azorult | 6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929

Analysis

max time kernel
88s
max time network
155s
platform
windows7_x64
resource
win7-en-20211208
submitted
10-01-2022 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
Size

24.0MB
MD5

e11fa56349781d01080d0baba6367758
SHA1

6214bdca82fa0e54a75de181fd1ed95dffdaf35a
SHA256

6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929
SHA512

1e99d322bb33346db00d9ba4ac0a6deb19830b02d3d4f98aee5461b2bbf99d02831b1079daed9d44307c261084a6864a4242a352aa12590b265941002de65f64

Score

10^/10

azorult njrat xmrig hacked collection discovery evasion infostealer miner persistence spyware stealer trojan

Malware Config

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

172.94.18.243:3001

Mutex

79402713f13d898b624bf5785b7dd5e5

Attributes

reg_key
79402713f13d898b624bf5785b7dd5e5
splitter
|'|'|

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\WINDOWS.EXE	disable_win_def
C:\Users\Admin\AppData\Local\Temp\WINDOWS.EXE	disable_win_def
C:\Users\Admin\AppData\Local\Temp\WINDOWS.EXE	disable_win_def
behavioral1/memory/880-85-0x0000000000B40000-0x0000000000B48000-memory.dmp	disable_win_def
behavioral1/memory/880-87-0x0000000000B40000-0x0000000000B48000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 1956 created 416 1956 powershell.EXE winlogon.exe
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

description	pid	process	target process
PID 1956 created 416	1956	powershell.EXE	winlogon.exe

XMRig Miner Payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2376-432-0x0000000140310068-mapping.dmp	xmrig

Executes dropped EXE 12 IoCs

Processes:

CHROME UPDATE.EXECHROME.EXEGOOGLE CHROME.EXENOTEPAD.EXESVCHOST.EXEWINDOWS UPDATE.EXEWINDOWS.EXEserver.exesihost64.exeServices.exeservices.exeservicesupdate.exe

pid	process
960	CHROME UPDATE.EXE
652	CHROME.EXE
972	GOOGLE CHROME.EXE
1224	NOTEPAD.EXE
1396	SVCHOST.EXE
1560	WINDOWS UPDATE.EXE
880	WINDOWS.EXE
1060	server.exe
1588	sihost64.exe
948	Services.exe
1300	services.exe
1956	servicesupdate.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 4 IoCs

Processes:

SVCHOST.EXEserver.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SVCHOST.EXE	SVCHOST.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SVCHOST.EXE	SVCHOST.EXE
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79402713f13d898b624bf5785b7dd5e5.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79402713f13d898b624bf5785b7dd5e5.exe	server.exe

Loads dropped DLL 31 IoCs

Processes:

6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exeWINDOWS UPDATE.EXEGOOGLE CHROME.EXENOTEPAD.EXEsihost64.execmd.execmd.exeServices.exesihost64.exe

pid	process
1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
1560	WINDOWS UPDATE.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
972	GOOGLE CHROME.EXE
1224	NOTEPAD.EXE
1588	sihost64.exe
1584	cmd.exe
1740	cmd.exe
948	Services.exe
2524	sihost64.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

WINDOWS.EXE

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features WINDOWS.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	WINDOWS.EXE

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

GOOGLE CHROME.EXE

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	GOOGLE CHROME.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	GOOGLE CHROME.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	GOOGLE CHROME.EXE

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SVCHOST.EXENOTEPAD.EXEserver.exeServices.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Store = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SVCHOST.EXE"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype Web = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\SVCHOST.EXE"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services.exe = "C:\\Users\\Admin\\Services.exe"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\79402713f13d898b624bf5785b7dd5e5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\79402713f13d898b624bf5785b7dd5e5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services.exe = "C:\\Users\\Admin\\Services.exe"	Services.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.EXEpowershell.EXEpowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

CHROME.EXEpowershell.EXE

description	pid	process	target process
PID 652 set thread context of 292	652	CHROME.EXE	nslookup.exe
PID 1956 set thread context of 1192	1956	powershell.EXE	dllhost.exe

Drops file in Windows directory 5 IoCs

Processes:

nslookup.exesvchost.exe

description	ioc	process
File created	C:\Windows\Tasks\nslooksvc32.job	nslookup.exe
File opened for modification	C:\Windows\Tasks\nslooksvc32.job	nslookup.exe
File created	C:\Windows\Tasks\nslooksvc64.job	nslookup.exe
File opened for modification	C:\Windows\Tasks\nslooksvc64.job	nslookup.exe
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GOOGLE CHROME.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GOOGLE CHROME.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GOOGLE CHROME.EXE

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1064 schtasks.exe
2008 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1764 timeout.exe

pid	process
1064	schtasks.exe
2008	schtasks.exe

pid	process
1764	timeout.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 604939c47306d801	powershell.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

SVCHOST.EXE

pid process

1396 SVCHOST.EXE

pid	process
1396	SVCHOST.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

NOTEPAD.EXEGOOGLE CHROME.EXEpowershell.exepowershell.exepowershell.exepowershell.exeCHROME UPDATE.EXECHROME.EXEpowershell.EXEdllhost.exepowershell.exe

pid	process
1224	NOTEPAD.EXE
1224	NOTEPAD.EXE
1224	NOTEPAD.EXE
1224	NOTEPAD.EXE
1224	NOTEPAD.EXE
972	GOOGLE CHROME.EXE
1300	powershell.exe
2036	powershell.exe
992	powershell.exe
2016	powershell.exe
960	CHROME UPDATE.EXE
652	CHROME.EXE
1956	powershell.EXE
1956	powershell.EXE
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
2228	powershell.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe
1192	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

NOTEPAD.EXEserver.exepowershell.exepowershell.exepowershell.exepowershell.exeCHROME UPDATE.EXEServices.exeCHROME.EXEpowershell.EXEdllhost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1224	NOTEPAD.EXE
Token: SeDebugPrivilege	1060	server.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: 33	1060	server.exe
Token: SeIncBasePriorityPrivilege	1060	server.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	960	CHROME UPDATE.EXE
Token: SeDebugPrivilege	948	Services.exe
Token: SeDebugPrivilege	652	CHROME.EXE
Token: 33	1060	server.exe
Token: SeIncBasePriorityPrivilege	1060	server.exe
Token: SeDebugPrivilege	1956	powershell.EXE
Token: SeDebugPrivilege	1956	powershell.EXE
Token: SeDebugPrivilege	1192	dllhost.exe
Token: 33	1060	server.exe
Token: SeIncBasePriorityPrivilege	1060	server.exe
Token: SeAuditPrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe
Token: SeSystemEnvironmentPrivilege	868	svchost.exe
Token: SeUndockPrivilege	868	svchost.exe
Token: SeManageVolumePrivilege	868	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	868	svchost.exe
Token: SeIncreaseQuotaPrivilege	868	svchost.exe
Token: SeSecurityPrivilege	868	svchost.exe
Token: SeTakeOwnershipPrivilege	868	svchost.exe
Token: SeLoadDriverPrivilege	868	svchost.exe
Token: SeSystemtimePrivilege	868	svchost.exe
Token: SeBackupPrivilege	868	svchost.exe
Token: SeRestorePrivilege	868	svchost.exe
Token: SeShutdownPrivilege	868	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exeWINDOWS UPDATE.EXENOTEPAD.EXECHROME.EXECHROME UPDATE.EXEcmd.execmd.exeGOOGLE CHROME.EXEserver.execmd.exe

