05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0

Analysis

max time kernel
151s
max time network
158s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Size

536KB
MD5

4ab05f44a4ee4aeef3fffd08cf3897d0
SHA1

51b28c7b2f16458ef3a86e50014902c02a9e5001
SHA256

05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0
SHA512

fb5a8399c8275a1ab1c355e6daf1a3ae5c565bcf44d52a02ea1f4e2cf66db59249942acc49a2a84368fee685e793a334c00b7fe63cdc974d23f36cab9c8641c0
SSDEEP

12288:YqXg1EBXgR86OJqW3o8p8BS0TPt9yJLFk6A/sJJeio:YqFBwODYW3Vp8MA0

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	openfiles.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEUpdate\\openfiles.exe\""	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEUpdate\\openfiles.exe\""	openfiles.exe

Executes dropped EXE 9 IoCs

pid	Process
1916	openfiles.exe
2044	tmp75AD.exe
896	tmp75AD.exe
2024	openfiles.exe
1660	openfiles.exe
1736	openfiles.exe
1692	openfiles.exe
1980	openfiles.exe
1028	openfiles.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe

Deletes itself 1 IoCs

pid	Process
896	tmp75AD.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\openfiles.lnk	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe

Loads dropped DLL 7 IoCs

pid	Process
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1728	cmd.exe
1232	Process not Found
1232	Process not Found

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\openfiles = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEUpdate\\openfiles.exe\""	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\openfiles = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEUpdate\\openfiles.exe\""	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\openfiles = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEUpdate\\openfiles.exe\""	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\openfiles = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEUpdate\\openfiles.exe\""	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2044 set thread context of 896	2044	tmp75AD.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEUpdate\\openfiles.exe\""	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IEUpdate\\openfiles.exe\""	openfiles.exe

Modifies Internet Explorer Protected Mode 1 TTPs 50 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	openfiles.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 10 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\NoProtectedModeBanner = "1"	openfiles.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\openfiles.exe = "11000"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\openfiles.exe = "11000"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\DisableScriptDebuggerIE = "yes"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\PICTS\CheckedValue = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\DisableScriptDebuggerIE = "yes"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\openfiles.exe = "11000"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\openfiles.exe = "11000"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Display Inline Images = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Display Inline Images = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\openfiles.exe = "1"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Display Inline Images = "yes"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\openfiles.exe = "1"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Display Inline Images = "yes"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Disable Script Debugger = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Disable Script Debugger = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\PICTS\CheckedValue = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\openfiles.exe = "1"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\PICTS\CheckedValue = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Display Inline Images = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\DisableScriptDebuggerIE = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Disable Script Debugger = "yes"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\DisableScriptDebuggerIE = "yes"	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\PICTS\CheckedValue = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\openfiles.exe = "11000"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	openfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\DisableScriptDebuggerIE = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	openfiles.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	openfiles.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	openfiles.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GlobalUserOffline = "0"	openfiles.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\openfiles.exe = "1"	openfiles.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	openfiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	openfiles.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1864	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
2044	tmp75AD.exe
2044	tmp75AD.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe
1916	openfiles.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1916	openfiles.exe
1916	openfiles.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	openfiles.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1916	openfiles.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1736	openfiles.exe
1736	openfiles.exe
1692	openfiles.exe
1692	openfiles.exe
1980	openfiles.exe
1980	openfiles.exe
1028	openfiles.exe
1028	openfiles.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 2000 wrote to memory of 1984	2000	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	26
PID 1984 wrote to memory of 1916	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	27
PID 1984 wrote to memory of 1916	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	27
PID 1984 wrote to memory of 1916	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	27
PID 1984 wrote to memory of 1916	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	27
PID 1984 wrote to memory of 2044	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	28
PID 1984 wrote to memory of 2044	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	28
PID 1984 wrote to memory of 2044	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	28
PID 1984 wrote to memory of 2044	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	28
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 2044 wrote to memory of 896	2044	tmp75AD.exe	29
PID 1984 wrote to memory of 1728	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	30
PID 1984 wrote to memory of 1728	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	30
PID 1984 wrote to memory of 1728	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	30
PID 1984 wrote to memory of 1728	1984	05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe	30
PID 1728 wrote to memory of 2024	1728	cmd.exe	32
PID 1728 wrote to memory of 2024	1728	cmd.exe	32
PID 1728 wrote to memory of 2024	1728	cmd.exe	32
PID 1728 wrote to memory of 2024	1728	cmd.exe	32
PID 1728 wrote to memory of 1864	1728	cmd.exe	33
PID 1728 wrote to memory of 1864	1728	cmd.exe	33
PID 1728 wrote to memory of 1864	1728	cmd.exe	33
PID 1728 wrote to memory of 1864	1728	cmd.exe	33
PID 1916 wrote to memory of 1660	1916	openfiles.exe	34
PID 1916 wrote to memory of 1660	1916	openfiles.exe	34
PID 1916 wrote to memory of 1660	1916	openfiles.exe	34
PID 1916 wrote to memory of 1736	1916	openfiles.exe	36
PID 1916 wrote to memory of 1736	1916	openfiles.exe	36
PID 1916 wrote to memory of 1736	1916	openfiles.exe	36
PID 1736 wrote to memory of 2040	1736	openfiles.exe	37
PID 1736 wrote to memory of 2040	1736	openfiles.exe	37
PID 1736 wrote to memory of 2040	1736	openfiles.exe	37
PID 1736 wrote to memory of 268	1736	openfiles.exe	38
PID 1736 wrote to memory of 268	1736	openfiles.exe	38
PID 1736 wrote to memory of 268	1736	openfiles.exe	38
PID 1916 wrote to memory of 1692	1916	openfiles.exe	41
PID 1916 wrote to memory of 1692	1916	openfiles.exe	41
PID 1916 wrote to memory of 1692	1916	openfiles.exe	41
PID 1692 wrote to memory of 1288	1692	openfiles.exe	42
PID 1692 wrote to memory of 1288	1692	openfiles.exe	42
PID 1692 wrote to memory of 1288	1692	openfiles.exe	42
PID 1692 wrote to memory of 1752	1692	openfiles.exe	43
PID 1692 wrote to memory of 1752	1692	openfiles.exe	43
PID 1692 wrote to memory of 1752	1692	openfiles.exe	43
PID 1916 wrote to memory of 1980	1916	openfiles.exe	45
PID 1916 wrote to memory of 1980	1916	openfiles.exe	45
PID 1916 wrote to memory of 1980	1916	openfiles.exe	45

