d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd

Analysis

max time kernel
151s
max time network
179s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
Size

492KB
MD5

0706dbd48e688386807d4905e6a9a593
SHA1

0185108894440f03e21dac0c91d644f536c321c2
SHA256

d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd
SHA512

9c49ada94a95f2e331648fa569251f0d44a7dbb8a8a7bc36aef40364c165c943eaf9ee00aee5bf51631dbfb72d1225f0c44498194f071147d2879de4cecc7302
SSDEEP

12288:tbGx+je/ygu566z3w8iiuFDnNMkP8W2aSQkGvdGebCJK83:tb1je/+X3w8Cn+kP8W8/Jx

Score

10^/10

evasion persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\41c40e2a\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Lo7b43s3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zfyiup.exe

Executes dropped EXE 9 IoCs

pid	Process
1772	Lo7b43s3.exe
1892	zfyiup.exe
1044	2eaa.exe
1596	2eaa.exe
1260	2eaa.exe
972	2eaa.exe
1624	3eaa.exe
332	csrss.exe
1772	X

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1596-83-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1596-85-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1596-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1596-91-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1596-93-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1260-92-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1260-95-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1260-97-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/972-105-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/972-107-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1260-108-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1260-106-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/972-109-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/972-113-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/972-114-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1596-115-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/972-127-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1260-126-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1260-139-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Loads dropped DLL 10 IoCs