description	pid	process	target process
PID 1568 wrote to memory of 960	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	CHROME UPDATE.EXE
PID 1568 wrote to memory of 960	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	CHROME UPDATE.EXE
PID 1568 wrote to memory of 960	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	CHROME UPDATE.EXE
PID 1568 wrote to memory of 960	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	CHROME UPDATE.EXE
PID 1568 wrote to memory of 652	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	CHROME.EXE
PID 1568 wrote to memory of 652	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	CHROME.EXE
PID 1568 wrote to memory of 652	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	CHROME.EXE
PID 1568 wrote to memory of 652	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	CHROME.EXE
PID 1568 wrote to memory of 972	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	GOOGLE CHROME.EXE
PID 1568 wrote to memory of 972	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	GOOGLE CHROME.EXE
PID 1568 wrote to memory of 972	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	GOOGLE CHROME.EXE
PID 1568 wrote to memory of 972	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	GOOGLE CHROME.EXE
PID 1568 wrote to memory of 1224	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	NOTEPAD.EXE
PID 1568 wrote to memory of 1224	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	NOTEPAD.EXE
PID 1568 wrote to memory of 1224	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	NOTEPAD.EXE
PID 1568 wrote to memory of 1224	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	NOTEPAD.EXE
PID 1568 wrote to memory of 1396	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	SVCHOST.EXE
PID 1568 wrote to memory of 1396	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	SVCHOST.EXE
PID 1568 wrote to memory of 1396	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	SVCHOST.EXE
PID 1568 wrote to memory of 1396	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	SVCHOST.EXE
PID 1568 wrote to memory of 1560	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS UPDATE.EXE
PID 1568 wrote to memory of 1560	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS UPDATE.EXE
PID 1568 wrote to memory of 1560	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS UPDATE.EXE
PID 1568 wrote to memory of 1560	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS UPDATE.EXE
PID 1568 wrote to memory of 1560	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS UPDATE.EXE
PID 1568 wrote to memory of 1560	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS UPDATE.EXE
PID 1568 wrote to memory of 1560	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS UPDATE.EXE
PID 1568 wrote to memory of 880	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS.EXE
PID 1568 wrote to memory of 880	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS.EXE
PID 1568 wrote to memory of 880	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS.EXE
PID 1568 wrote to memory of 880	1568	6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe	WINDOWS.EXE
PID 1560 wrote to memory of 1060	1560	WINDOWS UPDATE.EXE	server.exe
PID 1560 wrote to memory of 1060	1560	WINDOWS UPDATE.EXE	server.exe
PID 1560 wrote to memory of 1060	1560	WINDOWS UPDATE.EXE	server.exe
PID 1560 wrote to memory of 1060	1560	WINDOWS UPDATE.EXE	server.exe
PID 1224 wrote to memory of 1588	1224	NOTEPAD.EXE	sihost64.exe
PID 1224 wrote to memory of 1588	1224	NOTEPAD.EXE	sihost64.exe
PID 1224 wrote to memory of 1588	1224	NOTEPAD.EXE	sihost64.exe
PID 652 wrote to memory of 1712	652	CHROME.EXE	cmd.exe
PID 652 wrote to memory of 1712	652	CHROME.EXE	cmd.exe
PID 652 wrote to memory of 1712	652	CHROME.EXE	cmd.exe
PID 960 wrote to memory of 1112	960	CHROME UPDATE.EXE	cmd.exe
PID 960 wrote to memory of 1112	960	CHROME UPDATE.EXE	cmd.exe
PID 960 wrote to memory of 1112	960	CHROME UPDATE.EXE	cmd.exe
PID 1112 wrote to memory of 1300	1112	cmd.exe	powershell.exe
PID 1112 wrote to memory of 1300	1112	cmd.exe	powershell.exe
PID 1112 wrote to memory of 1300	1112	cmd.exe	powershell.exe
PID 1712 wrote to memory of 2036	1712	cmd.exe	powershell.exe
PID 1712 wrote to memory of 2036	1712	cmd.exe	powershell.exe
PID 1712 wrote to memory of 2036	1712	cmd.exe	powershell.exe
PID 972 wrote to memory of 1368	972	GOOGLE CHROME.EXE	cmd.exe
PID 972 wrote to memory of 1368	972	GOOGLE CHROME.EXE	cmd.exe
PID 972 wrote to memory of 1368	972	GOOGLE CHROME.EXE	cmd.exe
PID 972 wrote to memory of 1368	972	GOOGLE CHROME.EXE	cmd.exe
PID 1060 wrote to memory of 1736	1060	server.exe	netsh.exe
PID 1060 wrote to memory of 1736	1060	server.exe	netsh.exe
PID 1060 wrote to memory of 1736	1060	server.exe	netsh.exe
PID 1060 wrote to memory of 1736	1060	server.exe	netsh.exe
PID 1368 wrote to memory of 1764	1368	cmd.exe	timeout.exe
PID 1368 wrote to memory of 1764	1368	cmd.exe	timeout.exe
PID 1368 wrote to memory of 1764	1368	cmd.exe	timeout.exe
PID 1368 wrote to memory of 1764	1368	cmd.exe	timeout.exe
PID 1112 wrote to memory of 992	1112	cmd.exe	powershell.exe
PID 1112 wrote to memory of 992	1112	cmd.exe	powershell.exe

outlook_office_path 1 IoCs

Processes:

GOOGLE CHROME.EXE

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	GOOGLE CHROME.EXE

outlook_win_path 1 IoCs

Processes:

GOOGLE CHROME.EXE

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	GOOGLE CHROME.EXE

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:472

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1028

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1840

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\system32\taskeng.exe
taskeng.exe {4A4AD126-6CA0-4132-A1D9-330E6873B2A1} S-1-5-18:NT AUTHORITY\System:Service:
3⤵
PID:620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('nslookstager')).EntryPoint.Invoke($Null,$Null)"
4⤵
- Drops file in System32 directory
PID:892

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
3⤵
PID:1156

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
3⤵
PID:1908

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
3⤵
PID:2320

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{fe308cda-c6cc-45af-a770-395e2f48c3cd}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:480

