dcrat | c28979c726cf60a9bfe8fb473783fb3e86dba470901d3ad459d9065bf85c66b7

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2022 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

207KB
MD5

3b1642dd6d275aff1067b8362e9db661
SHA1

6adf323b248923b10e2fecba3da8d3d1162359e5
SHA256

c28979c726cf60a9bfe8fb473783fb3e86dba470901d3ad459d9065bf85c66b7
SHA512

a26ec16b579991d7684aff23c871367a03b3fdff6b13391ac21aa95f8239ac707d4ac05ab91df54e1887163cb571cd2c1c1d03093b7e6966e775d647640eed82
SSDEEP

3072:e2MZ56J2ZblR+S/5CW3ZGijWi2qwx6yiNgCvYNQ:mph8ExjjKx6yZV

Malware Config

Extracted

Family

redline

Botnet

mario_new

176.122.23.55:11768

Attributes

auth_value
eeee8d5fcc3ba3a42094ef260c5bdcb4

Extracted

Family

socelars

https://dfgrthres.s3.eu-west-3.amazonaws.com/asdhs909/

Extracted

Family

redline

Botnet

1337

78.153.144.6:2510

Attributes

auth_value
b0447922bcbc2eda83260a9e7a638f45

Extracted

Family

redline

Botnet

nam5

103.89.90.61:34589

Attributes

auth_value
f23be8e9063fe5d0c6fc3ee8e7d565bd

Extracted

Family

djvu

http://acacaca.org/lancer/get.php

Attributes

extension
.mmdt
offline_id
yd6oYv6aBN90yFzTWdZ34sXSXtXiauzOLXZyWht1
payload_url
http://rgyui.top/dl/build2.exe

http://acacaca.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-xuPJqoyzQE Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0557Jhyjd

rsa_pubkey.plain

Extracted

Family

raccoon

Botnet

567d5bff28c2a18132d2f88511f07435

http://116.203.167.5/

http://195.201.248.58/

rc4.plain

Signatures

DcRat 3 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Processes:

file.exeschtasks.exeschtasks.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe
6384 schtasks.exe
7432 schtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
6384	schtasks.exe
7432	schtasks.exe

Detected Djvu ransomware 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/6104-288-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/6104-293-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5736-290-0x00000000048D0000-0x00000000049EB000-memory.dmp	family_djvu
behavioral2/memory/6104-289-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/6104-302-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/6104-309-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/7160-313-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/7160-315-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/7160-317-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4004-133-0x00000000048B0000-0x00000000048B9000-memory.dmp	family_smokeloader
behavioral2/memory/1948-152-0x0000000002C90000-0x0000000002C99000-memory.dmp	family_smokeloader

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	59668	4640	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	4640	rundll32.exe

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/59216-195-0x0000000000810000-0x0000000000870000-memory.dmp	family_redline
behavioral2/memory/5796-273-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/5996-281-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/46832-200-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars
behavioral2/memory/46832-212-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars
behavioral2/memory/1524-240-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars
behavioral2/memory/1524-267-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 4264 created 4548	4264	svchost.exe	DAE7.exe
PID 4264 created 4636	4264	svchost.exe	csrss.exe
PID 4264 created 4636	4264	svchost.exe	csrss.exe

Downloads MZ/PE file

Executes dropped EXE 26 IoCs

Processes:

1CDE.exe444D.exe6515.exe86B8.exe903F.exe9987.exeAD00.exeAD00.exeDAE7.exeDFAB.exeDFAB.exeE8A5.exeDAE7.execsrss.exe6DC.exe92F.exeA59.exe114F.exe172C.exe17F8.exe25C4.exe172C.execlient32.exeinjector.exe172C.exe172C.exe

pid	process
2200	1CDE.exe
1948	444D.exe
736	6515.exe
936	86B8.exe
46556	903F.exe
46832	9987.exe
59476	AD00.exe
59560	AD00.exe
4548	DAE7.exe
4216	DFAB.exe
760	DFAB.exe
1524	E8A5.exe
388	DAE7.exe
4636	csrss.exe
1732	6DC.exe
2240	92F.exe
4612	A59.exe
5624	114F.exe
5736	172C.exe
5756	17F8.exe
6076	25C4.exe
6104	172C.exe
6264	client32.exe
6688	injector.exe
6764	172C.exe
7160	172C.exe

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4880 netsh.exe

pid	process
4880	netsh.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\9987.exe	upx
C:\Users\Admin\AppData\Local\Temp\9987.exe	upx
behavioral2/memory/46832-200-0x0000000000400000-0x000000000058E000-memory.dmp	upx
behavioral2/memory/46832-212-0x0000000000400000-0x000000000058E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\E8A5.exe	upx
C:\Users\Admin\AppData\Local\Temp\E8A5.exe	upx
behavioral2/memory/1524-240-0x0000000000400000-0x000000000058E000-memory.dmp	upx
behavioral2/memory/1524-267-0x0000000000400000-0x000000000058E000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\903F.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\903F.exe	vmprotect
behavioral2/memory/46556-182-0x0000000140000000-0x0000000140608000-memory.dmp	vmprotect
behavioral2/memory/2240-263-0x0000000140000000-0x0000000140608000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AD00.exeDFAB.exe25C4.exe172C.exe172C.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	AD00.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	DFAB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	25C4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	172C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	172C.exe

Drops startup file 1 IoCs

Processes:

25C4.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunsuport.ini.lnk 25C4.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorunsuport.ini.lnk	25C4.exe

Loads dropped DLL 12 IoCs

Processes:

regsvr32.exerundll32.exerundll32.execlient32.exe17F8.exe

pid	process
4316	regsvr32.exe
4316	regsvr32.exe
59692	rundll32.exe
2008	rundll32.exe
6264	client32.exe
6264	client32.exe
6264	client32.exe
6264	client32.exe
6264	client32.exe
5756	17F8.exe
5756	17F8.exe
5756	17F8.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

6624 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
6624	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DAE7.exe172C.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	DAE7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\79558734-2b13-4a42-93c5-d2a00f6470fd\\172C.exe\" --AutoStart"	172C.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

237 api.2ip.ua
238 api.2ip.ua
253 api.2ip.ua

flow	ioc
237	api.2ip.ua
238	api.2ip.ua
253	api.2ip.ua

Suspicious use of SetThreadContext 5 IoCs

Processes:

86B8.exe6DC.exeA59.exe172C.exe172C.exe

description	pid	process	target process
PID 936 set thread context of 59216	936	86B8.exe	AppLaunch.exe
PID 1732 set thread context of 5796	1732	6DC.exe	AppLaunch.exe
PID 4612 set thread context of 5996	4612	A59.exe	AppLaunch.exe
PID 5736 set thread context of 6104	5736	172C.exe	172C.exe
PID 6764 set thread context of 7160	6764	172C.exe	172C.exe

Drops file in Program Files directory 19 IoCs

Processes:

9987.exeE8A5.exe

description	ioc	process
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json	9987.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js	E8A5.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js	E8A5.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json	E8A5.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	9987.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js	9987.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	9987.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js	E8A5.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html	9987.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js	9987.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	E8A5.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js	E8A5.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js	9987.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html	E8A5.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js	9987.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png	E8A5.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js	E8A5.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png	9987.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js	9987.exe

