djvu | 983eecd93e507fe9b968cad6e83c5314fc61ef881a141b40d0102b6f1fa5be4c

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

266KB
MD5

28d76bc20e00e083b7b1846e0e242ba4
SHA1

f0256c658fc8a72adc2b4f13b6268603479098e3
SHA256

983eecd93e507fe9b968cad6e83c5314fc61ef881a141b40d0102b6f1fa5be4c
SHA512

dbcd5148437958d23171bc815776f5501509b6b24d7d081d44a536b9772de3780e1fd71f4f329d7e4ccc983204a44d8dc71d66ee1d9cd1ba51578a03189a5a23
SSDEEP

3072:y0XZRrpPgrVGUyt+2GlNedZTMOSi1AeWG+BZ3V7OX9BocL45mUspX:vTrWrEUy0Z7dOBAeN+p7nS45mUs

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/raud/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.wwza
offline_id
LtYnlJvK0hICyOCeum6Tv4pbia9jcIGHVgA3Xht1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-xoUXGr6cqT Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0789JOsie

rsa_pubkey.plain

Extracted

Family

redline

Botnet

lux3

176.123.9.142:14845

Attributes

auth_value
e94dff9a76da90d6b000642c4a52574b

Extracted

Family

redline

38.181.25.43:3325

Attributes

auth_value
082cde17c5630749ecb0376734fe99c9

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

51.38.95.107:42494

Attributes

auth_value
3a050df92d0cf082b2cdaf87863616be

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

Detected Djvu ransomware 15 IoCs

resource	yara_rule
behavioral2/memory/852-20-0x0000000002550000-0x000000000266B000-memory.dmp	family_djvu
behavioral2/memory/3464-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3464-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3464-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3464-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1980-61-0x00000000024C0000-0x00000000025DB000-memory.dmp	family_djvu
behavioral2/memory/1572-65-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1572-63-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1572-67-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1572-75-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3464-97-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1572-150-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2020-189-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2020-199-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2020-193-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 3 IoCs

resource	yara_rule
behavioral2/memory/4664-206-0x0000000002980000-0x0000000002D7A000-memory.dmp	family_glupteba
behavioral2/memory/4664-209-0x0000000002D80000-0x000000000366B000-memory.dmp	family_glupteba
behavioral2/memory/4664-290-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
5116	netsh.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	D219.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	E594.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	kos1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	kos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	CBBC.exe

Executes dropped EXE 26 IoCs

pid	Process
852	CBBC.exe
4756	CCF6.exe
3464	CBBC.exe
3624	CDC2.exe
2548	D0C0.exe
1980	D219.exe
1572	D219.exe
4992	D9CC.exe
4152	E594.exe
5024	aafg31.exe
1732	toolspub2.exe
2224	D219.exe
4664	31839b57a4f11171d6abc8bbc4451ee4.exe
3380	kos1.exe
2020	D219.exe
2208	toolspub2.exe
3168	set16.exe
3064	kos.exe
5004	is-5VUUM.tmp
3856	previewer.exe
316	previewer.exe
2864	CBBC.exe
3572	CBBC.exe
1160	31839b57a4f11171d6abc8bbc4451ee4.exe
4984	csrss.exe
3496	injector.exe

Loads dropped DLL 4 IoCs

pid	Process
4296	regsvr32.exe
5004	is-5VUUM.tmp
5004	is-5VUUM.tmp
5004	is-5VUUM.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4900	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\147ba1f5-3ec2-427f-8667-b4acbd02d202\\CBBC.exe\" --AutoStart"	CBBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	api.2ip.ua
40	api.2ip.ua
53	api.2ip.ua

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	Process not Found
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	Process not Found
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 852 set thread context of 3464	852	CBBC.exe	92
PID 1980 set thread context of 1572	1980	D219.exe	100
PID 2548 set thread context of 2924	2548	D0C0.exe	107
PID 2224 set thread context of 2020	2224	D219.exe	113
PID 1732 set thread context of 2208	1732	toolspub2.exe	117
PID 2864 set thread context of 3572	2864	CBBC.exe	129