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe
"C:\Users\Admin\AppData\Local\Temp\6fe04c8791ef39d3256b229ecb5e574d450e8c0e59300c32658e940880aa2929.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\CHROME UPDATE.EXE
"C:\Users\Admin\AppData\Local\Temp\CHROME UPDATE.EXE"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\system32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "servicesupdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\servicesupdate.exe"
4⤵
PID:460

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "servicesupdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\servicesupdate.exe"
5⤵
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\servicesupdate.exe"
4⤵
- Loads dropped DLL
PID:1740

C:\Users\Admin\AppData\Roaming\Microsoft\servicesupdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\servicesupdate.exe
5⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
6⤵
PID:2628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
7⤵
- Drops file in System32 directory
PID:2740

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
7⤵
PID:2068

C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"
6⤵
PID:2232

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "uflniqjjzekonnq"
7⤵
PID:2540

C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE
"C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "GOOGLE CHROME.EXE"
4⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\timeout.exe
C:\Windows\system32\timeout.exe 3
5⤵
- Delays execution with timeout.exe
PID:1764

C:\Users\Admin\AppData\Local\Temp\CHROME.EXE
"C:\Users\Admin\AppData\Local\Temp\CHROME.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\System32\nslookup.exe
C:\Windows\System32\nslookup.exe
4⤵
- Drops file in Windows directory
PID:292

C:\Windows\system32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
4⤵
PID:688

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
5⤵
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
4⤵
- Loads dropped DLL
PID:1584

C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
5⤵
- Executes dropped EXE
PID:1300

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
6⤵
PID:2644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
7⤵
- Drops file in System32 directory
PID:2812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
7⤵
PID:3000

C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"
6⤵
PID:2236

C:\Windows\System32\nslookup.exe
C:\Windows\System32\nslookup.exe sftvajqyhq0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJS5a+kDe4w1mLzYsRI/LuCd6FAArVGer+fGI7AGs5V/i1l3RkntgnURxXlB6//2VjxVCI+Y6C+CXIc06SY0rs6kBeXVFHc2CHK39Mfl0SjCv7idMDtIMYnUkXuL3CDdDxh8N8AmoKBatGiJsH0Rbb52aAJmb4vq3sWUtVan9b4riuhJfhV7s/ssXFVbyBZM7oqx/ZG1guFpT334AoH/LyKl2GU3UlJ+xWa5R9QGSALZ93yai32VNe3EiSxlcjwWccfm4+dDfYIe1/oNXvKQcvYm58w4oha65/CLmmwfV0MRLFUmx7aZywYBY41aLenObWAPiQmf9dzCvLpdIhSZMVhKh2WQMM3g7f6U+DzDbAIQ6KKyVRXQ9i4ep5kcxvRG7GVQSXXvE7U0aRZThxD21wjOx5m07be+XADWn0AVjktWo33v6RYjetPkeb6WXmTp08Oqlj3o88lt8OE0RVizcsjhdCFoi9TI+IockCfmpTYG1sHOnaPjLG0RiVNb+yqvAtXiy8zKnecp7CZuu4b/jiFW8sQelPXB9cVk01Kkb4I1daMatStvVzc0KSVG8mKggxec8XjPfyFNTdwC6YmaLprIY1qtgre6j93Lsp4RvRk08GiA7Z8m7c93+5XI8z6UdPqP50axZPkt4XplOgRZuDsdsULEm5QwCfDQ453GqGAbN1KbMIIsyvIkYTlNPgq06Pz1T5lVNMVXeFpapiDKKOdEjwiidghJqBkx9fGVUUJ5hROYSaHIe3H7XBQ2uA1aylhpGUQf8xpWLy+t1n9yA8YzzS9mX8HkCswg+95bJbWIXuHdgBsFKKgR+r/4nuEK11pTaplR1OK+cnNprdEfTuWu
6⤵
PID:2376

C:\Users\Admin\AppData\Local\Temp\NOTEPAD.EXE
"C:\Users\Admin\AppData\Local\Temp\NOTEPAD.EXE"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588

C:\Users\Admin\Services.exe
"C:\Users\Admin\Services.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe"
6⤵
- Loads dropped DLL
PID:2524

C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE
"C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
PID:1396

C:\Users\Admin\AppData\Local\Temp\WINDOWS UPDATE.EXE
"C:\Users\Admin\AppData\Local\Temp\WINDOWS UPDATE.EXE"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
5⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\WINDOWS.EXE
"C:\Users\Admin\AppData\Local\Temp\WINDOWS.EXE"
3⤵
- Executes dropped EXE
- Windows security modification
PID:880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2228

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-955212664-542999169-402258478-1339758484-10441627512057984126-1555214416-1179236442"
1⤵
PID:292

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-381878113-1481400355-269823666-607488833175319282-17511718796928141961654871576"
1⤵
PID:452

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "886460600102002272119862520261136950804495943247-489831858-641860445-1578910835"
1⤵
PID:1968

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1118577655-196544183-674225567-429746600-374442078-1200251688796442435-245605186"
1⤵
PID:2272

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1630258181694775677-612772791-724931474-362489693861577580-2109303854-1086612743"
1⤵
PID:2664

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-798401809-810364931-1982717819-91476897-12184778506285588374824982501133416944"
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CHROME UPDATE.EXE

MD5
0097f768c3d8c2bb8f03f62e227dfc8a

SHA1
a58b4f7e2c8e814a9bdd84362f554e07bc93eaf7

SHA256
a8a600735f68498af695ad4500fc153cb22ce6a04dc1e8db382a185af710368e

SHA512
5457ffd3cd953a1df98776d37218f94e88494d0263939860277661321b22aae605316d3061788282e9e3c303a9d4d27bbd7a1b376ac3204f3e8de64cf6fb3c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\CHROME UPDATE.EXE

MD5
0097f768c3d8c2bb8f03f62e227dfc8a

SHA1
a58b4f7e2c8e814a9bdd84362f554e07bc93eaf7

SHA256
a8a600735f68498af695ad4500fc153cb22ce6a04dc1e8db382a185af710368e

SHA512
5457ffd3cd953a1df98776d37218f94e88494d0263939860277661321b22aae605316d3061788282e9e3c303a9d4d27bbd7a1b376ac3204f3e8de64cf6fb3c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\CHROME.EXE

MD5
522967bd7cf9c8ca72ea418316fb1766

SHA1
bbc7e5fb8600a4ec86d15fd511fa2d00918b3626

SHA256
86c43915d81769522d2ca2a0a43907a624502355a109286e121c5cf363d6ba36

SHA512
de054c47fc7861c39aebc8b46ae064a49e8c5347894482c5921ed319d6df61305eb8e606f77d23d708f2dffc4c0881d53f7f890331815a3581b96cb1ed9b68c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CHROME.EXE