C:\Users\Admin\AppData\Local\Temp\05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
"C:\Users\Admin\AppData\Local\Temp\05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
  "C:\Users\Admin\AppData\Local\Temp\05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Looks for VirtualBox Guest Additions in registry
  - Adds policy Run key to start application
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies Control Panel
    - Modifies Internet Explorer Protected Mode
    - Modifies Internet Explorer Protected Mode Banner
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe" -standalone 131074 "-update_flash"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies system certificate store
      PID:1660
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe" -standalone 131074 "-new_session VzARUpK8yx0SE1wYQsfZdZcCgoto0"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer Protected Mode Banner
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:2040
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:268
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe" -standalone 131074 "-new_session 3I0RGKTvu76QznWxLqdbDUDBVcooH"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer Protected Mode Banner
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:1288
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:1752
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe" -standalone 131074 "-new_session f0eCeU0P4oyuF5IJPTiBGHhwfmknf"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer Protected Mode Banner
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1980
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:2000
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:1556
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe" -standalone 131074 "-new_session FksWeI6qNOahiacJkxV7WGd7Ixl1L"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer Protected Mode Banner
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1028
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:1700
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:1728
- - C:\Users\Admin\AppData\Local\Temp\tmp75AD.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp75AD.exe" "C:\Users\Admin\AppData\Local\Temp\05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\tmp75AD.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp75AD.exe" "C:\Users\Admin\AppData\Local\Temp\05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      PID:896
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ping 127.0.0.1 >> nul
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      PID:2024
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.bin\S-1-5-21-999675638-2867687379-27515722-1000\$ast-S-1-5-21-999675638-2867687379-27515722-1000\3c5zBuGDVZfQhfGALARSIKZ.dat

Filesize
6KB

MD5
092a72e8904b5d128955d2958fcba64e

SHA1
6461df4c6fe1eaebf5e56eb8ec12296e08a41ca4

SHA256
7f4a9d8d3807b82e60756df1eb579cff6dd291ee9075ef27402a693f04536f95

SHA512
af1fb1479ac213d8543fec3f32bf3d07976356599d86fc9d4282cd8aad958f5081d05851cf5790eb5e536b9df068fcb7f7a63d48edd8a57ae657a6135737e416