pid	Process
1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
1772	Lo7b43s3.exe
1772	Lo7b43s3.exe
1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
1624	3eaa.exe
1624	3eaa.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /M"	zfyiup.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Lo7b43s3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /U"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /A"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /r"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /G"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /W"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /v"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /d"	Lo7b43s3.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /h"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /l"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /z"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /D"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /i"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /f"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /O"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /s"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /Q"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /b"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /u"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /I"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /B"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /Y"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /k"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /j"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /V"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /T"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /H"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /g"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /S"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /p"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /c"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /n"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /P"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /m"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /R"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /X"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /F"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /e"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /o"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /C"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /q"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /d"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /t"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /w"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /K"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /L"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /a"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /J"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /N"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /Z"	zfyiup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zfyiup = "C:\\Users\\Admin\\zfyiup.exe /x"	zfyiup.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2eaa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	2eaa.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 1596	1044	2eaa.exe	35
PID 1044 set thread context of 1260	1044	2eaa.exe	36
PID 1044 set thread context of 972	1044	2eaa.exe	37
PID 1624 set thread context of 812	1624	3eaa.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1684	tasklist.exe
1452	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{a8b10a90-7cc9-cb3a-842b-f0e02d692f2a}	3eaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a8b10a90-7cc9-cb3a-842b-f0e02d692f2a}\u = "188"	3eaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a8b10a90-7cc9-cb3a-842b-f0e02d692f2a}\cid = "15334173904859173395"	3eaa.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1772	Lo7b43s3.exe
1772	Lo7b43s3.exe
1260	2eaa.exe
1624	3eaa.exe
1624	3eaa.exe
1624	3eaa.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1260	2eaa.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1624	3eaa.exe
1772	X
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe
1892	zfyiup.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	tasklist.exe
Token: SeDebugPrivilege	1624	3eaa.exe
Token: SeDebugPrivilege	1624	3eaa.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeShutdownPrivilege	1324	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1324	Explorer.EXE
1324	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1324	Explorer.EXE
1324	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
1772	Lo7b43s3.exe
1892	zfyiup.exe
1044	2eaa.exe
1596	2eaa.exe
972	2eaa.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1772	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	28
PID 1460 wrote to memory of 1772	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	28
PID 1460 wrote to memory of 1772	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	28
PID 1460 wrote to memory of 1772	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	28
PID 1772 wrote to memory of 1892	1772	Lo7b43s3.exe	29
PID 1772 wrote to memory of 1892	1772	Lo7b43s3.exe	29
PID 1772 wrote to memory of 1892	1772	Lo7b43s3.exe	29
PID 1772 wrote to memory of 1892	1772	Lo7b43s3.exe	29
PID 1772 wrote to memory of 1888	1772	Lo7b43s3.exe	30
PID 1772 wrote to memory of 1888	1772	Lo7b43s3.exe	30
PID 1772 wrote to memory of 1888	1772	Lo7b43s3.exe	30
PID 1772 wrote to memory of 1888	1772	Lo7b43s3.exe	30
PID 1888 wrote to memory of 1684	1888	cmd.exe	32
PID 1888 wrote to memory of 1684	1888	cmd.exe	32
PID 1888 wrote to memory of 1684	1888	cmd.exe	32
PID 1888 wrote to memory of 1684	1888	cmd.exe	32
PID 1460 wrote to memory of 1044	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	34
PID 1460 wrote to memory of 1044	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	34
PID 1460 wrote to memory of 1044	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	34
PID 1460 wrote to memory of 1044	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	34
PID 1044 wrote to memory of 1596	1044	2eaa.exe	35
PID 1044 wrote to memory of 1596	1044	2eaa.exe	35
PID 1044 wrote to memory of 1596	1044	2eaa.exe	35
PID 1044 wrote to memory of 1596	1044	2eaa.exe	35
PID 1044 wrote to memory of 1596	1044	2eaa.exe	35
PID 1044 wrote to memory of 1596	1044	2eaa.exe	35
PID 1044 wrote to memory of 1596	1044	2eaa.exe	35
PID 1044 wrote to memory of 1596	1044	2eaa.exe	35
PID 1044 wrote to memory of 1260	1044	2eaa.exe	36
PID 1044 wrote to memory of 1260	1044	2eaa.exe	36
PID 1044 wrote to memory of 1260	1044	2eaa.exe	36
PID 1044 wrote to memory of 1260	1044	2eaa.exe	36
PID 1044 wrote to memory of 1260	1044	2eaa.exe	36
PID 1044 wrote to memory of 1260	1044	2eaa.exe	36
PID 1044 wrote to memory of 1260	1044	2eaa.exe	36
PID 1044 wrote to memory of 1260	1044	2eaa.exe	36
PID 1044 wrote to memory of 972	1044	2eaa.exe	37
PID 1044 wrote to memory of 972	1044	2eaa.exe	37
PID 1044 wrote to memory of 972	1044	2eaa.exe	37
PID 1044 wrote to memory of 972	1044	2eaa.exe	37
PID 1044 wrote to memory of 972	1044	2eaa.exe	37
PID 1044 wrote to memory of 972	1044	2eaa.exe	37
PID 1044 wrote to memory of 972	1044	2eaa.exe	37
PID 1044 wrote to memory of 972	1044	2eaa.exe	37
PID 1460 wrote to memory of 1624	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	38
PID 1460 wrote to memory of 1624	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	38
PID 1460 wrote to memory of 1624	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	38
PID 1460 wrote to memory of 1624	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	38
PID 1624 wrote to memory of 1324	1624	3eaa.exe	11
PID 1460 wrote to memory of 1588	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	39
PID 1460 wrote to memory of 1588	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	39
PID 1460 wrote to memory of 1588	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	39
PID 1460 wrote to memory of 1588	1460	d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe	39
PID 1588 wrote to memory of 1452	1588	cmd.exe	41
PID 1588 wrote to memory of 1452	1588	cmd.exe	41
PID 1588 wrote to memory of 1452	1588	cmd.exe	41
PID 1588 wrote to memory of 1452	1588	cmd.exe	41
PID 1624 wrote to memory of 332	1624	3eaa.exe	26
PID 1624 wrote to memory of 1772	1624	3eaa.exe	42
PID 1624 wrote to memory of 1772	1624	3eaa.exe	42
PID 1624 wrote to memory of 1772	1624	3eaa.exe	42
PID 1624 wrote to memory of 1772	1624	3eaa.exe	42
PID 1772 wrote to memory of 1324	1772	X	11
PID 1624 wrote to memory of 812	1624	3eaa.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1324
- C:\Users\Admin\AppData\Local\Temp\d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
  "C:\Users\Admin\AppData\Local\Temp\d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Users\Admin\Lo7b43s3.exe
    C:\Users\Admin\Lo7b43s3.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Users\Admin\zfyiup.exe
      "C:\Users\Admin\zfyiup.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1892
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del Lo7b43s3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
- - C:\Users\Admin\2eaa.exe
    C:\Users\Admin\2eaa.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Users\Admin\2eaa.exe
      "C:\Users\Admin\2eaa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
  - - C:\Users\Admin\2eaa.exe
      "C:\Users\Admin\2eaa.exe"
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:1260
  - - C:\Users\Admin\2eaa.exe
      "C:\Users\Admin\2eaa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
- - C:\Users\Admin\3eaa.exe
    C:\Users\Admin\3eaa.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Users\Admin\AppData\Local\41c40e2a\X
      *0*bc*2b321213*69.64.52.10:53
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1772
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del d61f060bf5b14563cc681286f1230fb5edc6fa08d5176355dd200f7045de7ddd.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1452