MD5
522967bd7cf9c8ca72ea418316fb1766

SHA1
bbc7e5fb8600a4ec86d15fd511fa2d00918b3626

SHA256
86c43915d81769522d2ca2a0a43907a624502355a109286e121c5cf363d6ba36

SHA512
de054c47fc7861c39aebc8b46ae064a49e8c5347894482c5921ed319d6df61305eb8e606f77d23d708f2dffc4c0881d53f7f890331815a3581b96cb1ed9b68c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE

MD5
57c55fda46addb304afe6ae1e556349d

SHA1
3d710a7e837dad90d8beb7be57caa5aa6f2f5b2f

SHA256
de4e562c74f0e15ff99add8883953ad5fae2856be71f2f6b5988bffd314ac6e7

SHA512
f188651e4662233a5690acbe96338772dc520961f08f457f255ae783293f80ceb7b13855c7de3fc7c65e64f22e0eca87f1bb72fa9d7d691392761c74eb91fe3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE

MD5
57c55fda46addb304afe6ae1e556349d

SHA1
3d710a7e837dad90d8beb7be57caa5aa6f2f5b2f

SHA256
de4e562c74f0e15ff99add8883953ad5fae2856be71f2f6b5988bffd314ac6e7

SHA512
f188651e4662233a5690acbe96338772dc520961f08f457f255ae783293f80ceb7b13855c7de3fc7c65e64f22e0eca87f1bb72fa9d7d691392761c74eb91fe3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\NOTEPAD.EXE

MD5
5e54a1c7a9157dfa8a6fd04ccbf552ee

SHA1
ee2007d8c10d5a5b6eeae1a28c3ec1b4614cbd3b

SHA256
8edeafcac47a8afdb8812fe48da3941e659a260e0509b67983a158d5debdd308

SHA512
32733a9ece59b0958c29e19e8d154af201e00146c3d4eca4792d2f83c914b5d2f16837999d2216721d5537836b4ddb0ec8b0c174959ce7daced2fbd3d61baae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\NOTEPAD.EXE

MD5
5e54a1c7a9157dfa8a6fd04ccbf552ee

SHA1
ee2007d8c10d5a5b6eeae1a28c3ec1b4614cbd3b

SHA256
8edeafcac47a8afdb8812fe48da3941e659a260e0509b67983a158d5debdd308

SHA512
32733a9ece59b0958c29e19e8d154af201e00146c3d4eca4792d2f83c914b5d2f16837999d2216721d5537836b4ddb0ec8b0c174959ce7daced2fbd3d61baae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5
b30bd52a30d2035d5ef49b9b89575f81

SHA1
9062331b82003031cdf20dd7a35d9903c6d3a161

SHA256
2d2ceb896bf2f2af272245a052c936a9e45df7bded60a09ba3a1debc3aff1c4c

SHA512
a133f36adacf045150cc3ec8908b15e2bb9aca4487a10d9113c0e102cda4212f6e50483fa75ef46550aad44e8395881b8863e6d64fb55747e080132ebd75d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5
b30bd52a30d2035d5ef49b9b89575f81

SHA1
9062331b82003031cdf20dd7a35d9903c6d3a161

SHA256
2d2ceb896bf2f2af272245a052c936a9e45df7bded60a09ba3a1debc3aff1c4c

SHA512
a133f36adacf045150cc3ec8908b15e2bb9aca4487a10d9113c0e102cda4212f6e50483fa75ef46550aad44e8395881b8863e6d64fb55747e080132ebd75d1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDOWS UPDATE.EXE

MD5
d157b480e55e02d5eb5af195f7eaf41a

SHA1
264d93242c3d3ef3640d6c6548e5cb7a088e8d5c

SHA256
b4a63629d1d2c8b7320b1372cf46e3e0c05bf1d1ddf7f89deb644aacf9e51f3b

SHA512
b139d58a899306ae16db844dacf7975e1ea4fd9f4c6dde30730bc7ddc850e3033cf5c60cb9ddd743984728b81f1f3c4dc8b8ca19b00b85dc3f447d0a1072a815

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDOWS UPDATE.EXE

MD5
d157b480e55e02d5eb5af195f7eaf41a

SHA1
264d93242c3d3ef3640d6c6548e5cb7a088e8d5c

SHA256
b4a63629d1d2c8b7320b1372cf46e3e0c05bf1d1ddf7f89deb644aacf9e51f3b

SHA512
b139d58a899306ae16db844dacf7975e1ea4fd9f4c6dde30730bc7ddc850e3033cf5c60cb9ddd743984728b81f1f3c4dc8b8ca19b00b85dc3f447d0a1072a815

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDOWS.EXE

MD5
8ff3198dbd93b447202687b8aa137f83

SHA1
aa33a67075d4a5d0a73d8efa98b9ffa3d9efc1f2

SHA256
8e0a8ec3a6504e973530c5cc92f9f304b5858bc7eac627eb7d4d4347b407dd59

SHA512
f97b66d21f757cdfe58d5f504b1cd5267dbcbb515afb3a932a73154fc3de3f027346540ad2483b9b3aeef22ddd3e7a446f76bb96319fd6b4ab9b37ff67174be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDOWS.EXE

MD5
8ff3198dbd93b447202687b8aa137f83

SHA1
aa33a67075d4a5d0a73d8efa98b9ffa3d9efc1f2

SHA256
8e0a8ec3a6504e973530c5cc92f9f304b5858bc7eac627eb7d4d4347b407dd59

SHA512
f97b66d21f757cdfe58d5f504b1cd5267dbcbb515afb3a932a73154fc3de3f027346540ad2483b9b3aeef22ddd3e7a446f76bb96319fd6b4ab9b37ff67174be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

MD5
d157b480e55e02d5eb5af195f7eaf41a

SHA1
264d93242c3d3ef3640d6c6548e5cb7a088e8d5c

SHA256
b4a63629d1d2c8b7320b1372cf46e3e0c05bf1d1ddf7f89deb644aacf9e51f3b

SHA512
b139d58a899306ae16db844dacf7975e1ea4fd9f4c6dde30730bc7ddc850e3033cf5c60cb9ddd743984728b81f1f3c4dc8b8ca19b00b85dc3f447d0a1072a815

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

MD5
d157b480e55e02d5eb5af195f7eaf41a

SHA1
264d93242c3d3ef3640d6c6548e5cb7a088e8d5c

SHA256
b4a63629d1d2c8b7320b1372cf46e3e0c05bf1d1ddf7f89deb644aacf9e51f3b

SHA512
b139d58a899306ae16db844dacf7975e1ea4fd9f4c6dde30730bc7ddc850e3033cf5c60cb9ddd743984728b81f1f3c4dc8b8ca19b00b85dc3f447d0a1072a815

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5
ce3c72565102596d88885a7fedc5817c