Drops file in Windows directory 2 IoCs

Processes:

DAE7.exe

description ioc process

File opened for modification C:\Windows\rss DAE7.exe
File created C:\Windows\rss\csrss.exe DAE7.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

7620 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\rss	DAE7.exe
File created	C:\Windows\rss\csrss.exe	DAE7.exe

pid	process
7620	sc.exe

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4852	2200	WerFault.exe	1CDE.exe
46428	46556	WerFault.exe	903F.exe
59316	936	WerFault.exe	86B8.exe
59756	59692	WerFault.exe	rundll32.exe
1248	2008	WerFault.exe	rundll32.exe
5512	2240	WerFault.exe	92F.exe
6544	6172	WerFault.exe	explorer.exe
7728	5756	WerFault.exe	17F8.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file.exe444D.exe6515.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	444D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6515.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6515.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	444D.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	444D.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

6384 schtasks.exe
7432 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

8248 timeout.exe

pid	process
6384	schtasks.exe
7432	schtasks.exe

pid	process
8248	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

8184 taskkill.exe
59292 taskkill.exe
1152 taskkill.exe

pid	process
8184	taskkill.exe
59292	taskkill.exe
1152	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DAE7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	DAE7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	DAE7.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	109	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	169	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
4004	file.exe
4004	file.exe
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512
512

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

512
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

file.exe444D.exe6515.exe

pid process

4004 file.exe
1948 444D.exe
736 6515.exe
512
512
512
512
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

chrome.exechrome.exe

pid process

59736 chrome.exe
59736 chrome.exe
59736 chrome.exe
59736 chrome.exe
2112 chrome.exe
2112 chrome.exe
2112 chrome.exe
2112 chrome.exe
2112 chrome.exe

pid	process
512

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1CDE.exe9987.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2200	1CDE.exe
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeCreateTokenPrivilege	46832	9987.exe
Token: SeAssignPrimaryTokenPrivilege	46832	9987.exe
Token: SeLockMemoryPrivilege	46832	9987.exe
Token: SeIncreaseQuotaPrivilege	46832	9987.exe
Token: SeMachineAccountPrivilege	46832	9987.exe
Token: SeTcbPrivilege	46832	9987.exe
Token: SeSecurityPrivilege	46832	9987.exe
Token: SeTakeOwnershipPrivilege	46832	9987.exe
Token: SeLoadDriverPrivilege	46832	9987.exe
Token: SeSystemProfilePrivilege	46832	9987.exe
Token: SeSystemtimePrivilege	46832	9987.exe
Token: SeProfSingleProcessPrivilege	46832	9987.exe
Token: SeIncBasePriorityPrivilege	46832	9987.exe
Token: SeCreatePagefilePrivilege	46832	9987.exe
Token: SeCreatePermanentPrivilege	46832	9987.exe
Token: SeBackupPrivilege	46832	9987.exe
Token: SeRestorePrivilege	46832	9987.exe
Token: SeShutdownPrivilege	46832	9987.exe
Token: SeDebugPrivilege	46832	9987.exe
Token: SeAuditPrivilege	46832	9987.exe
Token: SeSystemEnvironmentPrivilege	46832	9987.exe
Token: SeChangeNotifyPrivilege	46832	9987.exe
Token: SeRemoteShutdownPrivilege	46832	9987.exe
Token: SeUndockPrivilege	46832	9987.exe
Token: SeSyncAgentPrivilege	46832	9987.exe
Token: SeEnableDelegationPrivilege	46832	9987.exe
Token: SeManageVolumePrivilege	46832	9987.exe
Token: SeImpersonatePrivilege	46832	9987.exe
Token: SeCreateGlobalPrivilege	46832	9987.exe
Token: 31	46832	9987.exe
Token: 32	46832	9987.exe
Token: 33	46832	9987.exe
Token: 34	46832	9987.exe
Token: 35	46832	9987.exe
Token: SeDebugPrivilege	59292	taskkill.exe
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512
Token: SeShutdownPrivilege	512
Token: SeCreatePagefilePrivilege	512

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

chrome.exechrome.execlient32.exe

pid	process
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
512
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
6264	client32.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exechrome.exe

pid	process
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
59736	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

pid process

512

pid	process
512

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exe86B8.exe9987.execmd.exeAD00.exerundll32.exechrome.exe

description	pid	process	target process
PID 512 wrote to memory of 2200	512		1CDE.exe
PID 512 wrote to memory of 2200	512		1CDE.exe
PID 512 wrote to memory of 2200	512		1CDE.exe
PID 512 wrote to memory of 1948	512		444D.exe
PID 512 wrote to memory of 1948	512		444D.exe
PID 512 wrote to memory of 1948	512		444D.exe
PID 512 wrote to memory of 736	512		6515.exe
PID 512 wrote to memory of 736	512		6515.exe
PID 512 wrote to memory of 736	512		6515.exe
PID 512 wrote to memory of 1372	512		regsvr32.exe
PID 512 wrote to memory of 1372	512		regsvr32.exe
PID 1372 wrote to memory of 4316	1372	regsvr32.exe	regsvr32.exe
PID 1372 wrote to memory of 4316	1372	regsvr32.exe	regsvr32.exe
PID 1372 wrote to memory of 4316	1372	regsvr32.exe	regsvr32.exe
PID 512 wrote to memory of 936	512		86B8.exe
PID 512 wrote to memory of 936	512		86B8.exe
PID 512 wrote to memory of 936	512		86B8.exe
PID 512 wrote to memory of 46556	512		903F.exe
PID 512 wrote to memory of 46556	512		903F.exe
PID 512 wrote to memory of 46832	512		9987.exe
PID 512 wrote to memory of 46832	512		9987.exe
PID 512 wrote to memory of 46832	512		9987.exe
PID 936 wrote to memory of 59216	936	86B8.exe	AppLaunch.exe
PID 936 wrote to memory of 59216	936	86B8.exe	AppLaunch.exe
PID 936 wrote to memory of 59216	936	86B8.exe	AppLaunch.exe
PID 936 wrote to memory of 59216	936	86B8.exe	AppLaunch.exe
PID 936 wrote to memory of 59216	936	86B8.exe	AppLaunch.exe
PID 46832 wrote to memory of 46688	46832	9987.exe	cmd.exe
PID 46832 wrote to memory of 46688	46832	9987.exe	cmd.exe
PID 46832 wrote to memory of 46688	46832	9987.exe	cmd.exe
PID 46688 wrote to memory of 59292	46688	cmd.exe	taskkill.exe
PID 46688 wrote to memory of 59292	46688	cmd.exe	taskkill.exe
PID 46688 wrote to memory of 59292	46688	cmd.exe	taskkill.exe
PID 512 wrote to memory of 59476	512		AD00.exe
PID 512 wrote to memory of 59476	512		AD00.exe
PID 512 wrote to memory of 59476	512		AD00.exe
PID 59476 wrote to memory of 59560	59476	AD00.exe	AD00.exe
PID 59476 wrote to memory of 59560	59476	AD00.exe	AD00.exe
PID 59476 wrote to memory of 59560	59476	AD00.exe	AD00.exe
PID 59668 wrote to memory of 59692	59668	rundll32.exe	rundll32.exe
PID 59668 wrote to memory of 59692	59668	rundll32.exe	rundll32.exe
PID 59668 wrote to memory of 59692	59668	rundll32.exe	rundll32.exe
PID 46832 wrote to memory of 59736	46832	9987.exe	chrome.exe
PID 46832 wrote to memory of 59736	46832	9987.exe	chrome.exe
PID 59736 wrote to memory of 59772	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 59772	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe
PID 59736 wrote to memory of 60012	59736	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4004