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
C:\Users\Admin\3eaa.exe

Filesize
253KB

MD5
60055d4e3397db97e7cb6400b2f5cacf

SHA1
1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

SHA256
8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

SHA512
63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

Download Submit
C:\Users\Admin\3eaa.exe

Filesize
253KB

MD5
60055d4e3397db97e7cb6400b2f5cacf

SHA1
1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

SHA256
8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

SHA512
63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

Download Submit
C:\Users\Admin\AppData\Local\41c40e2a\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
C:\Users\Admin\Lo7b43s3.exe

Filesize
232KB

MD5
555a30b03ba67c68c5206e84d5eef20c

SHA1
683fefc8ba94ab95a67d390a1d512d38b8c59170

SHA256
cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

SHA512
92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

Download Submit
C:\Users\Admin\Lo7b43s3.exe

Filesize
232KB

MD5
555a30b03ba67c68c5206e84d5eef20c

SHA1
683fefc8ba94ab95a67d390a1d512d38b8c59170

SHA256
cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

SHA512
92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

Download Submit
C:\Users\Admin\zfyiup.exe

Filesize
232KB

MD5
b1ee06087ea70376b923b93ee3f047ae

SHA1
fd3d1d89ade2e4bc417de3938a1c79ed9d052f1c

SHA256
9b0383063ecb97e331352f075baa692cb2157bc111ec66867ba7447ee5b07600

SHA512
893321364060d32e4f067b91fe21281e5c83397e6ddab5bd231d83cca41d5c79496dfa179c5adc3d63a69a1ef7c6d77dec3299a4557ec2952c63d5d4b04efff1

Download Submit
C:\Users\Admin\zfyiup.exe

Filesize
232KB

MD5
b1ee06087ea70376b923b93ee3f047ae

SHA1
fd3d1d89ade2e4bc417de3938a1c79ed9d052f1c

SHA256
9b0383063ecb97e331352f075baa692cb2157bc111ec66867ba7447ee5b07600

SHA512
893321364060d32e4f067b91fe21281e5c83397e6ddab5bd231d83cca41d5c79496dfa179c5adc3d63a69a1ef7c6d77dec3299a4557ec2952c63d5d4b04efff1

Download Submit
C:\Windows\system32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
\Users\Admin\2eaa.exe

Filesize
124KB

MD5
7b3def3cfe4bb0145ce8ec999978acd6

SHA1
c5197f94b9ded5e9e7158ce9ca53f3eaa6443357

SHA256
7b03e0be239f6716f840748faef30ef2a6d25f03689f839339864b7474fc7e31

SHA512
8b1bcaca6d6245f30f5fbc367d6a96545ddc4a8116acb98ec494065af56b60090d675bfae51d2bfd1a8a56ddcbdd1f2fda298addd3e420d941eebc2c6325e4cd

Download Submit
\Users\Admin\3eaa.exe

Filesize
253KB

MD5
60055d4e3397db97e7cb6400b2f5cacf

SHA1
1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

SHA256
8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

SHA512
63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

Download Submit
\Users\Admin\3eaa.exe

Filesize
253KB

MD5
60055d4e3397db97e7cb6400b2f5cacf

SHA1
1b197c3ea33bc51ec2d78d152295e4db13ba8fc6

SHA256
8f966fdcbe708065fde4cbb7087af788d6e9b8d4410fa7bcaf1ba6de0993a091

SHA512
63a644df9a5201936f6a08ccd88a4c37485ceac46a2610b85ed1b13480f6b41902d9385488a67f160412567916ac792131c4c1b5e92e4afce54aab67a1120bd4

Download Submit
\Users\Admin\AppData\Local\41c40e2a\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Users\Admin\AppData\Local\41c40e2a\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Users\Admin\Lo7b43s3.exe