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-5VUUM.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-5VUUM.tmp
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-5VUUM.tmp
File created	C:\Program Files (x86)\PA Previewer\is-E1CM9.tmp	is-5VUUM.tmp
File created	C:\Program Files (x86)\PA Previewer\is-IA50I.tmp	is-5VUUM.tmp
File created	C:\Program Files (x86)\PA Previewer\is-3S118.tmp	is-5VUUM.tmp
File created	C:\Program Files (x86)\PA Previewer\is-C916T.tmp	is-5VUUM.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5108	2548	WerFault.exe	95
4012	2020	WerFault.exe	113
3516	3572	WerFault.exe	129

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D9CC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D9CC.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D9CC.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5100	schtasks.exe
4316	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4308	file.exe
4308	file.exe
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3216	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4308	file.exe
4992	D9CC.exe
2208	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	3064	kos.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	4756	CCF6.exe
Token: SeDebugPrivilege	3856	previewer.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	316	previewer.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	3624	CDC2.exe
Token: SeShutdownPrivilege	3216	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3216	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 852	3216	Process not Found	89
PID 3216 wrote to memory of 852	3216	Process not Found	89
PID 3216 wrote to memory of 852	3216	Process not Found	89
PID 3216 wrote to memory of 4756	3216	Process not Found	90
PID 3216 wrote to memory of 4756	3216	Process not Found	90
PID 3216 wrote to memory of 4756	3216	Process not Found	90
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 852 wrote to memory of 3464	852	CBBC.exe	92
PID 3216 wrote to memory of 3624	3216	Process not Found	94
PID 3216 wrote to memory of 3624	3216	Process not Found	94
PID 3216 wrote to memory of 3624	3216	Process not Found	94
PID 3216 wrote to memory of 2548	3216	Process not Found	95
PID 3216 wrote to memory of 2548	3216	Process not Found	95
PID 3216 wrote to memory of 2548	3216	Process not Found	95
PID 3216 wrote to memory of 1980	3216	Process not Found	97
PID 3216 wrote to memory of 1980	3216	Process not Found	97
PID 3216 wrote to memory of 1980	3216	Process not Found	97
PID 3216 wrote to memory of 2760	3216	Process not Found	98
PID 3216 wrote to memory of 2760	3216	Process not Found	98
PID 2760 wrote to memory of 4296	2760	regsvr32.exe	99
PID 2760 wrote to memory of 4296	2760	regsvr32.exe	99
PID 2760 wrote to memory of 4296	2760	regsvr32.exe	99
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 1980 wrote to memory of 1572	1980	D219.exe	100
PID 3216 wrote to memory of 4992	3216	Process not Found	101
PID 3216 wrote to memory of 4992	3216	Process not Found	101
PID 3216 wrote to memory of 4992	3216	Process not Found	101
PID 3464 wrote to memory of 4900	3464	CBBC.exe	102
PID 3464 wrote to memory of 4900	3464	CBBC.exe	102
PID 3464 wrote to memory of 4900	3464	CBBC.exe	102
PID 3216 wrote to memory of 4152	3216	Process not Found	103
PID 3216 wrote to memory of 4152	3216	Process not Found	103
PID 3216 wrote to memory of 4152	3216	Process not Found	103
PID 2548 wrote to memory of 2924	2548	D0C0.exe	107
PID 2548 wrote to memory of 2924	2548	D0C0.exe	107
PID 2548 wrote to memory of 2924	2548	D0C0.exe	107
PID 2548 wrote to memory of 2924	2548	D0C0.exe	107
PID 2548 wrote to memory of 2924	2548	D0C0.exe	107
PID 2548 wrote to memory of 2924	2548	D0C0.exe	107
PID 2548 wrote to memory of 2924	2548	D0C0.exe	107
PID 2548 wrote to memory of 2924	2548	D0C0.exe	107
PID 1572 wrote to memory of 2224	1572	D219.exe	105
PID 1572 wrote to memory of 2224	1572	D219.exe	105
PID 1572 wrote to memory of 2224	1572	D219.exe	105
PID 4152 wrote to memory of 5024	4152	E594.exe	108
PID 4152 wrote to memory of 5024	4152	E594.exe	108
PID 4152 wrote to memory of 1732	4152	E594.exe	110
PID 4152 wrote to memory of 1732	4152	E594.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4308