C:\Users\Admin\AppData\Local\Temp\1CDE.exe
C:\Users\Admin\AppData\Local\Temp\1CDE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 1484
2⤵
- Program crash
PID:4852

C:\Users\Admin\AppData\Local\Temp\444D.exe
C:\Users\Admin\AppData\Local\Temp\444D.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1948

C:\Users\Admin\AppData\Local\Temp\6515.exe
C:\Users\Admin\AppData\Local\Temp\6515.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2200 -ip 2200
1⤵
PID:2884

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\70BE.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\70BE.dll
2⤵
- Loads dropped DLL
PID:4316

C:\Users\Admin\AppData\Local\Temp\86B8.exe
C:\Users\Admin\AppData\Local\Temp\86B8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:59216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 55872
2⤵
- Program crash
PID:59316

C:\Users\Admin\AppData\Local\Temp\903F.exe
C:\Users\Admin\AppData\Local\Temp\903F.exe
1⤵
- Executes dropped EXE
PID:46556

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 46556 -s 424
2⤵
- Program crash
PID:46428

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 46556 -ip 46556
1⤵
PID:46696

C:\Users\Admin\AppData\Local\Temp\9987.exe
C:\Users\Admin\AppData\Local\Temp\9987.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:46832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:46688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:59292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:59736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff99e394f50,0x7ff99e394f60,0x7ff99e394f70
3⤵
PID:59772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
3⤵
PID:60012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:8
3⤵
PID:60024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
3⤵
PID:60232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
3⤵
PID:60380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
3⤵
PID:60388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
3⤵
PID:46688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
3⤵
PID:59484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4780 /prefetch:8
3⤵
PID:976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:8
3⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5048 /prefetch:8
3⤵
PID:3880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
3⤵
PID:3216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
3⤵
PID:5104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5688 /prefetch:8
3⤵
PID:1716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:8
3⤵
PID:4392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3788 /prefetch:8
3⤵
PID:2428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2971478430761053211,5813172249623539184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5280 /prefetch:8
3⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 936 -ip 936
1⤵
PID:59264

C:\Users\Admin\AppData\Local\Temp\AD00.exe
C:\Users\Admin\AppData\Local\Temp\AD00.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:59476

C:\Users\Admin\AppData\Local\Temp\AD00.exe
"C:\Users\Admin\AppData\Local\Temp\AD00.exe" -h
2⤵
- Executes dropped EXE
PID:59560

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:59668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:59692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 59692 -s 600
3⤵
- Program crash
PID:59756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 59692 -ip 59692
1⤵
PID:59720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60260

C:\Users\Admin\AppData\Local\Temp\DAE7.exe
C:\Users\Admin\AppData\Local\Temp\DAE7.exe
1⤵
- Executes dropped EXE
PID:4548

C:\Users\Admin\AppData\Local\Temp\DAE7.exe
"C:\Users\Admin\AppData\Local\Temp\DAE7.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:388

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:2884

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:4880

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
PID:4636

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- DcRat
- Creates scheduled task(s)
PID:6384

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:6416

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
PID:6688

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- DcRat
- Creates scheduled task(s)
PID:7432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
4⤵
PID:7548

C:\Windows\SysWOW64\sc.exe
sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
- Launches sc.exe
PID:7620

C:\Users\Admin\AppData\Local\Temp\DFAB.exe
C:\Users\Admin\AppData\Local\Temp\DFAB.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:4216

C:\Users\Admin\AppData\Local\Temp\DFAB.exe
"C:\Users\Admin\AppData\Local\Temp\DFAB.exe" -h
2⤵
- Executes dropped EXE
PID:760

C:\Users\Admin\AppData\Local\Temp\E8A5.exe
C:\Users\Admin\AppData\Local\Temp\E8A5.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
2⤵
PID:3440

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
3⤵
- Kills process with taskkill
PID:1152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99e394f50,0x7ff99e394f60,0x7ff99e394f70
3⤵
PID:4416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 /prefetch:8
3⤵
PID:5264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
3⤵
PID:5288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:1
3⤵
PID:5280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2028 /prefetch:8
3⤵
PID:5256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=2 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
3⤵
PID:5504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
3⤵
PID:5616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
3⤵
PID:5244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:8
3⤵
PID:5872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:8
3⤵
PID:5920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:8
3⤵
PID:5952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5572 /prefetch:8
3⤵
PID:6908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
3⤵
PID:6944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5344 /prefetch:8
3⤵
PID:6988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5448 /prefetch:8
3⤵
PID:7020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5400 /prefetch:8
3⤵
PID:7052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
3⤵
PID:7084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1960,7714334580007657268,8699593344178589132,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
3⤵
PID:7280

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:3552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 600
3⤵
- Program crash
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2008 -ip 2008
1⤵
PID:812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4264

C:\Users\Admin\AppData\Local\Temp\6DC.exe
C:\Users\Admin\AppData\Local\Temp\6DC.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\92F.exe
C:\Users\Admin\AppData\Local\Temp\92F.exe
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2240 -s 424
2⤵
- Program crash
PID:5512

C:\Users\Admin\AppData\Local\Temp\A59.exe
C:\Users\Admin\AppData\Local\Temp\A59.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:5996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 2240 -ip 2240
1⤵
PID:5224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\114F.exe
C:\Users\Admin\AppData\Local\Temp\114F.exe
1⤵
- Executes dropped EXE
PID:5624

C:\Users\Admin\AppData\Local\Temp\172C.exe
C:\Users\Admin\AppData\Local\Temp\172C.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5736

C:\Users\Admin\AppData\Local\Temp\172C.exe
C:\Users\Admin\AppData\Local\Temp\172C.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:6104

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\79558734-2b13-4a42-93c5-d2a00f6470fd" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:6624

C:\Users\Admin\AppData\Local\Temp\172C.exe
"C:\Users\Admin\AppData\Local\Temp\172C.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6764

C:\Users\Admin\AppData\Local\Temp\172C.exe
"C:\Users\Admin\AppData\Local\Temp\172C.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:7160

C:\Users\Admin\AppData\Local\4a203763-dfa1-4248-b173-f19b1df0c0a8\build2.exe
"C:\Users\Admin\AppData\Local\4a203763-dfa1-4248-b173-f19b1df0c0a8\build2.exe"
5⤵
PID:7392

