd7206b6125bb
SHA1 e1a46d15eb008f36c6aef6f01f17125ad743526c
SHA512 562488c8af5fe806f4863f3b1e1d8db5f6470c3484646b25c82cabdc35ac638f3dc281eb0fa6b22934806faf47b0d22d2deb3439f4c7a84b4f37ac907a01eb76
TLSH
T12AE0262027FF602FF1A89B7803DAD09AAF26F1132C5656FF1F92153D991AA014DA2C31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
Size 404B
SHA256 39f3473e343b11b80ac876cf62b02977387cdb957c149a02d22287c6e50ba1e0
MD5 15112e7dc69975989c26f077ee189299
SHA1 0ea0e3dde9090b479e7653d00dff9372d556c269
SHA512 1a90de9d5ef07d9c09d6e369595f0ba6a1867c853cb3a752fbf10ed62d3eb894f85a0fcb8cda4440cd8a0cec1109af6215958306eddf70ae7387a6135155d3b9
TLSH
T1F5E0283031FF015DF1F4D47407E9AC22587DF10B0547C3E80514071567147004CB1631
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 45017aafb89673430c136eb47a7e2d82db6e29791b94192dd009a6bf6080dcff
MD5 7daf54f8000ad50df2755c11e0b814b5
SHA1 af5e4e2bf2d25f9744bb2e976a85d14545367c2e
SHA512 2e559f7644bba5add36cb2ab932980bf83558bc9ffa79f5b0cb26b9d9e8638df71596354c00fd08845fddaaf745e29754850f0722a8908c7aeaf8bebc195004f
TLSH
T1EFE0683816EB654EF1509D3182E9A0762D69F205640496B907914328B71AF015E109F0
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
Size 416B
SHA256 45a8c1d14e5fcc8a5ba889db22769b763f0048e893de2bea216ae8b9e2bd462b
MD5 8035cd88dbec59c78c06698378823d9e
SHA1 7e84f75f7c63cc226fbd1f2af1542eda3c28869a
SHA512 beaadba3e49b658f8096e3a915e0f6180a1ce89403de706a06bb0b72c16fa62fcd9bcdff36f0de8f3b343b42caee723cc93b85cf1c8c625207667f97860f9256
TLSH
T1C8E0682812FEB11FF020DA3003F9A8362D18F305040492B806D043487B17F005C11AF0
MD5 SHA1 SHA512 TLSH

Submit Download

8821E12759AD7B6395C.CMD

Path C:\Users\Admin\AppData\Local\Temp\8821E12759AD7B6395C.CMD
Size 1KB
SHA256 522ac211cc3ab363722dbc6300df7787467cfe35d91652afafb2fa5b678456cc
MD5 75cdd637e6254bf9efceda03ad7fa2d6
SHA1 935d92be44c1e34e162b49dde14610af9da433ba
SHA512 4de0efa6e5d691b64dd180962bb881b4775e63f3c4bd5e4e513e030c1e1a93eb8bbac42a60c479b2b5766a4ed2a6fcb6a0add550ebb1e0b210877a8316ca2324
TLSH
T150314E8EC80B4E0D435842DF134ADC6ACA80F047FDC471C0B2AC5BC02386A8D09A6BED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4244-33-0x0000000004A50000-0x0000000004AA8000-memory.dmp

Download

memory/4244-34-0x0000000004A50000-0x0000000004AA8000-memory.dmp

Download

memory/4244-36-0x0000000004A50000-0x0000000004AA8000-memory.dmp

Download

memory/4244-37-0x0000000004A50000-0x0000000004AA8000-memory.dmp

Download

memory/4244-38-0x0000000004A50000-0x0000000004AA8000-memory.dmp

Download