dcrat | 8d8083a15c3ed42eae1336ff0060628915f58b60ee35e95b18843b5711b13372

Analysis

max time kernel
150s
max time network
145s
platform
windows10-1703_x64
resource
win10-20220812-es
resource tags

arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
28-01-2023 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Belle Delphine Nudes Leaked!/Titty Drop.scr
Size

3.4MB
MD5

ed6ea767354e940d79e591d21d8e1bbd
SHA1

d07011f13100f7578506f45630cfdb73286a3e44
SHA256

be790ab14ba841b5a5ae4fb7853924f33be7577b35a5565ca31fcd399b1ad8f8
SHA512

b653626e2d42d76d6daa48ecf779e053ab3bff1781c54519fe70f47bd97a03fcce3eed5dacb01edbae655b588ad4be138b2df29e604ddfd2cc0ff4f80b8da569
SSDEEP

49152:EbA37QXuXj2m0oENBxCFk+M0/V5Z7dTMjPvxQp0VR4NOjtSskvRIaqiZd:EbXXuiyENBE209BqnOmeMjYsqR7d

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 35 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeTitty Drop.scrschtasks.exeschtasks.exeschtasks.exewebbroker.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4488	schtasks.exe
4548	schtasks.exe
3356	schtasks.exe
5040	schtasks.exe
4692	schtasks.exe
1528	schtasks.exe
5028	schtasks.exe
392	schtasks.exe
528	schtasks.exe
4320	schtasks.exe
420	schtasks.exe
924	schtasks.exe
1196	schtasks.exe
928	schtasks.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	Titty Drop.scr
4380	schtasks.exe
4448	schtasks.exe
1456	schtasks.exe
File created	C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16	webbroker.exe
3264	schtasks.exe
3840	schtasks.exe
5060	schtasks.exe
4924	schtasks.exe
820	schtasks.exe
1108	schtasks.exe
1900	schtasks.exe
1204	schtasks.exe
3100	schtasks.exe
4972	schtasks.exe
4536	schtasks.exe
3260	schtasks.exe
1512	schtasks.exe
632	schtasks.exe
3396	schtasks.exe
1828	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

webbroker.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\", \"C:\\SurrogateagentsavesDll\\csrss.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\", \"C:\\SurrogateagentsavesDll\\csrss.exe\", \"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\", \"C:\\SurrogateagentsavesDll\\csrss.exe\", \"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\", \"C:\\odt\\ShellExperienceHost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\", \"C:\\SurrogateagentsavesDll\\csrss.exe\", \"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\", \"C:\\odt\\ShellExperienceHost.exe\", \"C:\\Users\\Default User\\services.exe\", \"C:\\SurrogateagentsavesDll\\Idle.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\", \"C:\\SurrogateagentsavesDll\\csrss.exe\", \"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\", \"C:\\odt\\ShellExperienceHost.exe\", \"C:\\Users\\Default User\\services.exe\", \"C:\\SurrogateagentsavesDll\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fontdrvhost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\", \"C:\\SurrogateagentsavesDll\\csrss.exe\", \"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\", \"C:\\odt\\ShellExperienceHost.exe\", \"C:\\Users\\Default User\\services.exe\", \"C:\\SurrogateagentsavesDll\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\services.exe\", \"C:\\Windows\\en-US\\services.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\", \"C:\\SurrogateagentsavesDll\\csrss.exe\", \"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\", \"C:\\odt\\ShellExperienceHost.exe\", \"C:\\Users\\Default User\\services.exe\", \"C:\\SurrogateagentsavesDll\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\services.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\wininit.exe\", \"C:\\SurrogateagentsavesDll\\smss.exe\", \"C:\\SurrogateagentsavesDll\\csrss.exe\", \"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\", \"C:\\odt\\ShellExperienceHost.exe\", \"C:\\Users\\Default User\\services.exe\""	webbroker.exe

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	420	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	4388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	4388	schtasks.exe

DCRat payload 23 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\SurrogateagentsavesDll\webbroker.exe	dcrat
C:\SurrogateagentsavesDll\webbroker.exe	dcrat
behavioral3/memory/4008-281-0x00000000007E0000-0x0000000000A82000-memory.dmp	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat
C:\SurrogateagentsavesDll\csrss.exe	dcrat
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe	dcrat

Executes dropped EXE 11 IoCs

Processes:

webbroker.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	process
4008	webbroker.exe
5052	csrss.exe
3712	csrss.exe
1780	csrss.exe
2308	csrss.exe
1260	csrss.exe
4816	csrss.exe
4108	csrss.exe
4560	csrss.exe
652	csrss.exe
1560	csrss.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

webbroker.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\SurrogateagentsavesDll\\csrss.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\SurrogateagentsavesDll\\csrss.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\odt\\ShellExperienceHost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\MSBuild\\wininit.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\SurrogateagentsavesDll\\smss.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Media Player\\fontdrvhost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\en-US\\services.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\en-US\\services.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\SurrogateagentsavesDll\\smss.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\MSBuild\\wininit.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Windows\\ELAMBKUP\\ShellExperienceHost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\odt\\ShellExperienceHost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default User\\services.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\SurrogateagentsavesDll\\Idle.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\services.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default User\\services.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\SurrogateagentsavesDll\\Idle.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Media Player\\fontdrvhost.exe\""	webbroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\services.exe\""	webbroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows Mail\\sppsvc.exe\""	webbroker.exe