C:\Users\Admin\AppData\Local\4a203763-dfa1-4248-b173-f19b1df0c0a8\build2.exe
"C:\Users\Admin\AppData\Local\4a203763-dfa1-4248-b173-f19b1df0c0a8\build2.exe"
6⤵
PID:7900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\4a203763-dfa1-4248-b173-f19b1df0c0a8\build2.exe" & del C:\PrograData\*.dll & exit
7⤵
PID:8132

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
PID:8184

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:8248

C:\Users\Admin\AppData\Local\Temp\17F8.exe
C:\Users\Admin\AppData\Local\Temp\17F8.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 1504
2⤵
- Program crash
PID:7728

C:\Users\Admin\AppData\Local\Temp\25C4.exe
C:\Users\Admin\AppData\Local\Temp\25C4.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
PID:6076

C:\Users\Admin\AppData\Roaming\windows_update_253746\client32.exe
"C:\Users\Admin\AppData\Roaming\windows_update_253746\client32.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:6264

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6172 -s 872
2⤵
- Program crash
PID:6544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6172 -ip 6172
1⤵
PID:6496

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6636

C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"
1⤵
PID:7504

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7636

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:7684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5756 -ip 5756
1⤵
PID:7712

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7748

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:7816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7860

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:8032

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:8084

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:8224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html
Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png
Filesize
6KB

MD5
c8d8c174df68910527edabe6b5278f06

SHA1
8ac53b3605fea693b59027b9b471202d150f266f

SHA256
9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5

SHA512
d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js
Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js
Filesize
20KB

MD5
3a293a98c3f7838965396f9e8d687d91

SHA1
f53665732d3c38f8d8f5c0ccad7f1a7e3d6eb186

SHA256
27b5cce20840ee8af2b55e8c3cc3e34017b28282b3577acbbeef3625e88c824b

SHA512
b63fdccf837a8007d27bcec760239cefdbe1974c77343bb583b490e11fc3123e94e4e453a164696455b7b76bce9806d146550f47aa6b719631bd23556b9de138

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js
Filesize
3KB

MD5
f79618c53614380c5fdc545699afe890

SHA1
7804a4621cd9405b6def471f3ebedb07fb17e90a

SHA256
f3f30c5c271f80b0a3a329b11d8e72eb404d0c0dc9c66fa162ca97ccaa1e963c

SHA512
c4e0c4df6ac92351591859a7c4358b3dcd342e00051bf561e68e3fcc2c94fdd8d14bd0a042d88dca33f6c7e952938786378d804f56e84b4eab99e2a5fee96a4c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js
Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js
Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js
Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json
Filesize
1KB

MD5
6da6b303170ccfdca9d9e75abbfb59f3

SHA1
1a8070080f50a303f73eba253ba49c1e6d400df6

SHA256
66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333

SHA512
872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9DD071679C018B2129B579E1C864DC6B
Filesize
600B

MD5
589e42bf0b9c372001898e750d3bffa2

SHA1
f34618c34ceb84e546d0c12117055e8424a121f7

SHA256
239cdf121564bf648d3e34b258dcb89039b90abc9f3d95221f8e4dcaa250fb51

SHA512
9a793f6f275f4915b90586b7dcbecb88eac32733a3ddba68382c7ae6b5deead8e7f952d4a049e39ea2ea07d98abb3eb1edf93a2f7f9716762e73acca7dba3979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_BE25D0FE540174A4A87E2295C663329D
Filesize
1KB

MD5
5a87acec8d6f410e56daa22f24221ef0

SHA1
e2ca8371bd15fb3271ba0a38f6b75df08cbe4087

SHA256
f81f9a5b8b47bb6d5fbfd9fc508d91a297d71b73467f6ed31239d7d8ce0c8ff1

SHA512
c925e76d3bc7682ddb6fadb71ec69462dfcd63f6cedc9ba7c2b547bce3da0545a68c03fec50d5155f94964ed0f7ac3e906ba2dfe146057582fbe7a8dd6bd446e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
d2a5e9c177aa521e9767c0d8c7e491b6

SHA1
a774a7daa11ee26228cabbe099c8b584893e9c79

SHA256
73da6ccf617b979c704a530b4cba6cc4b3200c38efa786c92b049e342d869d33

SHA512
8f7dcdaa68a1f1d1649eef835f8ec557c5b81f24a6dda8c0bebeb07625dfc57f21b3ccca345d0702c5c9256ed1062f79226e64617d62b3ccc941f49a62055c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9DD071679C018B2129B579E1C864DC6B
Filesize
496B

MD5
c2ec6c1b9c2c4ce004dceb4c6e10d183

SHA1
2939037316338d1617a4e9f6b8cc12c102c9b23b

SHA256
3a78df3c6e6aed7c951fff295b824552b6ead60cb394819faefd40a9e6f51198

SHA512
76376ce707c571ee44eebc47348d438485a541486f73f42515c84863888185098f42dbc59ce8bab69da189b7ad9863fb391526a50ff2ec6a8a16fae572127434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_BE25D0FE540174A4A87E2295C663329D
Filesize
482B

MD5
f6a220ac239566cacfdf6885eacb7f78

SHA1
fa7a17f683128759f2f2d96ef52802951bb6afd7

SHA256
f3f4f59d094820ede08ce09237a66e73f1ac726fe94037e397a16a0366bfce81

SHA512
f990e940f622cabcf51dbc1b63aaf7fd99ccd8bf5f5dbc490c0410ff42b443790d5a918cdc5c6bee4e3d97b25fc446865cd093cc3fe64e97735c0ab14ddeeee2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
87c6f7a12400e4d26086b4edcde0cf38

SHA1
55b84af207dbf774694363edd28d64e2012c1018

SHA256
e91547635729afce24b069a3c00a1868f62d01e3127e6b45adeef9fb0e7d5283

SHA512
dfc26d6a0ca2ad2d6c035a8dcef4949039196a94702f519b6fd46315b34bf836d1f1db11d68aa6298cee814ad7c8fb6e606592cbec8731a6eb8e480ee5b25418

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
1559a7f334a2ce6df79a10950c547903

SHA1
7ae1000039cfa1b7ff19535e260373ad1b913295

SHA256
fcf9fb4b70ba1a18829fd4673016a76b20e2c346a5c263650ac33c02b74f3f01

SHA512
04a8361758978b14f61a00eabf01b9db92c2f838abb031b0591741057f2b286c4a8c0936a71daa7a06882b007b373b2788f839c44723c677ecc2b05a78283ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CDE.exe
Filesize
419KB

MD5
7ee26071eccd624c58596bb7e356c8c3

SHA1
2c61201ce36e236c30c350bfae82fa74d21c89cb

SHA256
69fde9e6449ac4f800f47188a10e04db056c0b570876b254c93d3a8d94d2016b

SHA512
7cd53f55077e02d2982c15963da8ad0ccb254063196c21a8cc0803f474a86ddf5e8ba48c4d6b8f74020074b76319fde082fcc12bedd7c69e75e3597f2ec5f562