C:\Users\Admin\AppData\Local\Temp\CBBC.exe
C:\Users\Admin\AppData\Local\Temp\CBBC.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Local\Temp\CBBC.exe
  C:\Users\Admin\AppData\Local\Temp\CBBC.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\147ba1f5-3ec2-427f-8667-b4acbd02d202" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\CBBC.exe
    "C:\Users\Admin\AppData\Local\Temp\CBBC.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\CBBC.exe
      "C:\Users\Admin\AppData\Local\Temp\CBBC.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:3572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 572
        5⤵
        Program crash
        
        PID:3516

C:\Users\Admin\AppData\Local\Temp\CCF6.exe
C:\Users\Admin\AppData\Local\Temp\CCF6.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Users\Admin\AppData\Local\Temp\CDC2.exe
C:\Users\Admin\AppData\Local\Temp\CDC2.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Users\Admin\AppData\Local\Temp\D0C0.exe
C:\Users\Admin\AppData\Local\Temp\D0C0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 136
  2⤵
  - Program crash
  PID:5108

C:\Users\Admin\AppData\Local\Temp\D219.exe
C:\Users\Admin\AppData\Local\Temp\D219.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\D219.exe
  C:\Users\Admin\AppData\Local\Temp\D219.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Users\Admin\AppData\Local\Temp\D219.exe
    "C:\Users\Admin\AppData\Local\Temp\D219.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\D219.exe
      "C:\Users\Admin\AppData\Local\Temp\D219.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 568
        5⤵
        Program crash
        
        PID:4012

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D4AA.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\D4AA.dll
  2⤵
  - Loads dropped DLL
  PID:4296

C:\Users\Admin\AppData\Local\Temp\D9CC.exe
C:\Users\Admin\AppData\Local\Temp\D9CC.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4992

C:\Users\Admin\AppData\Local\Temp\E594.exe
C:\Users\Admin\AppData\Local\Temp\E594.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Local\Temp\aafg31.exe
  "C:\Users\Admin\AppData\Local\Temp\aafg31.exe"
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2208
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  PID:4664
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:1160
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Modifies data under HKEY_USERS
      PID:4800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:1856
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:5116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:2932
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:100
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      PID:4984
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5060
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:5100
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:1352
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2072
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        
        PID:3496
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:4316
- C:\Users\Admin\AppData\Local\Temp\kos1.exe
  "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\set16.exe
    "C:\Users\Admin\AppData\Local\Temp\set16.exe"
    3⤵
    - Executes dropped EXE
    PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\is-GDR0L.tmp\is-5VUUM.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GDR0L.tmp\is-5VUUM.tmp" /SL4 $B00EC "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      PID:5004
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 8
        5⤵
        
        PID:4620
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 8
        6⤵
        
        PID:4780
    - - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3856
    - - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
- - C:\Users\Admin\AppData\Local\Temp\kos.exe
    "C:\Users\Admin\AppData\Local\Temp\kos.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2548 -ip 2548
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2020 -ip 2020
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3572 -ip 3572
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
9b667ecf8c64e80b6ba550371dc3149c

SHA1
dd7dd3675307f72562b20d01e86baf619798accf

SHA256
01376f194051bd65ab162ec35c24d005c179d01d28657eb1f339bb2ededfb886

SHA512
60daf11cfac79900c5e7c988606570a45a9b170b500acc203c0a12c0683914b745442a177017acc3a4a7df3fd99847768a264e2f0fd4aec76c92b5ecd870fc0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
5318d6a902beaba43fd3af656c2e3cb0