Drops file in Program Files directory 9 IoCs

Processes:

webbroker.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Media Player\5b884080fd4f94	webbroker.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\sppsvc.exe	webbroker.exe
File created	C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16	webbroker.exe
File created	C:\Program Files (x86)\MSBuild\wininit.exe	webbroker.exe
File created	C:\Program Files (x86)\MSBuild\56085415360792	webbroker.exe
File created	C:\Program Files (x86)\Windows Media Player\fontdrvhost.exe	webbroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\services.exe	webbroker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\c5b4cb5e9653cc	webbroker.exe
File created	C:\Program Files (x86)\Windows Mail\sppsvc.exe	webbroker.exe

Drops file in Windows directory 4 IoCs

Processes:

webbroker.exe

description	ioc	process
File created	C:\Windows\ELAMBKUP\ShellExperienceHost.exe	webbroker.exe
File created	C:\Windows\ELAMBKUP\f8c8f1285d826b	webbroker.exe
File created	C:\Windows\en-US\services.exe	webbroker.exe
File created	C:\Windows\en-US\c5b4cb5e9653cc	webbroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3356	schtasks.exe
1196	schtasks.exe
1108	schtasks.exe
1456	schtasks.exe
528	schtasks.exe
1204	schtasks.exe
3396	schtasks.exe
5060	schtasks.exe
392	schtasks.exe
4548	schtasks.exe
4448	schtasks.exe
420	schtasks.exe
1528	schtasks.exe
1512	schtasks.exe
4972	schtasks.exe
924	schtasks.exe
3260	schtasks.exe
4380	schtasks.exe
3264	schtasks.exe
4320	schtasks.exe
4488	schtasks.exe
5040	schtasks.exe
632	schtasks.exe
1900	schtasks.exe
4924	schtasks.exe
1828	schtasks.exe
3100	schtasks.exe
4536	schtasks.exe
928	schtasks.exe
4692	schtasks.exe
3840	schtasks.exe
820	schtasks.exe
5028	schtasks.exe

Modifies registry class 11 IoCs

Processes:

csrss.execsrss.execsrss.execsrss.exeTitty Drop.scrcsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	Titty Drop.scr
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	csrss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

webbroker.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exe

pid	process
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
4008	webbroker.exe
3380	powershell.exe
3380	powershell.exe
308	powershell.exe
308	powershell.exe
4664	powershell.exe
4664	powershell.exe
668	powershell.exe
668	powershell.exe
2172	powershell.exe
2172	powershell.exe
1304	powershell.exe
1304	powershell.exe
2052	powershell.exe
2052	powershell.exe
2496	powershell.exe
2496	powershell.exe
2156	powershell.exe
2156	powershell.exe
1920	powershell.exe
1920	powershell.exe
4288	powershell.exe
4288	powershell.exe
4728	powershell.exe
4728	powershell.exe
2172	powershell.exe
2052	powershell.exe
4664	powershell.exe
3380	powershell.exe
2052	powershell.exe
2172	powershell.exe
308	powershell.exe
668	powershell.exe
1920	powershell.exe
4288	powershell.exe
1304	powershell.exe
2496	powershell.exe
2156	powershell.exe
4728	powershell.exe
5052	csrss.exe
5052	csrss.exe
4664	powershell.exe
3380	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

webbroker.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4008	webbroker.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	5052	csrss.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeIncreaseQuotaPrivilege	2052	powershell.exe
Token: SeSecurityPrivilege	2052	powershell.exe
Token: SeTakeOwnershipPrivilege	2052	powershell.exe
Token: SeLoadDriverPrivilege	2052	powershell.exe
Token: SeSystemProfilePrivilege	2052	powershell.exe
Token: SeSystemtimePrivilege	2052	powershell.exe
Token: SeProfSingleProcessPrivilege	2052	powershell.exe
Token: SeIncBasePriorityPrivilege	2052	powershell.exe
Token: SeCreatePagefilePrivilege	2052	powershell.exe
Token: SeBackupPrivilege	2052	powershell.exe
Token: SeRestorePrivilege	2052	powershell.exe
Token: SeShutdownPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeSystemEnvironmentPrivilege	2052	powershell.exe
Token: SeRemoteShutdownPrivilege	2052	powershell.exe
Token: SeUndockPrivilege	2052	powershell.exe
Token: SeManageVolumePrivilege	2052	powershell.exe
Token: 33	2052	powershell.exe
Token: 34	2052	powershell.exe
Token: 35	2052	powershell.exe
Token: 36	2052	powershell.exe
Token: SeIncreaseQuotaPrivilege	2172	powershell.exe
Token: SeSecurityPrivilege	2172	powershell.exe
Token: SeTakeOwnershipPrivilege	2172	powershell.exe
Token: SeLoadDriverPrivilege	2172	powershell.exe
Token: SeSystemProfilePrivilege	2172	powershell.exe
Token: SeSystemtimePrivilege	2172	powershell.exe
Token: SeProfSingleProcessPrivilege	2172	powershell.exe
Token: SeIncBasePriorityPrivilege	2172	powershell.exe
Token: SeCreatePagefilePrivilege	2172	powershell.exe
Token: SeBackupPrivilege	2172	powershell.exe
Token: SeRestorePrivilege	2172	powershell.exe
Token: SeShutdownPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeSystemEnvironmentPrivilege	2172	powershell.exe
Token: SeRemoteShutdownPrivilege	2172	powershell.exe
Token: SeUndockPrivilege	2172	powershell.exe
Token: SeManageVolumePrivilege	2172	powershell.exe
Token: 33	2172	powershell.exe
Token: 34	2172	powershell.exe
Token: 35	2172	powershell.exe
Token: 36	2172	powershell.exe
Token: SeIncreaseQuotaPrivilege	4664	powershell.exe
Token: SeSecurityPrivilege	4664	powershell.exe
Token: SeTakeOwnershipPrivilege	4664	powershell.exe
Token: SeLoadDriverPrivilege	4664	powershell.exe
Token: SeSystemProfilePrivilege	4664	powershell.exe
Token: SeSystemtimePrivilege	4664	powershell.exe
Token: SeProfSingleProcessPrivilege	4664	powershell.exe
Token: SeIncBasePriorityPrivilege	4664	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Titty Drop.scrWScript.execmd.exewebbroker.execsrss.exeWScript.execsrss.exeWScript.execsrss.exeWScript.execsrss.exeWScript.execsrss.exeWScript.exe