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CDE.exe
Filesize
419KB

MD5
7ee26071eccd624c58596bb7e356c8c3

SHA1
2c61201ce36e236c30c350bfae82fa74d21c89cb

SHA256
69fde9e6449ac4f800f47188a10e04db056c0b570876b254c93d3a8d94d2016b

SHA512
7cd53f55077e02d2982c15963da8ad0ccb254063196c21a8cc0803f474a86ddf5e8ba48c4d6b8f74020074b76319fde082fcc12bedd7c69e75e3597f2ec5f562

Download Submit
C:\Users\Admin\AppData\Local\Temp\444D.exe
Filesize
207KB

MD5
43b8954e8abf124849b8a0cc178937a4

SHA1
ce2395780e2ad5ec8dc89fdc0d22180d5cb648c6

SHA256
675fd5dc0b60f4210f218e3726f9c47c26a23a0eb796ea73a3c0eb8de7355770

SHA512
5afb02eeb7226103bf0845e47be52117087cdff4d8535d59380d05c24fb00b68aa92d17370aa9abc2d136e9c8046c8342b51d91447d91388277c53218d2e3d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\444D.exe
Filesize
207KB

MD5
43b8954e8abf124849b8a0cc178937a4

SHA1
ce2395780e2ad5ec8dc89fdc0d22180d5cb648c6

SHA256
675fd5dc0b60f4210f218e3726f9c47c26a23a0eb796ea73a3c0eb8de7355770

SHA512
5afb02eeb7226103bf0845e47be52117087cdff4d8535d59380d05c24fb00b68aa92d17370aa9abc2d136e9c8046c8342b51d91447d91388277c53218d2e3d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\6515.exe
Filesize
205KB

MD5
07a8bc35ca1632555dd46a6867f22dd7

SHA1
1feb0c4429e48bb877e9110c05a0a6022a3abacd

SHA256
496e0e9f8c0f4239f5ef32035a628fba3179722ae147e016ae72ae3a6d067433

SHA512
195fc4cb02c51bb0c4095c1657ab927e9efe5299067132c331fd183beae07a7cb4acf8824efa344ecba139bb20869894924701944241cc004a414092b8ef479b

Download Submit
C:\Users\Admin\AppData\Local\Temp\6515.exe
Filesize
205KB

MD5
07a8bc35ca1632555dd46a6867f22dd7

SHA1
1feb0c4429e48bb877e9110c05a0a6022a3abacd

SHA256
496e0e9f8c0f4239f5ef32035a628fba3179722ae147e016ae72ae3a6d067433

SHA512
195fc4cb02c51bb0c4095c1657ab927e9efe5299067132c331fd183beae07a7cb4acf8824efa344ecba139bb20869894924701944241cc004a414092b8ef479b

Download Submit
C:\Users\Admin\AppData\Local\Temp\70BE.dll
Filesize
1.2MB

MD5
43aa7572e12c1a6abc3693dc21263f3c

SHA1
03407624fb118ad0ee214a597e034e96da83dc5b

SHA256
3446ad49d514cc5847556076ec821602a48353fd794647b0df6092a2e5db0e8c

SHA512
f7660d97d2f7882b99d931b13c7a0b5ef74350dffffbdcdad01259e19cbd5fa3d6597c6d96b0fa937a07e6b88f6e977f2e3f1fd1c50dfa22c32151061d773071

Download Submit
C:\Users\Admin\AppData\Local\Temp\70BE.dll
Filesize
1.2MB

MD5
43aa7572e12c1a6abc3693dc21263f3c

SHA1
03407624fb118ad0ee214a597e034e96da83dc5b

SHA256
3446ad49d514cc5847556076ec821602a48353fd794647b0df6092a2e5db0e8c

SHA512
f7660d97d2f7882b99d931b13c7a0b5ef74350dffffbdcdad01259e19cbd5fa3d6597c6d96b0fa937a07e6b88f6e977f2e3f1fd1c50dfa22c32151061d773071

Download Submit
C:\Users\Admin\AppData\Local\Temp\70BE.dll
Filesize
1.2MB

MD5
43aa7572e12c1a6abc3693dc21263f3c

SHA1
03407624fb118ad0ee214a597e034e96da83dc5b

SHA256
3446ad49d514cc5847556076ec821602a48353fd794647b0df6092a2e5db0e8c

SHA512
f7660d97d2f7882b99d931b13c7a0b5ef74350dffffbdcdad01259e19cbd5fa3d6597c6d96b0fa937a07e6b88f6e977f2e3f1fd1c50dfa22c32151061d773071

Download Submit
C:\Users\Admin\AppData\Local\Temp\86B8.exe
Filesize
719KB

MD5
8cd2e049bdbb6954e7ddaed3eb63dc79

SHA1
f0715504d291f42753ccb8cb340524369da00d49

SHA256
f513aa13542f7444fffa8d5a826633fee3a90ff90e9d6fdc7c67211ab1d51205

SHA512
45539036718e6d90581d5e007f45e4e283d0a570c60b33c18194c3e1467dfe586a89da62f358ef959ab695bc0e45e77c57f88deb1433a4763ee640fb8d1e501b

Download Submit
C:\Users\Admin\AppData\Local\Temp\86B8.exe
Filesize
719KB

MD5
8cd2e049bdbb6954e7ddaed3eb63dc79

SHA1
f0715504d291f42753ccb8cb340524369da00d49

SHA256
f513aa13542f7444fffa8d5a826633fee3a90ff90e9d6fdc7c67211ab1d51205

SHA512
45539036718e6d90581d5e007f45e4e283d0a570c60b33c18194c3e1467dfe586a89da62f358ef959ab695bc0e45e77c57f88deb1433a4763ee640fb8d1e501b

Download Submit
C:\Users\Admin\AppData\Local\Temp\903F.exe
Filesize
3.5MB

MD5
5a5818de3886c0ffaa7071e70d003eb6

SHA1
c4e62f5c1b674a80fdd48b6fe37e3e59607a7f2e

SHA256
4fac63cb799cc9da04b4332602ad9b4538dd2429ffcf2f8065ec598b2c6aa6a2

SHA512
07ba01218477f3cacd9846b16d9dc742b0e8b4afdca43aba3696b742063316d7fe0c15504c8ebbee20f3f4b42532960698308b45e5d2b55fcc536af28522b8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\903F.exe
Filesize
3.5MB

MD5
5a5818de3886c0ffaa7071e70d003eb6

SHA1
c4e62f5c1b674a80fdd48b6fe37e3e59607a7f2e

SHA256
4fac63cb799cc9da04b4332602ad9b4538dd2429ffcf2f8065ec598b2c6aa6a2

SHA512
07ba01218477f3cacd9846b16d9dc742b0e8b4afdca43aba3696b742063316d7fe0c15504c8ebbee20f3f4b42532960698308b45e5d2b55fcc536af28522b8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\9987.exe
Filesize
675KB

MD5
9e9e7ad2a575a1ee322b618cb9cfdf05

SHA1
42dba5e712f382a684deb20ededef154c74b24bc

SHA256
1a90eaf03ec44e61a6ee97be6b8757cc12b9d0a5c2904fa3652d651a92bbd6f1

SHA512
0c48cc0988b1153d5442a0409911be9dbee1db5b2ea1d3f12847b12a4e70eb9416600ee079eac58d0c3ac628d388c6037574278f69d0e8e69f7c9f24a127bc5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9987.exe
Filesize
675KB