Download Submit
C:\$Recycle.bin\S-1-5-21-999675638-2867687379-27515722-1000\$ast-S-1-5-21-999675638-2867687379-27515722-1000\9EmBEdrVYMgSt7is3E96CNa_1.dat

Filesize
21KB

MD5
c2da06a44f61d634a4c2426ae4cfab02

SHA1
380f3884acc8b2145f111f4a2dc4b29ef745fa06

SHA256
9339a0713f24e487ed58622445d42c549a3ed2bfb4e3b0f1494586ce7030afa5

SHA512
aec2ecb25a960aa202ede2d84456407d07a2eeb750c1d894559c9b42302f9a1f849e12bb806a149eec5b60daec85614b6b90870aeca23e1577c57e6020d17ce5

Download Submit
C:\$Recycle.bin\S-1-5-21-999675638-2867687379-27515722-1000\$ast-S-1-5-21-999675638-2867687379-27515722-1000\DJ5MxB-vrC1UAXzCVNSAB1T.dat

Filesize
48KB

MD5
39e531eac86b7de60c14613b35ddb593

SHA1
9778c8fb472a24a904bc69f108c70c27ff43c1a4

SHA256
2420f40814f515f900f1828897e7ebe56fb062df3314dc5af9dd60901718fd60

SHA512
aaa99b9af38b9dc15597b941e94d618dce427c909bee3178b1936329eaf2d976af52c09aaec33c075a3499c3636b69e94b3c78fbe0892ad4cc9f534dba545b02

Download Submit
C:\$Recycle.bin\S-1-5-21-999675638-2867687379-27515722-1000\$ast-S-1-5-21-999675638-2867687379-27515722-1000\Fgyv_4pjBSK2irAnAH9jEeS4fiC5G.dat

Filesize
418B

MD5
973d930f29fe6c215682397f8f4b1b8a

SHA1
2a6ebd33bc063f6d7e9c816f0433d3e2fc32057b

SHA256
95fc67315f3ad12830d67b158404f3146f1cc0984e6f4d873a35a9714187380a

SHA512
5e5a92f5adc8fdd69f96fa79ca1ed4acc27c07c2db7992dc73a9c9b4c15e3f3d6890a3d65cbc66367cc45423e5a61f9b82c410630f4a692b541b4f4f29e1c9ed

Download Submit
C:\$Recycle.bin\S-1-5-21-999675638-2867687379-27515722-1000\$ast-S-1-5-21-999675638-2867687379-27515722-1000\QFCgsW0wL8BJPmRMv8Aq.dat

Filesize
130KB

MD5
fdcba0efdd123661f7d2b869081d063a

SHA1
31b4adf44b6b24aaaa86908a3c8fd6c1979e2d00

SHA256
69ab41c7686f9fdc172ab0e9c05fc593c4d897418a3057e442044c6ed550d33e

SHA512
6a2b0847f63e8653518b0a21320ca1730c6f60211e1010b7f0b03647cf65d4b80ba6a1365e809543beb4d03065c161e48012672f398e806775f1e2b542d24bca

Download Submit
C:\$Recycle.bin\S-1-5-21-999675638-2867687379-27515722-1000\$ast-S-1-5-21-999675638-2867687379-27515722-1000\xZiY-7c0pqkO8Gb0Y8_CLsr8i6.dat

Filesize
423B

MD5
1596e78e630642da6f7225ec60343872

SHA1
90aba3aa9bb643e2b5fc489ffdb2a98de198d2dd

SHA256
fbeb7aeee61686c4690629f6643e6bb2d6222811c8548d25e0b83e29df017057

SHA512
844f52e0a2053a7a64608c6645c3d1e88d9ea825a6f21b80e6ce83f5b771745a5be5504b527eb551da7505837b5ef821beca1addd8722decc3df4018f8476708

