agenda | 9c9a264f5f1a78753f7f80ee6143d6c8967fa1375821bc09187767756d366800

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2023 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

decryptor_575a467c.exe
Size

1.7MB
MD5

a72345f5a627a2c8222f71347a44b013
SHA1

595bf5761ec6eee55fb291cb465736bbbb4bfcf8
SHA256

9c9a264f5f1a78753f7f80ee6143d6c8967fa1375821bc09187767756d366800
SHA512

5081c69929c6bd43277f416e942c7d8bb57a45c26089ade5a985ed9ae6a376128ed7dc9cba2618cf918941f7b919db73f1f48cf0c6d30b707927c4a77fbb3482
SSDEEP

24576:SV2LT3INDJRQDj4uFgjR9XKaNIAOgoXeQ7vIKiKyn9cr2Uy9TnFXlDi9uIIg:fLT4NDG4uGlF6AubJyKr2UBuIIg

Score

10^/10

agenda ransomware spyware stealer

Malware Config

Extracted

Family

agenda

Attributes

company_id
feGDg5BHWw
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: feGDg5BHWw Domain: e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion login: _RgxgvCfv_3rQI5oinfr9gj5JS6_AGP7 password:

rsa_privkey.plain

Signatures

Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.
ransomware agenda

Drops file in Drivers directory 21 IoCs

Processes:

decryptor_575a467c.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\afunix.sys	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui	decryptor_575a467c.exe

Drops startup file 1 IoCs

Processes:

decryptor_575a467c.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	decryptor_575a467c.exe

Loads dropped DLL 12 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exe

pid	process
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
216	OfficeClickToRun.exe
4472	OfficeClickToRun.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 64 IoCs

Processes:

decryptor_575a467c.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\Web\Wallpaper\Theme2\Desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Public\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1675742406-747946869-1029867430-1000\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\Web\Wallpaper\Theme1\Desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.423_none_7c917c97525f1487\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	decryptor_575a467c.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	decryptor_575a467c.exe

Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

decryptor_575a467c.exe

description ioc process

File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf decryptor_575a467c.exe

description	ioc	process
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	decryptor_575a467c.exe

Drops file in System32 directory 64 IoCs

Processes:

decryptor_575a467c.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\it-IT\rdvgumd32.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-FibreChannel-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Helium-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsExt-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\whvcrash.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_d32fe6b1c2b7b2a5\bda.inf	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\adsnt.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Security-SPP-Component-SKU-ServerRdsh-License-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\downlevel\api-ms-win-shcore-stream-l1-1-0.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\cht4sx64.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\circlass.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\PlayToStatusProvider.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-2-ul-store-rtm.xrm-ms	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA425_olpc_SS_T.bin	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\BthOob.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\gpscript.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\ncryptprov.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\UIRibbon.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\mimofcodec.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Holographic-Desktop-Merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\Dism\de-DE\LogProvider.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\d3d11.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\de-DE\MSFT_ScriptResourceStrings.psd1	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterUso.Format.ps1xml	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\wavemsp.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\netk57a.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\en-US\eudcedit.exe.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\en-US\g711codc.ax.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\IconCodecService.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\wimgapi.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\vca.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\F12\es-ES\F12Script.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0010~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\wGenCounter.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA425_olpc_A_TP203NAH.bin	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\EhStorPwdDrv.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\netrtwlanu.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Virtio-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\c_fsreplication.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\wvmic_timesync.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\miutils.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\ucrtbase.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WsmAgentUninstall.mof	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\winmsipc.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\wvmbusvideo.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\adsnt.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\eventvwr.exe.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EditionPack-Professional-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\pspluginwkr.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\MSFT_NCSIPolicyConfiguration.cdxml	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-Feature-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\wbem\fr-FR\wininit.mfl	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Multimedia-MFPMP-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\downlevel\api-ms-win-core-registry-l2-1-0.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\schtasks.exe.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_clr0400.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\SessEnv.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SimpleTCP-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OneDrive-Setup-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\occache.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\SysWOW64\msdadiag.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\xusb22.inf_amd64_d0f2fd4c931f4672\xusb22.inf	decryptor_575a467c.exe