description	pid	process	target process
PID 4708 wrote to memory of 4852	4708	Titty Drop.scr	WScript.exe
PID 4708 wrote to memory of 4852	4708	Titty Drop.scr	WScript.exe
PID 4708 wrote to memory of 4852	4708	Titty Drop.scr	WScript.exe
PID 4852 wrote to memory of 3388	4852	WScript.exe	cmd.exe
PID 4852 wrote to memory of 3388	4852	WScript.exe	cmd.exe
PID 4852 wrote to memory of 3388	4852	WScript.exe	cmd.exe
PID 3388 wrote to memory of 4008	3388	cmd.exe	webbroker.exe
PID 3388 wrote to memory of 4008	3388	cmd.exe	webbroker.exe
PID 4008 wrote to memory of 308	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 308	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 3380	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 3380	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 4664	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 4664	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 2172	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 2172	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 1304	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 1304	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 668	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 668	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 2052	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 2052	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 2156	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 2156	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 2496	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 2496	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 1920	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 1920	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 4288	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 4288	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 4728	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 4728	4008	webbroker.exe	powershell.exe
PID 4008 wrote to memory of 5052	4008	webbroker.exe	csrss.exe
PID 4008 wrote to memory of 5052	4008	webbroker.exe	csrss.exe
PID 5052 wrote to memory of 1700	5052	csrss.exe	WScript.exe
PID 5052 wrote to memory of 1700	5052	csrss.exe	WScript.exe
PID 5052 wrote to memory of 4740	5052	csrss.exe	WScript.exe
PID 5052 wrote to memory of 4740	5052	csrss.exe	WScript.exe
PID 1700 wrote to memory of 3712	1700	WScript.exe	csrss.exe
PID 1700 wrote to memory of 3712	1700	WScript.exe	csrss.exe
PID 3712 wrote to memory of 4972	3712	csrss.exe	WScript.exe
PID 3712 wrote to memory of 4972	3712	csrss.exe	WScript.exe
PID 3712 wrote to memory of 4068	3712	csrss.exe	WScript.exe
PID 3712 wrote to memory of 4068	3712	csrss.exe	WScript.exe
PID 4972 wrote to memory of 1780	4972	WScript.exe	csrss.exe
PID 4972 wrote to memory of 1780	4972	WScript.exe	csrss.exe
PID 1780 wrote to memory of 2796	1780	csrss.exe	WScript.exe
PID 1780 wrote to memory of 2796	1780	csrss.exe	WScript.exe
PID 1780 wrote to memory of 5084	1780	csrss.exe	WScript.exe
PID 1780 wrote to memory of 5084	1780	csrss.exe	WScript.exe
PID 2796 wrote to memory of 2308	2796	WScript.exe	csrss.exe
PID 2796 wrote to memory of 2308	2796	WScript.exe	csrss.exe
PID 2308 wrote to memory of 4264	2308	csrss.exe	WScript.exe
PID 2308 wrote to memory of 4264	2308	csrss.exe	WScript.exe
PID 2308 wrote to memory of 4908	2308	csrss.exe	WScript.exe
PID 2308 wrote to memory of 4908	2308	csrss.exe	WScript.exe
PID 4264 wrote to memory of 1260	4264	WScript.exe	csrss.exe
PID 4264 wrote to memory of 1260	4264	WScript.exe	csrss.exe
PID 1260 wrote to memory of 2408	1260	csrss.exe	WScript.exe
PID 1260 wrote to memory of 2408	1260	csrss.exe	WScript.exe
PID 1260 wrote to memory of 2100	1260	csrss.exe	WScript.exe
PID 1260 wrote to memory of 2100	1260	csrss.exe	WScript.exe
PID 2408 wrote to memory of 4816	2408	WScript.exe	csrss.exe
PID 2408 wrote to memory of 4816	2408	WScript.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\Belle Delphine Nudes Leaked!\Titty Drop.scr
"C:\Users\Admin\AppData\Local\Temp\Belle Delphine Nudes Leaked!\Titty Drop.scr" /S
1⤵
- DcRat
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\SurrogateagentsavesDll\rh7k9gt.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\SurrogateagentsavesDll\2nvHsNHUhqkINTDaJO.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3388