SHA1
232371fcb7f0c6ac60fcdc0a51e8d0ea2fbedb4f

SHA256
0d68096f4e5f3e72abc91bc66da857477da40ed38f4db3a4a9669692bcf77efd

SHA512
b9523b4bee6a4d5f4dde0c5917b0c725aa87a0fc06d9fc531394337127a9f373628576baec2e8e124ded3b4c0d20c6e2fb4d6c62e2d8e726f352e59ae643db4b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5
ce3c72565102596d88885a7fedc5817c

SHA1
232371fcb7f0c6ac60fcdc0a51e8d0ea2fbedb4f

SHA256
0d68096f4e5f3e72abc91bc66da857477da40ed38f4db3a4a9669692bcf77efd

SHA512
b9523b4bee6a4d5f4dde0c5917b0c725aa87a0fc06d9fc531394337127a9f373628576baec2e8e124ded3b4c0d20c6e2fb4d6c62e2d8e726f352e59ae643db4b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5
ce3c72565102596d88885a7fedc5817c

SHA1
232371fcb7f0c6ac60fcdc0a51e8d0ea2fbedb4f

SHA256
0d68096f4e5f3e72abc91bc66da857477da40ed38f4db3a4a9669692bcf77efd

SHA512
b9523b4bee6a4d5f4dde0c5917b0c725aa87a0fc06d9fc531394337127a9f373628576baec2e8e124ded3b4c0d20c6e2fb4d6c62e2d8e726f352e59ae643db4b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5
ce3c72565102596d88885a7fedc5817c

SHA1
232371fcb7f0c6ac60fcdc0a51e8d0ea2fbedb4f

SHA256
0d68096f4e5f3e72abc91bc66da857477da40ed38f4db3a4a9669692bcf77efd

SHA512
b9523b4bee6a4d5f4dde0c5917b0c725aa87a0fc06d9fc531394337127a9f373628576baec2e8e124ded3b4c0d20c6e2fb4d6c62e2d8e726f352e59ae643db4b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\services.exe

MD5
522967bd7cf9c8ca72ea418316fb1766

SHA1
bbc7e5fb8600a4ec86d15fd511fa2d00918b3626

SHA256
86c43915d81769522d2ca2a0a43907a624502355a109286e121c5cf363d6ba36

SHA512
de054c47fc7861c39aebc8b46ae064a49e8c5347894482c5921ed319d6df61305eb8e606f77d23d708f2dffc4c0881d53f7f890331815a3581b96cb1ed9b68c4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\servicesupdate.exe

MD5
0097f768c3d8c2bb8f03f62e227dfc8a

SHA1
a58b4f7e2c8e814a9bdd84362f554e07bc93eaf7

SHA256
a8a600735f68498af695ad4500fc153cb22ce6a04dc1e8db382a185af710368e

SHA512
5457ffd3cd953a1df98776d37218f94e88494d0263939860277661321b22aae605316d3061788282e9e3c303a9d4d27bbd7a1b376ac3204f3e8de64cf6fb3c08

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\servicesupdate.exe

MD5
0097f768c3d8c2bb8f03f62e227dfc8a

SHA1
a58b4f7e2c8e814a9bdd84362f554e07bc93eaf7

SHA256
a8a600735f68498af695ad4500fc153cb22ce6a04dc1e8db382a185af710368e

SHA512
5457ffd3cd953a1df98776d37218f94e88494d0263939860277661321b22aae605316d3061788282e9e3c303a9d4d27bbd7a1b376ac3204f3e8de64cf6fb3c08

Download Submit
C:\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe

MD5
05faed7f121c996f0c6c0b6f4e589202

SHA1
e2c2b553d7d3f881fbd6318d2d6d5afcff2efb53

SHA256
51a37ed6a20474cb765135681840abed6b1ed4b2ccb7575d59d3140bc6bd02f4

SHA512
d5536b5a62087c934b78b3c5514a5b4e7d629fc9598ed8f98d32d3a6cdedbb7ae3068c454af73c0704a4e48f2d58aca38e9dd0d20088eb213854a24fc6294eca

Download Submit
C:\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe

MD5
05faed7f121c996f0c6c0b6f4e589202

SHA1
e2c2b553d7d3f881fbd6318d2d6d5afcff2efb53

SHA256
51a37ed6a20474cb765135681840abed6b1ed4b2ccb7575d59d3140bc6bd02f4

SHA512
d5536b5a62087c934b78b3c5514a5b4e7d629fc9598ed8f98d32d3a6cdedbb7ae3068c454af73c0704a4e48f2d58aca38e9dd0d20088eb213854a24fc6294eca

Download Submit
C:\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe

MD5
05faed7f121c996f0c6c0b6f4e589202

SHA1
e2c2b553d7d3f881fbd6318d2d6d5afcff2efb53

SHA256
51a37ed6a20474cb765135681840abed6b1ed4b2ccb7575d59d3140bc6bd02f4

SHA512
d5536b5a62087c934b78b3c5514a5b4e7d629fc9598ed8f98d32d3a6cdedbb7ae3068c454af73c0704a4e48f2d58aca38e9dd0d20088eb213854a24fc6294eca

Download Submit
C:\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe

MD5
05faed7f121c996f0c6c0b6f4e589202

SHA1
e2c2b553d7d3f881fbd6318d2d6d5afcff2efb53

SHA256
51a37ed6a20474cb765135681840abed6b1ed4b2ccb7575d59d3140bc6bd02f4

SHA512
d5536b5a62087c934b78b3c5514a5b4e7d629fc9598ed8f98d32d3a6cdedbb7ae3068c454af73c0704a4e48f2d58aca38e9dd0d20088eb213854a24fc6294eca

Download Submit
C:\Users\Admin\Services.exe

MD5
5e54a1c7a9157dfa8a6fd04ccbf552ee

SHA1
ee2007d8c10d5a5b6eeae1a28c3ec1b4614cbd3b

SHA256
8edeafcac47a8afdb8812fe48da3941e659a260e0509b67983a158d5debdd308

SHA512
32733a9ece59b0958c29e19e8d154af201e00146c3d4eca4792d2f83c914b5d2f16837999d2216721d5537836b4ddb0ec8b0c174959ce7daced2fbd3d61baae7

Download Submit
C:\Users\Admin\Services.exe

MD5
5e54a1c7a9157dfa8a6fd04ccbf552ee

SHA1
ee2007d8c10d5a5b6eeae1a28c3ec1b4614cbd3b

SHA256
8edeafcac47a8afdb8812fe48da3941e659a260e0509b67983a158d5debdd308

SHA512
32733a9ece59b0958c29e19e8d154af201e00146c3d4eca4792d2f83c914b5d2f16837999d2216721d5537836b4ddb0ec8b0c174959ce7daced2fbd3d61baae7

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-convert-l1-1-0.dll

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-environment-l1-1-0.dll

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-filesystem-l1-1-0.dll

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-heap-l1-1-0.dll

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-locale-l1-1-0.dll

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-math-l1-1-0.dll

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-multibyte-l1-1-0.dll

MD5
35fc66bd813d0f126883e695664e7b83

SHA1
2fd63c18cc5dc4defc7ea82f421050e668f68548

SHA256
66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735

SHA512
65f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-runtime-l1-1-0.dll