Drops file in Program Files directory 64 IoCs

Processes:

decryptor_575a467c.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\instrument.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\jvm.lib	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageMedTile.scale-150_contrast-black.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-100.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zx______.pfm	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-timezone-l1-1-0.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptySearch.scale-150.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Telemetry\BIEvents.xml	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-400.HCBlack.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-200.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\ui-strings.js	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-256.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\SetupTeardown.ps1	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_col.hxc	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendar.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\PaintLargeTile.scale-200.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-cn\ui-strings.js	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF64.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\PREVIEW.GIF	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ExcelServices.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\156.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-80.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\msdaurl.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEES.DLL	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MissingAlbumArt.jpg	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\MusicWhatsNewItems.json	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll	decryptor_575a467c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	decryptor_575a467c.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-125.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-200.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	decryptor_575a467c.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fa.pak.DATA	decryptor_575a467c.exe

Drops file in Windows directory 64 IoCs

Processes:

decryptor_575a467c.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\ja\DropSqlPersistenceProviderLogic.sql	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-DynamicMemory-VirtualDevice-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..ep-chxapp.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_7d8eee60f8081103\AppxSignature.p7x	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-devices-haptics_31bf3856ad364e35_10.0.19041.264_none_22b5b9cd69282c16\r\Windows.Devices.Haptics.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\drvinst.exe	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..y-mdmcommon-onecore_31bf3856ad364e35_10.0.19041.746_none_b9ad1f8b13fd3844\f\MdmCommon.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Numerics.Vectors.resources.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.264.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_c_sslaccel.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_83daa211cc9c2110\c_sslaccel.inf_loc	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Containers-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Hyper-V-Offline-Core-Group-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..r-manager.resources_31bf3856ad364e35_10.0.19041.1_de-de_a4cb5add146741b2\cmservice.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\default-progress-vm.js	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-backup-cpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_83fb8580a25721c5\sdcpl.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_10.0.19041.117_none_3c1920f753190d57\bisrv.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\CloudExperienceHostAPI.winmd	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.de.resx	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-NFS-ClientCore-D-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Telnet-Client-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-b..ws-minwin.resources_31bf3856ad364e35_10.0.19041.1_de-de_08f17580025a89a5\winload.exe.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\UnifiedEnrollment.DataModel.winmd	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Host-Guardian-Deployment-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-HyperV-OptionalFeature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeerror-main.html	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\WindowsFormsIntegration.resources.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-Compute-Storage-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-Storage-QoS-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-u..itefilter.resources_31bf3856ad364e35_10.0.19041.1266_en-us_b648a623c9262c3b\f\uwfrtl.sys.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Enterprise-Desktop-Shared-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-UpdateTargeting-ClientOS-21h1-EKB-Wrapper-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.789.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\Formatter\Html\HtmlFormatter.js	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-d..onmanager.resources_31bf3856ad364e35_10.0.19041.1_de-de_ad3145588be2eceb\DictationManager.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.tlb	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-CoreSystem-RemoteFS-Client-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_eventviewersettings.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7bf34831f087e546\miguiresource.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-a..sibility-experience_31bf3856ad364e35_10.0.19041.746_none_69babc1ce4e23a84\cross.svg	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.1_none_0423901f2a62a812\fhuxpresentation.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Runtime.Serialization.Formatters.Soap.resources.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\PolicyDefinitions\es-ES\wlansvc.adml	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-analog-h2-physicsplugin-baked_31bf3856ad364e35_10.0.19041.1_none_5fb69e670630e91d\physicsmaterialrubber.hbakedphysicsmaterial	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-dot3ui.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b2661abcc7353069\dot3dlg.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Composable-PlatformExtension-DragDropCommon-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Dedup-ChunkLibrary-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-Publishing-WMIProvider-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\Fonts\vga775.fon	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.resx	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql	decryptor_575a467c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizard.aspx.es.resx	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.19041.207_none_a87fa27025b2eaac\r\dosvc.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\MultiPoint-Help-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\js\xboxTcuiContext.js	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..brokeredapi-desktop_31bf3856ad364e35_10.0.19041.964_none_a612f0b9f4217a31\f\Windows.Cortana.Desktop.dll	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..dservices.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fa358305ab788fdb\dsadmin.dll.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-a..sibility-experience_31bf3856ad364e35_10.0.19041.1_none_41b27ed425707c3a\pin.svg	decryptor_575a467c.exe
File opened for modification	C:\Windows\PolicyDefinitions\WinLogon.admx	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-RemoteFX-HyperV-Integration-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_hidbatt.inf_31bf3856ad364e35_10.0.19041.1_none_053be026f01761fd\hidbatt.sys	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_prnms012.inf_31bf3856ad364e35_10.0.19041.1_none_a3feabb281faa7e4\prnms012.inf	decryptor_575a467c.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Media-Streaming-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.mum	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..acysnapin.resources_31bf3856ad364e35_10.0.19041.1_it-it_fa1b38e5fc197cc5\Cnfgprts.ocx.mui	decryptor_575a467c.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-hyper-v-i..nents-rdv.resources_31bf3856ad364e35_10.0.19041.1_es-es_b39d4bf108b45afa\vmicrdv.dll.mui	decryptor_575a467c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 34 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,41484365,39965824,7153487,17110988,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