C:\SurrogateagentsavesDll\webbroker.exe
"C:\SurrogateagentsavesDll\webbroker.exe"
4⤵
- DcRat
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\SurrogateagentsavesDll\webbroker.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\wininit.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\SurrogateagentsavesDll\smss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ELAMBKUP\ShellExperienceHost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\SurrogateagentsavesDll\csrss.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\ShellExperienceHost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\services.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\SurrogateagentsavesDll\Idle.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\fontdrvhost.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\services.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\services.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\SurrogateagentsavesDll\csrss.exe
"C:\SurrogateagentsavesDll\csrss.exe"
5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37c80eab-3ca6-4432-b6d0-f22ad8d602bb.vbs"
6⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3712

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2215095a-21c4-4d12-b4f1-c9091797aee2.vbs"
8⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7658e67-3d10-4fbc-995c-2caff97520d1.vbs"
10⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
11⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\737210af-76ef-4994-a2b2-1e1bef510900.vbs"
12⤵
- Suspicious use of WriteProcessMemory
PID:4264

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
13⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3479512-5ef4-44f8-bb42-05d1be95ee0c.vbs"
14⤵
- Suspicious use of WriteProcessMemory
PID:2408

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
15⤵
- Executes dropped EXE
- Modifies registry class
PID:4816

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0be6e4fa-d742-4fe3-a815-1c69ea812efc.vbs"
16⤵
PID:804

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
17⤵
- Executes dropped EXE
- Modifies registry class
PID:4108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fac1ef4-2ebc-4e95-b635-c2401376adfe.vbs"
18⤵
PID:3848

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
19⤵
- Executes dropped EXE
- Modifies registry class
PID:4560

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7753e3d5-f77b-4ba4-879b-82bcac44e368.vbs"
20⤵
PID:4872

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
21⤵
- Executes dropped EXE
- Modifies registry class
PID:652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bcc8aa9-95f6-41c9-849a-f0abb60e19b4.vbs"
22⤵
PID:4240

C:\SurrogateagentsavesDll\csrss.exe
C:\SurrogateagentsavesDll\csrss.exe
23⤵
- Executes dropped EXE
- Modifies registry class
PID:1560

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\668cb84a-d21f-47ea-85c0-7e853616a082.vbs"
24⤵
PID:1300

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8231854-0b7f-4f87-be43-644944271a40.vbs"
24⤵
PID:1780

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdff3e33-bfa9-4b55-9641-4e562b368641.vbs"
22⤵
PID:4868

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5d2282c-f6f7-4e0b-9e1b-3443e8b7a5f3.vbs"
20⤵
PID:2028

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62ae950c-fdef-4bd2-ab0a-88a2507c8183.vbs"
18⤵
PID:4008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8874b9d4-e8ab-4192-8852-4ce4d0b77631.vbs"
16⤵
PID:2592

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e24f235-a98e-4f74-8d5b-2b720977d408.vbs"
14⤵
PID:2100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ccc56429-c611-4763-9c77-800cce95718d.vbs"
12⤵
PID:4908

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89e44d79-0b72-44dd-9a6f-6176fb3a2aa4.vbs"
10⤵
PID:5084

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47deeabd-3566-4cd7-98e9-4119b42592c2.vbs"
8⤵
PID:4068

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f580e6bb-1155-4db0-8f03-8e75bb720223.vbs"
6⤵
PID:4740

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sppsvc.exe'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\SurrogateagentsavesDll\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\SurrogateagentsavesDll\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\SurrogateagentsavesDll\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\SurrogateagentsavesDll\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\SurrogateagentsavesDll\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\SurrogateagentsavesDll\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Windows\ELAMBKUP\ShellExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Windows\ELAMBKUP\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\ELAMBKUP\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\odt\ShellExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\SurrogateagentsavesDll\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\SurrogateagentsavesDll\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\SurrogateagentsavesDll\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\en-US\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\en-US\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\SurrogateagentsavesDll\2nvHsNHUhqkINTDaJO.bat
Filesize
41B

MD5
d9fbba17a660eee76f5e6556e7f00ccc

SHA1
5e40c6de4f9a1d2dae42a33902120af6c561f631

SHA256
bed8275c849c71818fa90791dd5b71514a46a82990a7e04a3092dc7c761d1f62

SHA512
c3f484fbe0b3461335b6aa6fe8ec509044e853edf15a514e3d2d33bd5370d9566b21f03cc0e949ec9a6a91c2abeb7f30dc741b33522548b75c056384f1344955

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\csrss.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\rh7k9gt.vbe
Filesize
217B

MD5
243fd9d2bb97513854d1025a6727a5e4

SHA1
ab45973af5a26c54821b6897043958ecbf5683b3

SHA256
38a0c3d04ec79e01ecc452d0afb95ac1f419472d9abbd9ebde4b30b94da6509b

SHA512
da630c8c29ba43e8929ec89ba525930cceca5f580d338ca8337dc1be9cb41fe11ba7c7f4ab658407552b7d5ce2929fd56f86739bd76124e35a0110d407c6faeb

Download Submit
C:\SurrogateagentsavesDll\webbroker.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\SurrogateagentsavesDll\webbroker.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Filesize
1KB