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-stdio-l1-1-0.dll

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-string-l1-1-0.dll

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-time-l1-1-0.dll

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\api-ms-win-crt-utility-l1-1-0.dll

MD5
b52a0ca52c9c207874639b62b6082242

SHA1
6fb845d6a82102ff74bd35f42a2844d8c450413b

SHA256
a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0

SHA512
18834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\mozglue.dll

MD5
9e682f1eb98a9d41468fc3e50f907635

SHA1
85e0ceca36f657ddf6547aa0744f0855a27527ee

SHA256
830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d

SHA512
230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\msvcp140.dll

MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\nss3.dll

MD5
556ea09421a0f74d31c4c0a89a70dc23

SHA1
f739ba9b548ee64b13eb434a3130406d23f836e3

SHA256
f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb

SHA512
2481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2

Download Submit
\Users\Admin\AppData\Local\Temp\ADBB9ACD\vcruntime140.dll

MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
\Users\Admin\AppData\Local\Temp\CHROME UPDATE.EXE

MD5
0097f768c3d8c2bb8f03f62e227dfc8a

SHA1
a58b4f7e2c8e814a9bdd84362f554e07bc93eaf7

SHA256
a8a600735f68498af695ad4500fc153cb22ce6a04dc1e8db382a185af710368e

SHA512
5457ffd3cd953a1df98776d37218f94e88494d0263939860277661321b22aae605316d3061788282e9e3c303a9d4d27bbd7a1b376ac3204f3e8de64cf6fb3c08

Download Submit
\Users\Admin\AppData\Local\Temp\CHROME.EXE

MD5
522967bd7cf9c8ca72ea418316fb1766

SHA1
bbc7e5fb8600a4ec86d15fd511fa2d00918b3626

SHA256
86c43915d81769522d2ca2a0a43907a624502355a109286e121c5cf363d6ba36

SHA512
de054c47fc7861c39aebc8b46ae064a49e8c5347894482c5921ed319d6df61305eb8e606f77d23d708f2dffc4c0881d53f7f890331815a3581b96cb1ed9b68c4

Download Submit
\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE

MD5
57c55fda46addb304afe6ae1e556349d

SHA1
3d710a7e837dad90d8beb7be57caa5aa6f2f5b2f

SHA256
de4e562c74f0e15ff99add8883953ad5fae2856be71f2f6b5988bffd314ac6e7

SHA512
f188651e4662233a5690acbe96338772dc520961f08f457f255ae783293f80ceb7b13855c7de3fc7c65e64f22e0eca87f1bb72fa9d7d691392761c74eb91fe3c

Download Submit
\Users\Admin\AppData\Local\Temp\GOOGLE CHROME.EXE

MD5
57c55fda46addb304afe6ae1e556349d

SHA1
3d710a7e837dad90d8beb7be57caa5aa6f2f5b2f

SHA256
de4e562c74f0e15ff99add8883953ad5fae2856be71f2f6b5988bffd314ac6e7

SHA512
f188651e4662233a5690acbe96338772dc520961f08f457f255ae783293f80ceb7b13855c7de3fc7c65e64f22e0eca87f1bb72fa9d7d691392761c74eb91fe3c

Download Submit
\Users\Admin\AppData\Local\Temp\NOTEPAD.EXE

MD5
5e54a1c7a9157dfa8a6fd04ccbf552ee

SHA1
ee2007d8c10d5a5b6eeae1a28c3ec1b4614cbd3b

SHA256
8edeafcac47a8afdb8812fe48da3941e659a260e0509b67983a158d5debdd308

SHA512
32733a9ece59b0958c29e19e8d154af201e00146c3d4eca4792d2f83c914b5d2f16837999d2216721d5537836b4ddb0ec8b0c174959ce7daced2fbd3d61baae7

Download Submit
\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5
b30bd52a30d2035d5ef49b9b89575f81

SHA1
9062331b82003031cdf20dd7a35d9903c6d3a161

SHA256
2d2ceb896bf2f2af272245a052c936a9e45df7bded60a09ba3a1debc3aff1c4c

SHA512
a133f36adacf045150cc3ec8908b15e2bb9aca4487a10d9113c0e102cda4212f6e50483fa75ef46550aad44e8395881b8863e6d64fb55747e080132ebd75d1fd

Download Submit
\Users\Admin\AppData\Local\Temp\WINDOWS UPDATE.EXE

MD5
d157b480e55e02d5eb5af195f7eaf41a

SHA1
264d93242c3d3ef3640d6c6548e5cb7a088e8d5c

SHA256
b4a63629d1d2c8b7320b1372cf46e3e0c05bf1d1ddf7f89deb644aacf9e51f3b

SHA512
b139d58a899306ae16db844dacf7975e1ea4fd9f4c6dde30730bc7ddc850e3033cf5c60cb9ddd743984728b81f1f3c4dc8b8ca19b00b85dc3f447d0a1072a815

Download Submit
\Users\Admin\AppData\Local\Temp\WINDOWS.EXE

MD5
8ff3198dbd93b447202687b8aa137f83

SHA1
aa33a67075d4a5d0a73d8efa98b9ffa3d9efc1f2

SHA256
8e0a8ec3a6504e973530c5cc92f9f304b5858bc7eac627eb7d4d4347b407dd59

SHA512
f97b66d21f757cdfe58d5f504b1cd5267dbcbb515afb3a932a73154fc3de3f027346540ad2483b9b3aeef22ddd3e7a446f76bb96319fd6b4ab9b37ff67174be7

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

MD5
d157b480e55e02d5eb5af195f7eaf41a

SHA1
264d93242c3d3ef3640d6c6548e5cb7a088e8d5c

SHA256
b4a63629d1d2c8b7320b1372cf46e3e0c05bf1d1ddf7f89deb644aacf9e51f3b

SHA512
b139d58a899306ae16db844dacf7975e1ea4fd9f4c6dde30730bc7ddc850e3033cf5c60cb9ddd743984728b81f1f3c4dc8b8ca19b00b85dc3f447d0a1072a815

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\services.exe

MD5
522967bd7cf9c8ca72ea418316fb1766

SHA1
bbc7e5fb8600a4ec86d15fd511fa2d00918b3626

SHA256
86c43915d81769522d2ca2a0a43907a624502355a109286e121c5cf363d6ba36

SHA512
de054c47fc7861c39aebc8b46ae064a49e8c5347894482c5921ed319d6df61305eb8e606f77d23d708f2dffc4c0881d53f7f890331815a3581b96cb1ed9b68c4