SHA1
0202ac2d3e3ad69f1456c6de198b462cdba0edda

SHA256
bad155252d58babc8824eb5e5bc5efd49ba946a2d7f2aaf27dae16d157c7646e

SHA512
14b17ce0850c83ade52982c2c3d3d65bc621c2c09dae2f84cd44890a560811d5c25627e582c7dfa544f2a05665562f48f3b2cc4941bac688242eb13ff0944cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
f5213611da3f2ecb2cfc66e7d03630e4

SHA1
9c8a008999804120554d56a433266aaa6b09676d

SHA256
6163200cb64723f4d3dab1e870452cd0a00a0b09406f6d68261d85db45c721be

SHA512
af5faeb2f26551f82333c96dca95c5b858bc3a2bb12952509e414e8b67639e30f8d8654111615ecba1dbbfd6d78df0c0fd5022ef62707bb25313dcbb2744cefd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
7218ac046f31e0fb2c37628f51b52946

SHA1
780dbbc74603569ff5dbfdbec942d30e4eadd155

SHA256
853bd8a8da743326110fb9b53a4a0d9bd726e7352661a618a9c7d7cc6b4dabe9

SHA512
af8a78aed62d03c9c187a0bd0ae329861c9449f5f8d87170427d6e33cb46add184cc4ec9c70a559104530edd25c88aecd7ac0a778691322030b098bf79789676

Download Submit
C:\Users\Admin\AppData\Local\147ba1f5-3ec2-427f-8667-b4acbd02d202\CBBC.exe

Filesize
774KB

MD5
e56c98ba34e2520ea0bb08e643572ecf

SHA1
47b72b2f009c7bcb8846e3c006274c97cd7d720b

SHA256
b2848fc273a249dd45a23e09ea2c9fb52f1e345cdd35ff8f09a34349270b96dc

SHA512
408d28deeb7ec9417652a5d1c1869a168f1440beecb97c9721e61e5441bfa324be684e18acb827adb3a04dc79a5b1c292ce28e08b792e7793f3e34cd585b99b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
2KB

MD5
9b756bc85e5324eb8f87a69e3f9959ab

SHA1
1778b2e2d6a00c421578a284db1e743931611d66

SHA256
e347a39e49ca8c835cc47d3f039230969e7c4156089f2e83e8a0aed1df88016e

SHA512
c897af3307e3c3163762021f49934ac5fbeab27f123e814bc390bdf1f0ed46671afeadcc87a8a4b18ddf13f4abd0d8ef00343af91ff999d7d447c96505d866d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
f2a6bcee6c6bb311325b1b41b5363622

SHA1
587c5b9e0d6a6f50607e461667a09806e5866745

SHA256
ae3d87edb3a831555bac3684482ac5f4f1d794b75d00809250ea8d4937e65e8a

SHA512
9e7802dd50798bfb50553396fa9a45cf0ad16ca5937a33eeb731b4b9744dc0c0b837166675bf4a169c2fe1bc1ac5883b4791b4f2ac7dea4e42e43de77d053e5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
f2a6bcee6c6bb311325b1b41b5363622

SHA1
587c5b9e0d6a6f50607e461667a09806e5866745

SHA256
ae3d87edb3a831555bac3684482ac5f4f1d794b75d00809250ea8d4937e65e8a

SHA512
9e7802dd50798bfb50553396fa9a45cf0ad16ca5937a33eeb731b4b9744dc0c0b837166675bf4a169c2fe1bc1ac5883b4791b4f2ac7dea4e42e43de77d053e5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
f2a6bcee6c6bb311325b1b41b5363622

SHA1
587c5b9e0d6a6f50607e461667a09806e5866745

SHA256
ae3d87edb3a831555bac3684482ac5f4f1d794b75d00809250ea8d4937e65e8a

SHA512
9e7802dd50798bfb50553396fa9a45cf0ad16ca5937a33eeb731b4b9744dc0c0b837166675bf4a169c2fe1bc1ac5883b4791b4f2ac7dea4e42e43de77d053e5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
f2a6bcee6c6bb311325b1b41b5363622