MD5
08f43da77650c7ac78c89d4428532545

SHA1
cd4bd631bcca0015e3c3292d290eb0990593adcd

SHA256
e74f9cc1393d6a564ad1febad86452c11909a0c21e2a2433c18063d0dc41a18c

SHA512
49a5f7dd2836bd0fb53388e253ad333c20a8eb2f08d1f762101c75159b74aed21e6fe73f03dc558387ee1284637876dcf6c79062a191bb57490e5e58e6afff2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
eb06934d07bb30f0cad43b20cd5b049f

SHA1
97105b4b76383b4df19d187c1d03a7cac24d6f67

SHA256
9358b95ba4cea353580046b15166a8a2382c2fa412447f79cb6028a3f981be90

SHA512
5d5e29c73fbdb1015c7084810aaf44c9ba1b109e48c4eecd09af5ca87cb1d712086c48d0b0a0e51f9db02c2a958a2c897529bfa3027cb48c5eb6ffa45d86e7a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
a99500ff862ab06069c956feca52bfdd

SHA1
514d0d425f53186fd51115e597247a097e3034a9

SHA256
3b7c562697a3af170b48cdf526b6fce5c43fbc6d6e3e92e881bb371ea8406fca

SHA512
cd3c5113b6bbadfd7a171cfbacaa74652bf1964e0813652fe9997748e69c0b11561d667dbfd849aa112f1a629b335597628021c1914f1a7f9926667d309a0d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
a99500ff862ab06069c956feca52bfdd

SHA1
514d0d425f53186fd51115e597247a097e3034a9

SHA256
3b7c562697a3af170b48cdf526b6fce5c43fbc6d6e3e92e881bb371ea8406fca

SHA512
cd3c5113b6bbadfd7a171cfbacaa74652bf1964e0813652fe9997748e69c0b11561d667dbfd849aa112f1a629b335597628021c1914f1a7f9926667d309a0d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
8e66ab7aba9e194e566a2ff05b876244

SHA1
72da61e2f4709b4f6dee9adb77c1b6b597b895a9

SHA256
1215fd17a0461b50394c38d497ccf1ce0dc43f3eed5e5e9cd8104966614a9f9c

SHA512
826826c0b00133ab688e551e33158310f7ddeaaa6b2a2e281807dc094e1fc5543736cd73e6cd7e02af0f0c04847bede66caa31104da8cba144ea9ded4ab9ad57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3dc9e086a611815ff5ae6616ca4fe7da

SHA1
a525999efe07a27c0c53f7126ac8dcab4f4000cf

SHA256
fdddd8bacd23e4488d7794e46eaba88add6b762cb147e9cd159e10901a5f3375

SHA512
4577d6b0d6e974b7c94964113ee579cc9f15432abf79c563c227137e482c9f0da341359a0cab725f4c45f3590f27a3fa9594059da5e73b7f2da43f3e043d3aeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3dc9e086a611815ff5ae6616ca4fe7da

SHA1
a525999efe07a27c0c53f7126ac8dcab4f4000cf

SHA256
fdddd8bacd23e4488d7794e46eaba88add6b762cb147e9cd159e10901a5f3375

SHA512
4577d6b0d6e974b7c94964113ee579cc9f15432abf79c563c227137e482c9f0da341359a0cab725f4c45f3590f27a3fa9594059da5e73b7f2da43f3e043d3aeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
7d9cf12c74647d75a82ef1146c3914e3

SHA1
ab9608b5ceabf715ebfc366dcbfd175a33e5982b

SHA256
fa49977c702cb45b55b879bc38d7a05a83981d57cac23d5560c6c11c1e132f89

SHA512
5ccef95aab06694fd04669d928eef8f53fc4046a8cc7ed8cd163699cad2c7fe6f15b9eb24a37810391c6ea6f35a2a2b4f390a7b575952e82433e9ebc4a0f0ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
7d9cf12c74647d75a82ef1146c3914e3

SHA1
ab9608b5ceabf715ebfc366dcbfd175a33e5982b

SHA256
fa49977c702cb45b55b879bc38d7a05a83981d57cac23d5560c6c11c1e132f89

SHA512
5ccef95aab06694fd04669d928eef8f53fc4046a8cc7ed8cd163699cad2c7fe6f15b9eb24a37810391c6ea6f35a2a2b4f390a7b575952e82433e9ebc4a0f0ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
28ee5f8aafc83aa4125827bc569dbc03

SHA1
a53491b66cd70886b1d9d85c8ef3aa9911324d35

SHA256
2efb710afa9c7a3123a3269ba7e54d3e2bfd5d97f0d4c241e0a046956fe7ad05

SHA512
fa748ce2268326a751a1b3a3d6a55d96a903aa01768ee768f3ddc7814d0cd0ee845ef59df0d74f3a9af3c76c641d3333c341cc18acc114b649a842289d6d07d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
a3afb35eac65590018a218b5bf7be753

SHA1
ac43475bc5b081e905a59baaab3c2611f29eec78

SHA256
3ae4c1b313ed2d74d5d0814d64d4accf94d66237f01df0d71380c114e3cd88fd

SHA512
07fc235740b68cf88428dd0531323c0938fdfd57cdf41e7826ab34bdb2714c5375df1279f10c23357d2dbb7a60070f9f79a234f06209eaa9fda92aa49d6bc9de

Download Submit
C:\Users\Admin\AppData\Local\Temp\0be6e4fa-d742-4fe3-a815-1c69ea812efc.vbs
Filesize
711B