Filesize
232KB

MD5
555a30b03ba67c68c5206e84d5eef20c

SHA1
683fefc8ba94ab95a67d390a1d512d38b8c59170

SHA256
cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

SHA512
92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

Download Submit
\Users\Admin\Lo7b43s3.exe

Filesize
232KB

MD5
555a30b03ba67c68c5206e84d5eef20c

SHA1
683fefc8ba94ab95a67d390a1d512d38b8c59170

SHA256
cff70151f9c151b4cdbfc2c0db134ef81f095a34b86fb6497d37797d5cd3bcaf

SHA512
92a72e53f2c628e44b2ef5590f53e37b311a006f10683dc1c28182f3f88ea066ee14103f173a262f67c97d0386afebf51c9921e9ad55ca53efe9729cc4f63402

Download Submit
\Users\Admin\zfyiup.exe

Filesize
232KB

MD5
b1ee06087ea70376b923b93ee3f047ae

SHA1
fd3d1d89ade2e4bc417de3938a1c79ed9d052f1c

SHA256
9b0383063ecb97e331352f075baa692cb2157bc111ec66867ba7447ee5b07600

SHA512
893321364060d32e4f067b91fe21281e5c83397e6ddab5bd231d83cca41d5c79496dfa179c5adc3d63a69a1ef7c6d77dec3299a4557ec2952c63d5d4b04efff1

Download Submit
\Users\Admin\zfyiup.exe

Filesize
232KB

MD5
b1ee06087ea70376b923b93ee3f047ae

SHA1
fd3d1d89ade2e4bc417de3938a1c79ed9d052f1c

SHA256
9b0383063ecb97e331352f075baa692cb2157bc111ec66867ba7447ee5b07600

SHA512
893321364060d32e4f067b91fe21281e5c83397e6ddab5bd231d83cca41d5c79496dfa179c5adc3d63a69a1ef7c6d77dec3299a4557ec2952c63d5d4b04efff1

Download Submit
\Windows\System32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
11e0ec6479d63e5d99b8e99a78764852

SHA1
6fe917180e2dfe2b2116b5c96ad7edfe2decfe2e

SHA256
8638a72eef25a28486fc3aba1dbd0f8aded21e593eadac405f14657d432b6fd2

SHA512
faf64d015f7e7c4b0cb1ef239eef0262eef30b736ab48a20e3b384387eb6cb7797fcd88cf6ece536637dd6178365119d6f59dc6457f09dc8f47db085ad62c718

Download Submit
memory/332-160-0x0000000000A80000-0x0000000000A8B000-memory.dmp

Filesize
44KB

Download
memory/972-103-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/972-127-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/972-114-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/972-113-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/972-105-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/972-107-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/972-109-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1260-95-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1260-108-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1260-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1260-139-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1260-92-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1260-126-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1260-97-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1260-106-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1324-156-0x0000000002940000-0x000000000294B000-memory.dmp

Filesize
44KB

Download
memory/1324-162-0x0000000002930000-0x0000000002938000-memory.dmp

Filesize
32KB

Download
memory/1324-163-0x0000000002950000-0x000000000295B000-memory.dmp

Filesize
44KB

Download
memory/1324-164-0x0000000002930000-0x0000000002938000-memory.dmp

Filesize
32KB

Download
memory/1324-152-0x0000000002940000-0x000000000294B000-memory.dmp

Filesize
44KB

Download
memory/1324-148-0x0000000002940000-0x000000000294B000-memory.dmp

Filesize
44KB

Download
memory/1324-128-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download
memory/1324-132-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download
memory/1324-136-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download
memory/1460-56-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1596-91-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1596-82-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1596-83-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1596-85-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1596-115-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1596-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1596-93-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1624-124-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/1624-138-0x00000000003AD000-0x00000000003E2000-memory.dmp

Filesize
212KB

Download
memory/1624-125-0x00000000003AD000-0x00000000003E2000-memory.dmp

Filesize
212KB

Download
memory/1624-159-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/1624-137-0x0000000030670000-0x00000000306C7000-memory.dmp

Filesize
348KB

Download
memory/1624-161-0x00000000003AD000-0x00000000003E2000-memory.dmp

Filesize
212KB

Download