MD5
9e9e7ad2a575a1ee322b618cb9cfdf05

SHA1
42dba5e712f382a684deb20ededef154c74b24bc

SHA256
1a90eaf03ec44e61a6ee97be6b8757cc12b9d0a5c2904fa3652d651a92bbd6f1

SHA512
0c48cc0988b1153d5442a0409911be9dbee1db5b2ea1d3f12847b12a4e70eb9416600ee079eac58d0c3ac628d388c6037574278f69d0e8e69f7c9f24a127bc5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD00.exe
Filesize
84KB

MD5
2f60ef19334491b0800f818fe87c42f9

SHA1
a54541d84ffdd10c71053a4da5d2635129c1a5fa

SHA256
2b29136f3622d331c86855ab5298b22a996d7f894bd45c4d4a61a9460dfe2095

SHA512
97459e126e789b9425e8c6ea4afbc1f61732f98bad1539af6455e7154c72affd2b5ee2a6ad258a0da0fd19fd6b332c797be06aa2a757c0df90eed4f4426d5fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD00.exe
Filesize
84KB

MD5
2f60ef19334491b0800f818fe87c42f9

SHA1
a54541d84ffdd10c71053a4da5d2635129c1a5fa

SHA256
2b29136f3622d331c86855ab5298b22a996d7f894bd45c4d4a61a9460dfe2095

SHA512
97459e126e789b9425e8c6ea4afbc1f61732f98bad1539af6455e7154c72affd2b5ee2a6ad258a0da0fd19fd6b332c797be06aa2a757c0df90eed4f4426d5fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD00.exe
Filesize
84KB

MD5
2f60ef19334491b0800f818fe87c42f9

SHA1
a54541d84ffdd10c71053a4da5d2635129c1a5fa

SHA256
2b29136f3622d331c86855ab5298b22a996d7f894bd45c4d4a61a9460dfe2095

SHA512
97459e126e789b9425e8c6ea4afbc1f61732f98bad1539af6455e7154c72affd2b5ee2a6ad258a0da0fd19fd6b332c797be06aa2a757c0df90eed4f4426d5fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DAE7.exe
Filesize
4.0MB

MD5
f99d573625e45fc9d02bd27d30aa5839

SHA1
e12a9683a34b4e3d06d4f6d07851fa606a2a4556

SHA256
14d138ed08a4f1c0850a93312cec9258bc5a0e8942b57a582e47c258b91cfac6

SHA512
84b39b79549cf9d8b9e23c6c68f39f4a2453cd9322edf29c07534e3ae30a4524df937564a9c51c08f249be691aa97dca3a03e6f3677d6a3256d5e89b9293924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DAE7.exe
Filesize
4.0MB

MD5
f99d573625e45fc9d02bd27d30aa5839

SHA1
e12a9683a34b4e3d06d4f6d07851fa606a2a4556

SHA256
14d138ed08a4f1c0850a93312cec9258bc5a0e8942b57a582e47c258b91cfac6

SHA512
84b39b79549cf9d8b9e23c6c68f39f4a2453cd9322edf29c07534e3ae30a4524df937564a9c51c08f249be691aa97dca3a03e6f3677d6a3256d5e89b9293924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DAE7.exe
Filesize
4.0MB

MD5
f99d573625e45fc9d02bd27d30aa5839

SHA1
e12a9683a34b4e3d06d4f6d07851fa606a2a4556

SHA256
14d138ed08a4f1c0850a93312cec9258bc5a0e8942b57a582e47c258b91cfac6

SHA512
84b39b79549cf9d8b9e23c6c68f39f4a2453cd9322edf29c07534e3ae30a4524df937564a9c51c08f249be691aa97dca3a03e6f3677d6a3256d5e89b9293924d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DFAB.exe
Filesize
84KB

MD5
2f60ef19334491b0800f818fe87c42f9

SHA1
a54541d84ffdd10c71053a4da5d2635129c1a5fa

SHA256
2b29136f3622d331c86855ab5298b22a996d7f894bd45c4d4a61a9460dfe2095

SHA512
97459e126e789b9425e8c6ea4afbc1f61732f98bad1539af6455e7154c72affd2b5ee2a6ad258a0da0fd19fd6b332c797be06aa2a757c0df90eed4f4426d5fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DFAB.exe
Filesize
84KB

MD5
2f60ef19334491b0800f818fe87c42f9

SHA1
a54541d84ffdd10c71053a4da5d2635129c1a5fa

SHA256
2b29136f3622d331c86855ab5298b22a996d7f894bd45c4d4a61a9460dfe2095

SHA512
97459e126e789b9425e8c6ea4afbc1f61732f98bad1539af6455e7154c72affd2b5ee2a6ad258a0da0fd19fd6b332c797be06aa2a757c0df90eed4f4426d5fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DFAB.exe
Filesize
84KB

MD5
2f60ef19334491b0800f818fe87c42f9

SHA1
a54541d84ffdd10c71053a4da5d2635129c1a5fa

SHA256
2b29136f3622d331c86855ab5298b22a996d7f894bd45c4d4a61a9460dfe2095

SHA512
97459e126e789b9425e8c6ea4afbc1f61732f98bad1539af6455e7154c72affd2b5ee2a6ad258a0da0fd19fd6b332c797be06aa2a757c0df90eed4f4426d5fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\E8A5.exe
Filesize
675KB

MD5
9e9e7ad2a575a1ee322b618cb9cfdf05

SHA1
42dba5e712f382a684deb20ededef154c74b24bc

SHA256
1a90eaf03ec44e61a6ee97be6b8757cc12b9d0a5c2904fa3652d651a92bbd6f1

SHA512
0c48cc0988b1153d5442a0409911be9dbee1db5b2ea1d3f12847b12a4e70eb9416600ee079eac58d0c3ac628d388c6037574278f69d0e8e69f7c9f24a127bc5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E8A5.exe
Filesize
675KB

MD5
9e9e7ad2a575a1ee322b618cb9cfdf05

SHA1
42dba5e712f382a684deb20ededef154c74b24bc

SHA256
1a90eaf03ec44e61a6ee97be6b8757cc12b9d0a5c2904fa3652d651a92bbd6f1

SHA512
0c48cc0988b1153d5442a0409911be9dbee1db5b2ea1d3f12847b12a4e70eb9416600ee079eac58d0c3ac628d388c6037574278f69d0e8e69f7c9f24a127bc5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat
Filesize
557KB

MD5
2a03e19d5af7606e8e9a5c86a5a78880

SHA1
93945d1e473713d83316aaa9a297a417fb302db7

SHA256
15dea69e1ef7f927cdf56b7b6a31189b825b0cef06eeca4811006e7bf9d02c9a

SHA512
f263945af96cb0040d521832038862bfa05f4c9efd0eda0ae511dc1ab0ced179e0e64a3054de42bdc159db2520ff45f2b56ac08a7ac59bd01b74bbdf4b013f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat
Filesize
557KB