MD5
a28fe46c7b5098e9e457495223c426ab

SHA1
0a4d8cd74bc06149682340a595bc895c4aa471db

SHA256
8a95631f0f17aa107f091ed108e15346dc328404fe61a7a1e229f22a71ca3298

SHA512
971af9a4f65142673f12a71e6287d04cedd134911f527fbd5088fb0f3c45fe2adaea854433eab10af22d82d1881ab997fdc177e26e8c593134dcdbdfd4b6bef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2215095a-21c4-4d12-b4f1-c9091797aee2.vbs
Filesize
711B

MD5
c849b652bef7fc81d047f08088550442

SHA1
9bccf61184ce08c7c85736e3a37a0b9d13c6529b

SHA256
f8371ce2c7ec560e2ab9f8c594f4472e94123d37e515eaa45ff0b50be901a454

SHA512
09cfe40ed64cb4109de077c8506a31d4b812688334b2251e18f05f5e464991dcc5f9510fe7599a45109dffa96dc02d3de68870b12711fa05f6e0beac35ad6f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\37c80eab-3ca6-4432-b6d0-f22ad8d602bb.vbs
Filesize
711B

MD5
a294a436817a70fd28fa8caa0965fe60

SHA1
90fef84fe640040155bd8526b395eeac9a1e6efd

SHA256
e84d372861039cd413f9e125ddb324c4fcff8fb75f85d5f95e47a2aff8815589

SHA512
0e920b21e0b537a6cf40cab5df7968373c86fc6c7b3382f84aea47d3257662738fece886710420b1675f996e9520fa92900cc425c6e7513723dfccc2d8c40413

Download Submit
C:\Users\Admin\AppData\Local\Temp\3e24f235-a98e-4f74-8d5b-2b720977d408.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\47deeabd-3566-4cd7-98e9-4119b42592c2.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fac1ef4-2ebc-4e95-b635-c2401376adfe.vbs
Filesize
711B

MD5
49e520ca9f83028eb4ff025d2d5b792a

SHA1
f1f0add05e5bf94f4131f70bd297537da637dd49

SHA256
b7b56aac9435f6bf32743fd5617f3999135e0b466896b4b9baa1d813ddeda209

SHA512
cb1ae4e34050e6d780472deaa10a84a42fac0c977a5d6b8550408b1796cca029a1c1089c9283e415f4866aea3ae6029ed30aba88056bb3421ad0ed505c4836c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\62ae950c-fdef-4bd2-ab0a-88a2507c8183.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\668cb84a-d21f-47ea-85c0-7e853616a082.vbs
Filesize
711B

MD5
e34f41a165494f8898c44fbb86f7601f

SHA1
49889205964d9dce8d157da9dff64aca781315ae

SHA256
7bff2922983d11392767ef1bfd25853fb5166260cabc44d9ae054f8d1aa2e1f4

SHA512
5771398a71983222997abd9f601e6eb46e171dfb14403daa6b9ae581ffe90af23190bade0b4e480f6f3ce9df7e42b656d0bd7c6385c7452f4e9c0576c561fc4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\737210af-76ef-4994-a2b2-1e1bef510900.vbs
Filesize
711B

MD5
36342cd0307065f1cd61932fb81d3771

SHA1
3a659d6bfce1356cb5483fb5e69bfc26344deeca

SHA256
7e3713ac2efbb0712fd813658b9102f5735f072e1ee3ebfd79b3f458620def17

SHA512
4f60b687bb3d85e81b784854f5a738f56449e813a093e58c90036fed19bf2453b3dbd7b974545e0ab7975036601882c753ef3fd5d55fa8893dbdc4188a546011

Download Submit
C:\Users\Admin\AppData\Local\Temp\7753e3d5-f77b-4ba4-879b-82bcac44e368.vbs
Filesize
711B

MD5
daf490ce8ec33e9f75b3ac797b63cdf3

SHA1
c4c85156788472af01ecd6a81b31bdd1130a9844

SHA256
6a0eec36b657e648dfec6d6165e177f3360a54521c088d65cb81b870373e13ac

SHA512
e8059124d925c89f8ae5ef77b579d1d078b58805613eb137c31dc93eee17fd0a8667c9441e1d06f04a8c2efb821620fdc9566fbf106cadabfba7f976ba3c6d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\8874b9d4-e8ab-4192-8852-4ce4d0b77631.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\89e44d79-0b72-44dd-9a6f-6176fb3a2aa4.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\8bcc8aa9-95f6-41c9-849a-f0abb60e19b4.vbs
Filesize
710B

MD5
575f6956f5d07ca71fb38089c9f4841f

SHA1
15430169d20110038bcc7f46abdbcbf069678d16

SHA256
153696bf22d0b74b0abc32fda028d36e9a119143dc9f4da4e4a7605846ba96af

SHA512
19493d2f48c5fb1a5db5620615436d3b5214c50373f60b9a9261f731b8802e4b1148cf113f03d9e4f08b36b13a6aec3c7ec0d0e2711b4ed063a4ee243b3a4312

Download Submit
C:\Users\Admin\AppData\Local\Temp\a7658e67-3d10-4fbc-995c-2caff97520d1.vbs
Filesize
711B