SHA1
587c5b9e0d6a6f50607e461667a09806e5866745

SHA256
ae3d87edb3a831555bac3684482ac5f4f1d794b75d00809250ea8d4937e65e8a

SHA512
9e7802dd50798bfb50553396fa9a45cf0ad16ca5937a33eeb731b4b9744dc0c0b837166675bf4a169c2fe1bc1ac5883b4791b4f2ac7dea4e42e43de77d053e5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBBC.exe

Filesize
774KB

MD5
e56c98ba34e2520ea0bb08e643572ecf

SHA1
47b72b2f009c7bcb8846e3c006274c97cd7d720b

SHA256
b2848fc273a249dd45a23e09ea2c9fb52f1e345cdd35ff8f09a34349270b96dc

SHA512
408d28deeb7ec9417652a5d1c1869a168f1440beecb97c9721e61e5441bfa324be684e18acb827adb3a04dc79a5b1c292ce28e08b792e7793f3e34cd585b99b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBBC.exe

Filesize
774KB

MD5
e56c98ba34e2520ea0bb08e643572ecf

SHA1
47b72b2f009c7bcb8846e3c006274c97cd7d720b

SHA256
b2848fc273a249dd45a23e09ea2c9fb52f1e345cdd35ff8f09a34349270b96dc

SHA512
408d28deeb7ec9417652a5d1c1869a168f1440beecb97c9721e61e5441bfa324be684e18acb827adb3a04dc79a5b1c292ce28e08b792e7793f3e34cd585b99b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBBC.exe

Filesize
774KB

MD5
e56c98ba34e2520ea0bb08e643572ecf

SHA1
47b72b2f009c7bcb8846e3c006274c97cd7d720b

SHA256
b2848fc273a249dd45a23e09ea2c9fb52f1e345cdd35ff8f09a34349270b96dc

SHA512
408d28deeb7ec9417652a5d1c1869a168f1440beecb97c9721e61e5441bfa324be684e18acb827adb3a04dc79a5b1c292ce28e08b792e7793f3e34cd585b99b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBBC.exe

Filesize
774KB

MD5
e56c98ba34e2520ea0bb08e643572ecf

SHA1
47b72b2f009c7bcb8846e3c006274c97cd7d720b

SHA256
b2848fc273a249dd45a23e09ea2c9fb52f1e345cdd35ff8f09a34349270b96dc

SHA512
408d28deeb7ec9417652a5d1c1869a168f1440beecb97c9721e61e5441bfa324be684e18acb827adb3a04dc79a5b1c292ce28e08b792e7793f3e34cd585b99b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBBC.exe

Filesize
774KB

MD5
e56c98ba34e2520ea0bb08e643572ecf

SHA1
47b72b2f009c7bcb8846e3c006274c97cd7d720b

SHA256
b2848fc273a249dd45a23e09ea2c9fb52f1e345cdd35ff8f09a34349270b96dc

SHA512
408d28deeb7ec9417652a5d1c1869a168f1440beecb97c9721e61e5441bfa324be684e18acb827adb3a04dc79a5b1c292ce28e08b792e7793f3e34cd585b99b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CCF6.exe

Filesize
249KB

MD5
c635d3d5a5ea1303144f22a17be302d4

SHA1
a75d05e9166312189005ab0e8e2e9d92c4ac410f

SHA256
a706dd1cdbcdfa0e7de3cc5590d422338d17dcc55a9099d611a65dfb592d97d0

SHA512
3ec36398d804fe2468a0db62973bdff4b66985db22b025035204d3b1a4358b64cdc1f2676ae511aeaf125b963d1d7d5429702ce370a19ae5eda2c6dc0773d21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CCF6.exe