MD5
2a03e19d5af7606e8e9a5c86a5a78880

SHA1
93945d1e473713d83316aaa9a297a417fb302db7

SHA256
15dea69e1ef7f927cdf56b7b6a31189b825b0cef06eeca4811006e7bf9d02c9a

SHA512
f263945af96cb0040d521832038862bfa05f4c9efd0eda0ae511dc1ab0ced179e0e64a3054de42bdc159db2520ff45f2b56ac08a7ac59bd01b74bbdf4b013f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
60KB

MD5
4d11bd6f3172584b3fda0e9efcaf0ddb

SHA1
0581c7f087f6538a1b6d4f05d928c1df24236944

SHA256
73314490c80e5eb09f586e12c1f035c44f11aeaa41d2f4b08aca476132578930

SHA512
6a023496e7ee03c2ff8e3ba445c7d7d5bfe6a1e1e1bae5c17dcf41e78ede84a166966579bf8cc7be7450d2516f869713907775e863670b10eb60c092492d2d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
60KB

MD5
4d11bd6f3172584b3fda0e9efcaf0ddb

SHA1
0581c7f087f6538a1b6d4f05d928c1df24236944

SHA256
73314490c80e5eb09f586e12c1f035c44f11aeaa41d2f4b08aca476132578930

SHA512
6a023496e7ee03c2ff8e3ba445c7d7d5bfe6a1e1e1bae5c17dcf41e78ede84a166966579bf8cc7be7450d2516f869713907775e863670b10eb60c092492d2d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
60KB

MD5
4d11bd6f3172584b3fda0e9efcaf0ddb

SHA1
0581c7f087f6538a1b6d4f05d928c1df24236944

SHA256
73314490c80e5eb09f586e12c1f035c44f11aeaa41d2f4b08aca476132578930

SHA512
6a023496e7ee03c2ff8e3ba445c7d7d5bfe6a1e1e1bae5c17dcf41e78ede84a166966579bf8cc7be7450d2516f869713907775e863670b10eb60c092492d2d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll
Filesize
60KB

MD5
4d11bd6f3172584b3fda0e9efcaf0ddb

SHA1
0581c7f087f6538a1b6d4f05d928c1df24236944

SHA256
73314490c80e5eb09f586e12c1f035c44f11aeaa41d2f4b08aca476132578930

SHA512
6a023496e7ee03c2ff8e3ba445c7d7d5bfe6a1e1e1bae5c17dcf41e78ede84a166966579bf8cc7be7450d2516f869713907775e863670b10eb60c092492d2d04

Download Submit
\??\pipe\crashpad_59736_IHJKZCWPBHCPUKNE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/388-254-0x0000000000400000-0x0000000002F57000-memory.dmp

Filesize
43.3MB

Download
memory/388-260-0x0000000000400000-0x0000000002F57000-memory.dmp

Filesize
43.3MB

Download
memory/388-247-0x0000000000000000-mapping.dmp

Download
memory/388-253-0x0000000004A36000-0x0000000004E1F000-memory.dmp

Filesize
3.9MB

Download
memory/736-172-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/736-162-0x0000000002EB9000-0x0000000002ECA000-memory.dmp

Filesize
68KB

Download
memory/736-159-0x0000000000000000-mapping.dmp

Download
memory/736-165-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/760-230-0x0000000000000000-mapping.dmp

Download
memory/936-173-0x0000000000000000-mapping.dmp

Download
memory/1152-252-0x0000000000000000-mapping.dmp

Download
memory/1372-166-0x0000000000000000-mapping.dmp

Download
memory/1524-235-0x0000000000000000-mapping.dmp

Download
memory/1524-267-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-240-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/1732-258-0x0000000000000000-mapping.dmp

Download
memory/1948-158-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download
memory/1948-148-0x0000000000000000-mapping.dmp

Download
memory/1948-151-0x0000000002CC9000-0x0000000002CDA000-memory.dmp

Filesize
68KB

Download
memory/1948-152-0x0000000002C90000-0x0000000002C99000-memory.dmp

Filesize
36KB

Download
memory/1948-154-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download
memory/2008-239-0x0000000000000000-mapping.dmp

Download
memory/2200-140-0x0000000000920000-0x000000000095E000-memory.dmp

Filesize
248KB

Download
memory/2200-156-0x0000000006B50000-0x000000000707C000-memory.dmp

Filesize
5.2MB

Download
memory/2200-153-0x0000000006140000-0x00000000061A6000-memory.dmp

Filesize
408KB

Download
memory/2200-146-0x0000000005800000-0x0000000005812000-memory.dmp

Filesize
72KB

Download
memory/2200-145-0x00000000056D0000-0x00000000057DA000-memory.dmp

Filesize
1.0MB

Download
memory/2200-144-0x00000000058B0000-0x0000000005EC8000-memory.dmp

Filesize
6.1MB

Download
memory/2200-143-0x0000000005560000-0x00000000055F2000-memory.dmp

Filesize
584KB

Download
memory/2200-155-0x0000000006980000-0x0000000006B42000-memory.dmp

Filesize
1.8MB

Download
memory/2200-136-0x0000000000000000-mapping.dmp

Download
memory/2200-139-0x00000000009B9000-0x00000000009EA000-memory.dmp

Filesize
196KB

Download
memory/2200-147-0x0000000005820000-0x000000000585C000-memory.dmp

Filesize
240KB

Download
memory/2200-164-0x0000000000400000-0x000000000086C000-memory.dmp

Filesize
4.4MB

Download
memory/2200-163-0x00000000009B9000-0x00000000009EA000-memory.dmp

Filesize
196KB

Download
memory/2200-141-0x0000000000400000-0x000000000086C000-memory.dmp

Filesize
4.4MB

Download
memory/2200-142-0x0000000004F30000-0x00000000054D4000-memory.dmp

Filesize
5.6MB

Download
memory/2200-157-0x00000000009B9000-0x00000000009EA000-memory.dmp

Filesize
196KB

Download
memory/2240-261-0x0000000000000000-mapping.dmp

Download
memory/2240-263-0x0000000140000000-0x0000000140608000-memory.dmp

Filesize
6.0MB

Download
memory/2884-255-0x0000000000000000-mapping.dmp

Download
memory/3440-251-0x0000000000000000-mapping.dmp

Download
memory/4004-135-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4004-134-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/4004-133-0x00000000048B0000-0x00000000048B9000-memory.dmp