MD5
7089aa021909c86e693a3879b4216f18

SHA1
83c3a1c3541483abd7d46dd8aefa3f2b0b971eca

SHA256
ba6bd4bacaec0a59e9ff4c568e919f20c684f122d3d6d5f6ebb11f8446512a8d

SHA512
f5b607be6fe419529d1cf1cf3bc3650c473db2d3a189ca5eafef706d069d6c44c659fbe91b7a2f5cd1dff28f78a79f84559aec24c3f01850ddfcd6537a978e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3479512-5ef4-44f8-bb42-05d1be95ee0c.vbs
Filesize
711B

MD5
e07e8a0bb16946d4829f60ecb663bca5

SHA1
aa9415dc4b4d5d783987f669a95e8450d583cd7b

SHA256
e70e349b0fa43503f00346cec9cddc136a6c9f81d1631101f7b545b8d0f0546d

SHA512
b07edd64f605ea7d6f2ed4cef559dcdb5ccebf3a6c445eaaac9c073915d1c35b6ba885e67c0b62265cf679c59a3d743367a845eeb43697a027245251c26d6042

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca9e9ecc758009c9e5e88c36a3cad9405dc138f1.exe
Filesize
2.6MB

MD5
b1364fea5ff9a5f9d5e4f63374b926fc

SHA1
a837da0330a19c84bd2aaef52125f9cf98dc6f95

SHA256
cf3dc60ee782af378f4ad7651deb5ac6229c9073e47973f0732a761fa06fc5ce

SHA512
bb71608ebdb9a15ad0bc46226f3d0354bcd8659e088b723a29bb77e128ffe4bdfdb7bec859f3a8b9552efd31561088778655da3f1cc2137eec8707535bb21ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\ccc56429-c611-4763-9c77-800cce95718d.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f580e6bb-1155-4db0-8f03-8e75bb720223.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5d2282c-f6f7-4e0b-9e1b-3443e8b7a5f3.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f8231854-0b7f-4f87-be43-644944271a40.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdff3e33-bfa9-4b55-9641-4e562b368641.vbs
Filesize
487B

MD5
ae8539ce861c28f93750741f30071df0

SHA1
33186378679e9bf02cbbe9aa9acb808e973c1353

SHA256
401e7bcb33a5baf8414a57c4a13c0756be2f607b6f5458ba65e82329b942cd70

SHA512
e58125025a1761e49236d27d11a562ff8a26e0c78a0b40cc834aec2656c17c348cfae35d23b720feb1cb931026762391cea2a0d862673a8d6f7cf7db7838c00c

Download Submit
memory/308-296-0x0000000000000000-mapping.dmp

Download
memory/652-793-0x0000000000000000-mapping.dmp

Download
memory/652-795-0x00000000015F0000-0x0000000001602000-memory.dmp

Filesize
72KB

Download
memory/668-301-0x0000000000000000-mapping.dmp

Download
memory/804-771-0x0000000000000000-mapping.dmp

Download
memory/1260-762-0x0000000000DF0000-0x0000000000E02000-memory.dmp

Filesize
72KB

Download
memory/1260-761-0x000000001ABB0000-0x000000001AC06000-memory.dmp

Filesize
344KB

Download
memory/1260-758-0x0000000000000000-mapping.dmp

Download
memory/1260-760-0x0000000000DD0000-0x0000000000DE2000-memory.dmp

Filesize
72KB

Download
memory/1300-804-0x0000000000000000-mapping.dmp

Download
memory/1304-300-0x0000000000000000-mapping.dmp

Download
memory/1560-803-0x0000000001050000-0x0000000001062000-memory.dmp

Filesize
72KB

Download
memory/1560-801-0x0000000000000000-mapping.dmp

Download
memory/1700-391-0x0000000000000000-mapping.dmp

Download
memory/1780-741-0x0000000000000000-mapping.dmp

Download
memory/1780-743-0x00000000013F0000-0x0000000001402000-memory.dmp

Filesize
72KB

Download
memory/1780-806-0x0000000000000000-mapping.dmp

Download
memory/1920-307-0x0000000000000000-mapping.dmp

Download
memory/2028-790-0x0000000000000000-mapping.dmp

Download
memory/2052-302-0x0000000000000000-mapping.dmp

Download
memory/2100-765-0x0000000000000000-mapping.dmp

Download
memory/2156-682-0x0000023079DA0000-0x0000023079DBE000-memory.dmp

Filesize
120KB

Download
memory/2156-303-0x0000000000000000-mapping.dmp

Download
memory/2172-384-0x00000260CFC40000-0x00000260CFC8A000-memory.dmp

Filesize
296KB

Download
memory/2172-366-0x00000260CF8C0000-0x00000260CF936000-memory.dmp

Filesize
472KB

Download
memory/2172-299-0x0000000000000000-mapping.dmp

Download
memory/2308-751-0x00000000029A0000-0x00000000029F6000-memory.dmp

Filesize
344KB

Download
memory/2308-752-0x0000000000E90000-0x0000000000EA2000-memory.dmp

Filesize
72KB

Download
memory/2308-749-0x0000000000000000-mapping.dmp

Download
memory/2408-763-0x0000000000000000-mapping.dmp

Download
memory/2496-304-0x0000000000000000-mapping.dmp

Download
memory/2592-773-0x0000000000000000-mapping.dmp

Download
memory/2796-744-0x0000000000000000-mapping.dmp

Download
memory/3380-297-0x0000000000000000-mapping.dmp

Download
memory/3380-350-0x000001DB63D50000-0x000001DB63D60000-memory.dmp

Filesize
64KB

Download
memory/3380-347-0x000001DB7C330000-0x000001DB7C3B2000-memory.dmp

Filesize
520KB

Download
memory/3388-255-0x0000000000000000-mapping.dmp

Download
memory/3712-734-0x0000000000AB0000-0x0000000000B06000-memory.dmp

Filesize
344KB

Download
memory/3712-731-0x0000000000000000-mapping.dmp

Download
memory/3712-735-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3848-780-0x0000000000000000-mapping.dmp