decryptor_575a467c.exe

pid	process
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe
2752	decryptor_575a467c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OfficeClickToRun.exe

pid process

216 OfficeClickToRun.exe

C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe
"C:\Users\Admin\AppData\Local\Temp\decryptor_575a467c.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2752

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:216

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll
Filesize
230KB

MD5
2fc4d42f568c9fee6e069f7ea46d5cc0

SHA1
318429f05909b5d4097c2840d64029bc76d08d0f

SHA256
f0d4d5993e3e236c288ab8534583da7a624b340c0f6160f61ff4e2df4a82d390

SHA512
8e419505b40f55486aaa25ddca9e19c575986ffcd606168dca0ffda25e3affc5e5104185647f5cc277c5f647a6358f0fd35f53ca20bcc208728659eaf43daee9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll
Filesize
230KB

MD5
2fc4d42f568c9fee6e069f7ea46d5cc0

SHA1
318429f05909b5d4097c2840d64029bc76d08d0f

SHA256
f0d4d5993e3e236c288ab8534583da7a624b340c0f6160f61ff4e2df4a82d390

SHA512
8e419505b40f55486aaa25ddca9e19c575986ffcd606168dca0ffda25e3affc5e5104185647f5cc277c5f647a6358f0fd35f53ca20bcc208728659eaf43daee9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll
Filesize
672KB

MD5
f5d4c22ced66b4f563c6640068aec6b4

SHA1
33ce26f849b4f981448567c379e6c88031c919e4

SHA256
df7abcdf3da7c974c481c90535cb143d5ba005c2972639c1b0613634dc6f055f

SHA512
97ed0d91c18a4a056f7914dd7899710c9447adde3bbbcc395197dfa297b265e835687ef9d030e850b2b031759448cf9369642bdc67f08c306c0c4aa1d7d9682f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll
Filesize
304KB

MD5
d89cb906c358b2649e15b444a5e0411a

SHA1
93869f7039ae43e04344516234ab9e6a7811307b

SHA256
3ce0887e31ede3772dd5ff44a11fd8bf1611442e88b28605ffe881affc533aa0

SHA512
e4bcbd596b8ae810af9bddfb4b2128af2718e12e886ef9218a6c81638e60dcd69f162997c9771f830fe5248ade961d50a2abbfa2633bd28d90310d30710e23f6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll
Filesize
2.2MB

MD5
64fa89fe1bdc88ef8db4cc8c7c8319ec

SHA1
e1aff65c5b65a6a06303d5fe3bb9b8b6cdf5921b

SHA256
863b48351587489dc53337324d2d0602f6df57cc51b39d5713cf4bbec9046621

SHA512
11af835730f761ba86f518bd8d18425287fbb25f49faaa2d82defc84f7794d5684327e84f36b91ef57262828b0989d4a126e75fce30911eecc552c266223658c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll
Filesize
486KB