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\servicesupdate.exe

MD5
0097f768c3d8c2bb8f03f62e227dfc8a

SHA1
a58b4f7e2c8e814a9bdd84362f554e07bc93eaf7

SHA256
a8a600735f68498af695ad4500fc153cb22ce6a04dc1e8db382a185af710368e

SHA512
5457ffd3cd953a1df98776d37218f94e88494d0263939860277661321b22aae605316d3061788282e9e3c303a9d4d27bbd7a1b376ac3204f3e8de64cf6fb3c08

Download Submit
\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe

MD5
05faed7f121c996f0c6c0b6f4e589202

SHA1
e2c2b553d7d3f881fbd6318d2d6d5afcff2efb53

SHA256
51a37ed6a20474cb765135681840abed6b1ed4b2ccb7575d59d3140bc6bd02f4

SHA512
d5536b5a62087c934b78b3c5514a5b4e7d629fc9598ed8f98d32d3a6cdedbb7ae3068c454af73c0704a4e48f2d58aca38e9dd0d20088eb213854a24fc6294eca

Download Submit
\Users\Admin\AppData\Roaming\WinCFG\Libs\sihost64.exe

MD5
05faed7f121c996f0c6c0b6f4e589202

SHA1
e2c2b553d7d3f881fbd6318d2d6d5afcff2efb53

SHA256
51a37ed6a20474cb765135681840abed6b1ed4b2ccb7575d59d3140bc6bd02f4

SHA512
d5536b5a62087c934b78b3c5514a5b4e7d629fc9598ed8f98d32d3a6cdedbb7ae3068c454af73c0704a4e48f2d58aca38e9dd0d20088eb213854a24fc6294eca

Download Submit
\Users\Admin\Services.exe

MD5
5e54a1c7a9157dfa8a6fd04ccbf552ee

SHA1
ee2007d8c10d5a5b6eeae1a28c3ec1b4614cbd3b

SHA256
8edeafcac47a8afdb8812fe48da3941e659a260e0509b67983a158d5debdd308

SHA512
32733a9ece59b0958c29e19e8d154af201e00146c3d4eca4792d2f83c914b5d2f16837999d2216721d5537836b4ddb0ec8b0c174959ce7daced2fbd3d61baae7

Download Submit
memory/292-188-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-184-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-191-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-190-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-196-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-183-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-192-0x0000000140002348-mapping.dmp

Download
memory/292-189-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-185-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-187-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/292-186-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/296-274-0x0000000001F90000-0x0000000001FBA000-memory.dmp

Filesize
168KB

Download
memory/416-214-0x0000000000940000-0x0000000000963000-memory.dmp

Filesize
140KB

Download
memory/416-215-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/416-237-0x0000000000940000-0x0000000000963000-memory.dmp

Filesize
140KB

Download
memory/416-283-0x0000000037220000-0x0000000037230000-memory.dmp

Filesize
64KB

Download
memory/416-277-0x0000000000A90000-0x0000000000ABA000-memory.dmp

Filesize
168KB

Download
memory/460-194-0x0000000000000000-mapping.dmp

Download
memory/464-222-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/464-223-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download
memory/472-226-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/472-227-0x0000000000240000-0x000000000026A000-memory.dmp

Filesize
168KB

Download
memory/472-229-0x0000000037220000-0x0000000037230000-memory.dmp

Filesize
64KB

Download
memory/480-233-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/480-234-0x00000000003C0000-0x00000000003EA000-memory.dmp

Filesize
168KB

Download
memory/480-235-0x0000000037220000-0x0000000037230000-memory.dmp

Filesize
64KB

Download
memory/580-238-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/580-269-0x0000000037220000-0x0000000037230000-memory.dmp

Filesize
64KB

Download
memory/580-240-0x0000000000200000-0x000000000022A000-memory.dmp

Filesize
168KB

Download
memory/652-120-0x000000001BF00000-0x000000001C166000-memory.dmp

Filesize
2.4MB

Download
memory/652-131-0x000000001BC14000-0x000000001BC16000-memory.dmp

Filesize
8KB

Download
memory/652-133-0x000000001BC16000-0x000000001BC17000-memory.dmp

Filesize
4KB

Download
memory/652-116-0x0000000000A20000-0x0000000000C87000-memory.dmp

Filesize
2.4MB

Download
memory/652-122-0x000000001BF00000-0x000000001C166000-memory.dmp

Filesize
2.4MB

Download
memory/652-136-0x000000001BC17000-0x000000001BC18000-memory.dmp

Filesize
4KB

Download
memory/652-60-0x0000000000000000-mapping.dmp

Download
memory/652-118-0x000000001BC12000-0x000000001BC14000-memory.dmp

Filesize
8KB

Download
memory/660-245-0x00000000001E0000-0x000000000020A000-memory.dmp

Filesize
168KB

Download
memory/660-244-0x0000000037220000-0x0000000037230000-memory.dmp

Filesize
64KB

Download
memory/660-241-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/688-197-0x0000000000000000-mapping.dmp

Download
memory/736-250-0x0000000000B90000-0x0000000000BBA000-memory.dmp

Filesize
168KB

Download
memory/736-254-0x0000000037220000-0x0000000037230000-memory.dmp

Filesize
64KB

Download
memory/736-246-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/800-260-0x0000000037220000-0x0000000037230000-memory.dmp

Filesize
64KB

Download
memory/800-251-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/828-257-0x000007FEBD920000-0x000007FEBD930000-memory.dmp

Filesize
64KB

Download
memory/880-80-0x0000000000000000-mapping.dmp

Download
memory/880-87-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/880-85-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/892-213-0x0000000000000000-mapping.dmp

Download
memory/948-182-0x000000013FE20000-0x0000000140F96000-memory.dmp

Filesize
17.5MB

Download
memory/948-181-0x000000013FE20000-0x0000000140F96000-memory.dmp

Filesize
17.5MB

Download
memory/948-179-0x0000000000000000-mapping.dmp

Download
memory/960-137-0x000000001B9C7000-0x000000001B9C8000-memory.dmp

Filesize
4KB

Download
memory/960-121-0x000000001BC40000-0x000000001BE38000-memory.dmp

Filesize
2.0MB

Download
memory/960-130-0x000000001B9C4000-0x000000001B9C6000-memory.dmp

Filesize
8KB

Download
memory/960-119-0x000000001BC40000-0x000000001BE38000-memory.dmp

Filesize
2.0MB

Download
memory/960-57-0x0000000000000000-mapping.dmp

Download
memory/960-117-0x000000001B9C2000-0x000000001B9C4000-memory.dmp

Filesize
8KB

Download
memory/960-115-0x0000000000860000-0x0000000000A57000-memory.dmp

Filesize
2.0MB

Download
memory/960-132-0x000000001B9C6000-0x000000001B9C7000-memory.dmp

Filesize
4KB

Download
memory/972-64-0x0000000000000000-mapping.dmp

Download
memory/992-165-0x000007FEEAD90000-0x000007FEEB8ED000-memory.dmp

Filesize
11.4MB

Download
memory/992-168-0x00000000028C2000-0x00000000028C4000-memory.dmp

Filesize
8KB

Download
memory/992-176-0x00000000028CB000-0x00000000028EA000-memory.dmp

Filesize
124KB

Download
memory/992-174-0x000000001B7B0000-0x000000001BAAF000-memory.dmp

Filesize
3.0MB

Download
memory/992-160-0x0000000000000000-mapping.dmp

Download
memory/992-169-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/992-167-0x00000000028C0000-0x00000000028C2000-memory.dmp