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp75AD.exe

Filesize
536KB

MD5
4ab05f44a4ee4aeef3fffd08cf3897d0

SHA1
51b28c7b2f16458ef3a86e50014902c02a9e5001

SHA256
05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0

SHA512
fb5a8399c8275a1ab1c355e6daf1a3ae5c565bcf44d52a02ea1f4e2cf66db59249942acc49a2a84368fee685e793a334c00b7fe63cdc974d23f36cab9c8641c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp75AD.exe

Filesize
536KB

MD5
4ab05f44a4ee4aeef3fffd08cf3897d0

SHA1
51b28c7b2f16458ef3a86e50014902c02a9e5001

SHA256
05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0

SHA512
fb5a8399c8275a1ab1c355e6daf1a3ae5c565bcf44d52a02ea1f4e2cf66db59249942acc49a2a84368fee685e793a334c00b7fe63cdc974d23f36cab9c8641c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp75AD.exe

Filesize
536KB

MD5
4ab05f44a4ee4aeef3fffd08cf3897d0

SHA1
51b28c7b2f16458ef3a86e50014902c02a9e5001

SHA256
05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0

SHA512
fb5a8399c8275a1ab1c355e6daf1a3ae5c565bcf44d52a02ea1f4e2cf66db59249942acc49a2a84368fee685e793a334c00b7fe63cdc974d23f36cab9c8641c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8779.exe

Filesize
102KB

MD5
cf6f2f08b485aedd4a79fc3aef4ad363

SHA1
1def00e45ddd8c90b5e1ff863f3fa674912de19e

SHA256
803d3d94c542192616f10f5404a6c8ab6dc8af77deedeeada7311e595761428a

SHA512
8f31776f2d696600ec8bd353b5560bb7dc8785bc16f3936b898447a50f5d9603fd2e087705b98cb00bd2bb08a8a0a1151aac60798e9f4dd4bbc7542e046b23fb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\openfiles.lnk

Filesize
1KB

MD5
0d47bcad8370c50864374927388f2cb4

SHA1
1b97330b545e46ef2b85c99a99ffd6d47a0cbf29

SHA256
7a2d781794bb3e154f6d145dace72420086593c6fffb972e1f9794ed935a4e1f

SHA512
f866360c3f9b3c5a8772e160f4ed538ce9378a815c2c555cc8720eaed90a455138edd5ef092f71f13ce40e89028a31079532a1ffa2811f43d31da65f05892ce2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\IEUpdate\openfiles.exe

Filesize
131KB

MD5
565610e8824c6d659cf326d10c43a57e

SHA1
99f064329cc6a775b6e79053cfeade56ca732c91

SHA256
16974851edd8c910e399da07159335c405a40e996fdfee2e2320687451cbc2ee

SHA512
4d9419b15fb69778bf06a37b5ac82371a4acceeb3413b3aa129613fa15563241112e3ab3876ca321c61ba784919dfbb200fe34dae99b347a07436a74f70fac48

Download Submit
memory/1028-142-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1028-138-0x000000000219B000-0x000000000219F000-memory.dmp

Filesize
16KB

Download
memory/1028-139-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1028-140-0x000000000219B000-0x000000000219F000-memory.dmp

Filesize
16KB

Download
memory/1232-109-0x0000000002780000-0x00000000027A5000-memory.dmp

Filesize
148KB

Download
memory/1660-117-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/1692-129-0x0000000000929000-0x000000000092C000-memory.dmp

Filesize
12KB

Download
memory/1692-128-0x0000000000929000-0x000000000092C000-memory.dmp

Filesize
12KB

Download
memory/1692-131-0x0000000000A10000-0x0000000000A20000-memory.dmp

Filesize
64KB

Download
memory/1736-119-0x0000000000690000-0x00000000006A0000-memory.dmp

Filesize
64KB

Download
memory/1916-114-0x00000000022E3000-0x00000000022E8000-memory.dmp

Filesize
20KB

Download
memory/1916-111-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/1916-110-0x0000000000AA0000-0x0000000000AAB000-memory.dmp

Filesize
44KB

Download
memory/1916-98-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download
memory/1916-124-0x0000000000AA0000-0x0000000000AAB000-memory.dmp

Filesize
44KB

Download
memory/1916-125-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/1980-135-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1984-60-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-61-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-95-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-68-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-69-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-56-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-58-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-63-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1984-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2000-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/2000-67-0x00000000002E0000-0x000000000033A000-memory.dmp

Filesize
360KB

Download