MD5
c9dab12378f3f914ed34c23494ce74c0

SHA1
69c14443b2ebb2f1e726243288aab1d12b97db37

SHA256
18c514f88f60310f3cf25cda77924a01e0a36d14a0e9762756648c2c648ce705

SHA512
150fc79994d2af3fa38d61d875220c1baa3c24364423ee670718bd149be1129c52b30296bba44394eac8cbc587c065f04aa527522ef5c605f7221439fb7c7ca9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll
Filesize
210KB

MD5
761277d21e3a31948012fef82b42f022

SHA1
08f7b27e33dd2d3cdfd54c283cdd22994a53402b

SHA256
6e1fec70fc0013137957242159edf04eafdb3c14d8a6f1ee2204d451114a19be

SHA512
0401fa3425ac8b472f9f42166e70906cc531c94782f2b0338281f983a5ad6f6fd6817b26fe59e841be25aacbfca0df88f672db5a4e17fa9e99d281d912db2d8f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll
Filesize
1.5MB

MD5
cd68777721d728fe1f0417afd2a7b8fa

SHA1
2b245556966182e297eca0a53e1af9f732182272

SHA256
62023fd2449f16654306b645c1617aeb84c913778ce128fa1c90840dd230361e

SHA512
93a500ee36496211d108d950d5b2877010d1544528fac16abc64a5798f535093a7a78f209b848527e6f559a6b4bd29317a4aa4afbac0be609afb946789a35e66

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll
Filesize
600KB

MD5
ccc94602a6a71b59771ef2c321fe7bcd

SHA1
72fa3ce5942e46a3ddff792a6a9c95bcd9575646

SHA256
ef9d1539107155cf0fabe420790cb58d36fe562a5e2255ce472266669fc4bf98

SHA512
a731734703e12260a6fa37b4c0ec37d8afd0d97538c3383b59a9c15b6e44e6876babc3dba34e2bfc691b7f349632b6daeaaa97f388af7d5e57aa1fe17b781e31

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll
Filesize
1.2MB

MD5
c7f5af65598cf219f1f7544f895edd4c

SHA1
82f2decf1eb8a3c3dd015194f02e07abe651959f

SHA256
d872c5c1b312f4b257cad8c1f77c7e3b1ed090611e7186438f0b0ca6db6638d0

SHA512
8fb9378b798ec099079a23ccb7c2ec29ca0d87e6864ecf020fa5e300bc0bd9425f13a466c677818ee38fe560ceb493aff33fa831c6af03fac1566deb07535829

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll
Filesize
952KB

MD5
25297efc3bf8d2cb34972e49f033fa0a

SHA1
291881891e917c780fc00b22021e5c391b060dfe

SHA256
1ed32eb18896bd5fb1f6281eb875ce21dfa9ea20ffaa7e6c3b94eeb23f13aedd

SHA512
2ebb012a8973913c4b849988884372550bc1e7c5dd3af01ac01feab49dca40227e653876fce6b13a2c364c04931d5c6bfe88ef23e7065d22279779605954d2dd

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll
Filesize
1.2MB

MD5
77055f17bb0ddb795ef3a63ca0039bac

SHA1
433d647221c9bb54c3c76be44eed0c6a67b0a0de

SHA256
20f7fa3c8ab200d87ffa9f58c2700ab393893291338090ec900b6111ca561040

SHA512
5aab26f303672c3d745c303ea54ed5891529a0cc5860a4fb8fbb33abc2559ac064c44ea1a943301bd399f2616dd1e15d358474b1089d1cb11eb046d88d9d8d04

Download Submit
memory/2752-147-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-146-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-145-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-149-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-151-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-152-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-153-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-154-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-155-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-156-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download
memory/2752-157-0x0000000000C30000-0x0000000000DEE000-memory.dmp

Filesize
1.7MB

Download