Filesize
8KB

Download
memory/1028-282-0x00000000007C0000-0x00000000007EA000-memory.dmp

Filesize
168KB

Download
memory/1060-94-0x0000000000000000-mapping.dmp

Download
memory/1060-100-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1064-195-0x0000000000000000-mapping.dmp

Download
memory/1112-135-0x0000000000000000-mapping.dmp

Download
memory/1192-211-0x00000000771E0000-0x0000000077389000-memory.dmp

Filesize
1.7MB

Download
memory/1192-209-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1192-219-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1192-212-0x0000000076FC0000-0x00000000770DF000-memory.dmp

Filesize
1.1MB

Download
memory/1192-210-0x0000000140002498-mapping.dmp

Download
memory/1224-68-0x0000000000000000-mapping.dmp

Download
memory/1224-86-0x000000013FE30000-0x0000000140FA6000-memory.dmp

Filesize
17.5MB

Download
memory/1224-88-0x000000013FE30000-0x0000000140FA6000-memory.dmp

Filesize
17.5MB

Download
memory/1300-158-0x00000000025BB000-0x00000000025DA000-memory.dmp

Filesize
124KB

Download
memory/1300-138-0x0000000000000000-mapping.dmp

Download
memory/1300-248-0x0000000000000000-mapping.dmp

Download
memory/1300-147-0x00000000025B4000-0x00000000025B7000-memory.dmp

Filesize
12KB

Download
memory/1300-140-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download
memory/1300-146-0x00000000025B2000-0x00000000025B4000-memory.dmp

Filesize
8KB

Download
memory/1300-143-0x000007FEEB730000-0x000007FEEC28D000-memory.dmp

Filesize
11.4MB

Download
memory/1300-145-0x00000000025B0000-0x00000000025B2000-memory.dmp

Filesize
8KB

Download
memory/1300-157-0x000000001B8C0000-0x000000001BBBF000-memory.dmp

Filesize
3.0MB

Download
memory/1368-151-0x0000000000000000-mapping.dmp

Download
memory/1396-89-0x0000000000D80000-0x0000000000D88000-memory.dmp

Filesize
32KB

Download
memory/1396-92-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/1396-90-0x0000000000D80000-0x0000000000D88000-memory.dmp

Filesize
32KB

Download
memory/1396-72-0x0000000000000000-mapping.dmp

Download
memory/1560-75-0x0000000000000000-mapping.dmp

Download
memory/1560-83-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/1568-55-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download
memory/1584-232-0x0000000000000000-mapping.dmp

Download
memory/1588-127-0x000000013FB00000-0x000000013FB06000-memory.dmp

Filesize
24KB

Download
memory/1588-128-0x000000013FB00000-0x000000013FB06000-memory.dmp

Filesize
24KB

Download
memory/1588-124-0x0000000000000000-mapping.dmp

Download
memory/1712-134-0x0000000000000000-mapping.dmp

Download
memory/1736-152-0x0000000000000000-mapping.dmp

Download
memory/1740-230-0x0000000000000000-mapping.dmp

Download
memory/1764-153-0x0000000000000000-mapping.dmp

Download
memory/1956-206-0x00000000771E0000-0x0000000077389000-memory.dmp

Filesize
1.7MB

Download
memory/1956-263-0x0000000000000000-mapping.dmp

Download
memory/1956-208-0x000000000108B000-0x00000000010AA000-memory.dmp

Filesize
124KB

Download
memory/1956-205-0x0000000001084000-0x0000000001087000-memory.dmp

Filesize
12KB

Download
memory/1956-204-0x0000000001082000-0x0000000001084000-memory.dmp

Filesize
8KB

Download
memory/1956-203-0x0000000001080000-0x0000000001082000-memory.dmp

Filesize
8KB

Download
memory/1956-202-0x000007FEEB730000-0x000007FEEC28D000-memory.dmp

Filesize
11.4MB

Download
memory/1956-199-0x0000000000000000-mapping.dmp

Download
memory/1956-207-0x0000000076FC0000-0x00000000770DF000-memory.dmp

Filesize
1.1MB

Download
memory/2008-198-0x0000000000000000-mapping.dmp

Download
memory/2016-177-0x00000000024BB000-0x00000000024DA000-memory.dmp

Filesize
124KB

Download
memory/2016-175-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Filesize
3.0MB

Download
memory/2016-173-0x00000000024B4000-0x00000000024B7000-memory.dmp

Filesize
12KB

Download
memory/2016-172-0x00000000024B2000-0x00000000024B4000-memory.dmp

Filesize
8KB

Download
memory/2016-171-0x00000000024B0000-0x00000000024B2000-memory.dmp

Filesize
8KB

Download
memory/2016-170-0x000007FEEAD90000-0x000007FEEB8ED000-memory.dmp

Filesize
11.4MB

Download
memory/2016-162-0x0000000000000000-mapping.dmp

Download
memory/2036-159-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/2036-144-0x000007FEEB730000-0x000007FEEC28D000-memory.dmp

Filesize
11.4MB

Download
memory/2036-150-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/2036-149-0x0000000002832000-0x0000000002834000-memory.dmp

Filesize
8KB

Download
memory/2036-148-0x0000000002830000-0x0000000002832000-memory.dmp

Filesize
8KB

Download
memory/2036-139-0x0000000000000000-mapping.dmp

Download
memory/2036-156-0x000000001B7F0000-0x000000001BAEF000-memory.dmp

Filesize
3.0MB

Download
memory/2068-403-0x0000000000000000-mapping.dmp

Download
memory/2228-328-0x0000000000000000-mapping.dmp

Download
memory/2232-436-0x0000000000000000-mapping.dmp

Download
memory/2236-413-0x0000000000000000-mapping.dmp

Download
memory/2320-337-0x0000000000000000-mapping.dmp

Download
memory/2376-432-0x0000000140310068-mapping.dmp

Download
memory/2524-356-0x0000000000000000-mapping.dmp

Download
memory/2628-365-0x0000000000000000-mapping.dmp

Download
memory/2644-364-0x0000000000000000-mapping.dmp

Download
memory/2740-380-0x0000000000000000-mapping.dmp

Download
memory/2812-381-0x0000000000000000-mapping.dmp

Download
memory/3000-396-0x0000000000000000-mapping.dmp

Download