Filesize
36KB

Download
memory/4004-132-0x0000000002D8D000-0x0000000002D9E000-memory.dmp

Filesize
68KB

Download
memory/4216-227-0x0000000000000000-mapping.dmp

Download
memory/4316-181-0x0000000002A30000-0x0000000002AEE000-memory.dmp

Filesize
760KB

Download
memory/4316-176-0x00000000026D0000-0x00000000027EC000-memory.dmp

Filesize
1.1MB

Download
memory/4316-168-0x0000000000000000-mapping.dmp

Download
memory/4316-186-0x0000000002AF0000-0x0000000002B99000-memory.dmp

Filesize
676KB

Download
memory/4316-171-0x0000000002370000-0x00000000024AF000-memory.dmp

Filesize
1.2MB

Download
memory/4316-189-0x0000000002910000-0x0000000002A2C000-memory.dmp

Filesize
1.1MB

Download
memory/4316-177-0x0000000002910000-0x0000000002A2C000-memory.dmp

Filesize
1.1MB

Download
memory/4548-224-0x0000000000000000-mapping.dmp

Download
memory/4548-234-0x0000000000400000-0x0000000002F57000-memory.dmp

Filesize
43.3MB

Download
memory/4548-233-0x0000000005090000-0x0000000005906000-memory.dmp

Filesize
8.5MB

Download
memory/4548-232-0x0000000004B9B000-0x0000000004F84000-memory.dmp

Filesize
3.9MB

Download
memory/4548-270-0x0000000000400000-0x0000000002F57000-memory.dmp

Filesize
43.3MB

Download
memory/4612-262-0x0000000000000000-mapping.dmp

Download
memory/4636-259-0x0000000000000000-mapping.dmp

Download
memory/4636-274-0x0000000005000000-0x00000000053E9000-memory.dmp

Filesize
3.9MB

Download
memory/4636-320-0x0000000000400000-0x0000000002F57000-memory.dmp

Filesize
43.3MB

Download
memory/4636-279-0x0000000000400000-0x0000000002F57000-memory.dmp

Filesize
43.3MB

Download
memory/4880-256-0x0000000000000000-mapping.dmp

Download
memory/5624-268-0x0000000000000000-mapping.dmp

Download
memory/5736-291-0x00000000046F9000-0x000000000478B000-memory.dmp

Filesize
584KB

Download
memory/5736-290-0x00000000048D0000-0x00000000049EB000-memory.dmp

Filesize
1.1MB

Download
memory/5736-269-0x0000000000000000-mapping.dmp

Download
memory/5756-322-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download
memory/5756-292-0x0000000002C79000-0x0000000002C8A000-memory.dmp

Filesize
68KB

Download
memory/5756-271-0x0000000000000000-mapping.dmp

Download
memory/5756-294-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/5756-323-0x0000000002C79000-0x0000000002C8A000-memory.dmp

Filesize
68KB

Download
memory/5756-299-0x0000000000400000-0x0000000002B7F000-memory.dmp

Filesize
39.5MB

Download
memory/5796-272-0x0000000000000000-mapping.dmp

Download
memory/5796-318-0x0000000006980000-0x00000000069D0000-memory.dmp

Filesize
320KB

Download
memory/5796-273-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5996-307-0x0000000005800000-0x0000000005876000-memory.dmp

Filesize
472KB

Download
memory/5996-310-0x0000000007370000-0x000000000738E000-memory.dmp

Filesize
120KB

Download
memory/5996-280-0x0000000000000000-mapping.dmp

Download
memory/5996-281-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6076-286-0x0000000000000000-mapping.dmp

Download
memory/6104-289-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/6104-287-0x0000000000000000-mapping.dmp

Download
memory/6104-288-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/6104-309-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/6104-302-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/6104-293-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/6172-295-0x0000000000000000-mapping.dmp

Download
memory/6172-304-0x0000000000890000-0x00000000008FB000-memory.dmp

Filesize
428KB

Download
memory/6172-303-0x0000000000900000-0x0000000000974000-memory.dmp

Filesize
464KB

Download
memory/6264-296-0x0000000000000000-mapping.dmp

Download
memory/6384-297-0x0000000000000000-mapping.dmp

Download
memory/6416-298-0x0000000000000000-mapping.dmp

Download
memory/6624-300-0x0000000000000000-mapping.dmp

Download
memory/6636-306-0x0000000000110000-0x000000000011C000-memory.dmp

Filesize
48KB

Download
memory/6636-301-0x0000000000000000-mapping.dmp

Download
memory/6688-305-0x0000000000000000-mapping.dmp

Download
memory/6764-308-0x0000000000000000-mapping.dmp

Download
memory/6764-314-0x0000000002D8A000-0x0000000002E1C000-memory.dmp

Filesize
584KB

Download
memory/7160-313-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/7160-311-0x0000000000000000-mapping.dmp

Download
memory/7160-317-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/7160-315-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/7392-319-0x0000000000000000-mapping.dmp

Download
memory/7432-321-0x0000000000000000-mapping.dmp

Download
memory/7504-328-0x0000000074AC0000-0x0000000074DC1000-memory.dmp

Filesize
3.0MB

Download
memory/7504-326-0x0000000074FA0000-0x0000000075061000-memory.dmp

Filesize
772KB

Download
memory/7504-325-0x0000000074EA0000-0x0000000074ECA000-memory.dmp

Filesize
168KB

Download
memory/7504-324-0x0000000074FA0000-0x0000000075061000-memory.dmp

Filesize
772KB

Download
memory/7504-330-0x0000000074DD0000-0x0000000074E92000-memory.dmp

Filesize
776KB

Download
memory/7504-331-0x0000000074EA0000-0x0000000074ECA000-memory.dmp

Filesize
168KB

Download
memory/7504-327-0x0000000000DE0000-0x000000000122C000-memory.dmp

Filesize
4.3MB

Download
memory/7548-329-0x0000000000000000-mapping.dmp

Download
memory/7620-332-0x0000000000000000-mapping.dmp

Download
memory/7636-333-0x0000000000000000-mapping.dmp

Download
memory/7684-337-0x0000000000000000-mapping.dmp

Download
memory/7748-340-0x0000000000000000-mapping.dmp

Download
memory/7816-341-0x0000000000000000-mapping.dmp

Download
memory/7860-346-0x0000000000000000-mapping.dmp

Download
memory/7900-354-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/7900-351-0x0000000000000000-mapping.dmp

Download
memory/7900-353-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/7900-352-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/7992-357-0x0000000000000000-mapping.dmp

Download
memory/8032-361-0x0000000000000000-mapping.dmp

Download
memory/8084-364-0x0000000000000000-mapping.dmp

Download
memory/8132-367-0x0000000000000000-mapping.dmp

Download
memory/8184-369-0x0000000000000000-mapping.dmp

Download
memory/8224-370-0x0000000000000000-mapping.dmp

Download
memory/8248-371-0x0000000000000000-mapping.dmp

Download
memory/46556-178-0x0000000000000000-mapping.dmp

Download
memory/46556-182-0x0000000140000000-0x0000000140608000-memory.dmp

Filesize
6.0MB

Download
memory/46688-201-0x0000000000000000-mapping.dmp

Download
memory/46832-190-0x0000000000000000-mapping.dmp

Download
memory/46832-212-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/46832-200-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/59216-195-0x0000000000810000-0x0000000000870000-memory.dmp

Filesize
384KB

Download
memory/59216-194-0x0000000000000000-mapping.dmp

Download
memory/59292-202-0x0000000000000000-mapping.dmp

Download
memory/59476-203-0x0000000000000000-mapping.dmp

Download
memory/59560-206-0x0000000000000000-mapping.dmp

Download
memory/59692-209-0x0000000000000000-mapping.dmp

Download