Download
memory/4008-782-0x0000000000000000-mapping.dmp

Download
memory/4008-289-0x0000000002B30000-0x0000000002B42000-memory.dmp

Filesize
72KB

Download
memory/4008-285-0x0000000001250000-0x0000000001266000-memory.dmp

Filesize
88KB

Download
memory/4008-283-0x0000000001230000-0x000000000124C000-memory.dmp

Filesize
112KB

Download
memory/4008-286-0x0000000002B20000-0x0000000002B32000-memory.dmp

Filesize
72KB

Download
memory/4008-291-0x000000001B550000-0x000000001B55A000-memory.dmp

Filesize
40KB

Download
memory/4008-292-0x000000001B560000-0x000000001B56E000-memory.dmp

Filesize
56KB

Download
memory/4008-293-0x000000001B620000-0x000000001B62C000-memory.dmp

Filesize
48KB

Download
memory/4008-282-0x000000001BC90000-0x000000001BD92000-memory.dmp

Filesize
1.0MB

Download
memory/4008-294-0x000000001B630000-0x000000001B63A000-memory.dmp

Filesize
40KB

Download
memory/4008-287-0x000000001B520000-0x000000001B530000-memory.dmp

Filesize
64KB

Download
memory/4008-281-0x00000000007E0000-0x0000000000A82000-memory.dmp

Filesize
2.6MB

Download
memory/4008-295-0x000000001B640000-0x000000001B64C000-memory.dmp

Filesize
48KB

Download
memory/4008-288-0x000000001B5D0000-0x000000001B626000-memory.dmp

Filesize
344KB

Download
memory/4008-278-0x0000000000000000-mapping.dmp

Download
memory/4008-284-0x000000001B580000-0x000000001B5D0000-memory.dmp

Filesize
320KB

Download
memory/4008-290-0x000000001C5D0000-0x000000001CAF6000-memory.dmp

Filesize
5.1MB

Download
memory/4068-738-0x0000000000000000-mapping.dmp

Download
memory/4108-779-0x00000000017F0000-0x0000000001802000-memory.dmp

Filesize
72KB

Download
memory/4108-778-0x0000000001780000-0x0000000001792000-memory.dmp

Filesize
72KB

Download
memory/4108-776-0x0000000000000000-mapping.dmp

Download
memory/4240-796-0x0000000000000000-mapping.dmp

Download
memory/4264-753-0x0000000000000000-mapping.dmp

Download
memory/4288-309-0x0000000000000000-mapping.dmp

Download
memory/4560-785-0x0000000000000000-mapping.dmp

Download
memory/4560-787-0x0000000000A70000-0x0000000000A82000-memory.dmp

Filesize
72KB

Download
memory/4664-298-0x0000000000000000-mapping.dmp

Download
memory/4664-360-0x000001FFC35B0000-0x000001FFC35D2000-memory.dmp

Filesize
136KB

Download
memory/4708-150-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-172-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-149-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-170-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-151-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-116-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-148-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-152-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-147-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-146-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-145-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-153-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-154-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-155-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-144-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-171-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-143-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-142-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-156-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-141-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-157-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-158-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-159-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-140-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-117-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-139-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-115-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-160-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-138-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-161-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-162-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-123-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-177-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-137-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-173-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-136-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-135-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-134-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-168-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-118-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-163-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-133-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-132-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-164-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-131-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-174-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-130-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-178-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-165-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-166-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-129-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-167-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-128-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-127-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-169-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-126-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-175-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-120-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-125-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-121-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-176-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4708-124-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4728-312-0x0000000000000000-mapping.dmp

Download
memory/4740-415-0x0000000000000000-mapping.dmp

Download
memory/4816-768-0x0000000000000000-mapping.dmp

Download
memory/4816-770-0x00000000012F0000-0x0000000001302000-memory.dmp

Filesize
72KB

Download
memory/4852-180-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4852-179-0x0000000000000000-mapping.dmp

Download
memory/4852-181-0x0000000076F80000-0x000000007710E000-memory.dmp

Filesize
1.6MB

Download
memory/4868-798-0x0000000000000000-mapping.dmp

Download
memory/4872-788-0x0000000000000000-mapping.dmp

Download
memory/4908-755-0x0000000000000000-mapping.dmp

Download
memory/4972-736-0x0000000000000000-mapping.dmp

Download
memory/5052-327-0x0000000000000000-mapping.dmp

Download
memory/5052-370-0x00000000027F0000-0x0000000002846000-memory.dmp

Filesize
344KB

Download
memory/5052-375-0x0000000000C90000-0x0000000000CA2000-memory.dmp

Filesize
72KB

Download
memory/5052-730-0x000000001AFC0000-0x000000001B000000-memory.dmp

Filesize
256KB

Download
memory/5084-746-0x0000000000000000-mapping.dmp

Download