Filesize
249KB

MD5
c635d3d5a5ea1303144f22a17be302d4

SHA1
a75d05e9166312189005ab0e8e2e9d92c4ac410f

SHA256
a706dd1cdbcdfa0e7de3cc5590d422338d17dcc55a9099d611a65dfb592d97d0

SHA512
3ec36398d804fe2468a0db62973bdff4b66985db22b025035204d3b1a4358b64cdc1f2676ae511aeaf125b963d1d7d5429702ce370a19ae5eda2c6dc0773d21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CDC2.exe

Filesize
261KB

MD5
aaa35a5dd28fb6dcd151ccb0b9ed270d

SHA1
08a9dbe8c26691836f34eab89f1c500085b6efc5

SHA256
902b165bc7d6facfcda550144157b58d122d3c38abe5f5cfe630ad5eea8f8557

SHA512
155c3c6554268664afa1144fed18551de9f1787b787693f0d41697b4819b8f635eff6b82eafd690e19c351fe4e6349f34f9a74e45cf86ddc074a085aaf4fabed

Download Submit
C:\Users\Admin\AppData\Local\Temp\CDC2.exe

Filesize
261KB

MD5
aaa35a5dd28fb6dcd151ccb0b9ed270d

SHA1
08a9dbe8c26691836f34eab89f1c500085b6efc5

SHA256
902b165bc7d6facfcda550144157b58d122d3c38abe5f5cfe630ad5eea8f8557

SHA512
155c3c6554268664afa1144fed18551de9f1787b787693f0d41697b4819b8f635eff6b82eafd690e19c351fe4e6349f34f9a74e45cf86ddc074a085aaf4fabed

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0C0.exe

Filesize
397KB

MD5
443a2a80342e250493c764a1a2507766

SHA1
691bbb40c4cc19b99fcbb6e30e10989b010205fc

SHA256
36409da21c9c35416d4bf8c12e76042a7bcb09b8ab659545a33bd1d078e0dd86

SHA512
a0d7c59f337f2f9ce32e12fc4ee3cc4025687fd0545a9511ea2246783d3e9cc5b63ba8a384d34d44dca399345862d79e53f43f02ca0d9e22b286ef1a047bee94

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0C0.exe

Filesize
397KB

MD5
443a2a80342e250493c764a1a2507766

SHA1
691bbb40c4cc19b99fcbb6e30e10989b010205fc

SHA256
36409da21c9c35416d4bf8c12e76042a7bcb09b8ab659545a33bd1d078e0dd86

SHA512
a0d7c59f337f2f9ce32e12fc4ee3cc4025687fd0545a9511ea2246783d3e9cc5b63ba8a384d34d44dca399345862d79e53f43f02ca0d9e22b286ef1a047bee94

Download Submit
C:\Users\Admin\AppData\Local\Temp\D219.exe

Filesize
755KB

MD5
3813360b2761ccd6900baa3181222f8d

SHA1
0b6c49adbc2cc2843e96fdffc5cc21953d2a5f08

SHA256
78c249396c534df474dcace36d13844d9ca61b9f386a00dcade81453b409d067

SHA512
c6bb56a8cb632e9e5713d299bdb2f86a625f18318ec0b2b4bdc4ec8ac15d3de27357e7ad07844b2d16cff927d9550eb30d1ed33c37218beaae68e78037affc08

Download Submit
C:\Users\Admin\AppData\Local\Temp\D219.exe

Filesize
755KB

MD5
3813360b2761ccd6900baa3181222f8d

SHA1
0b6c49adbc2cc2843e96fdffc5cc21953d2a5f08

SHA256
78c249396c534df474dcace36d13844d9ca61b9f386a00dcade81453b409d067

SHA512
c6bb56a8cb632e9e5713d299bdb2f86a625f18318ec0b2b4bdc4ec8ac15d3de27357e7ad07844b2d16cff927d9550eb30d1ed33c37218beaae68e78037affc08

Download Submit
C:\Users\Admin\AppData\Local\Temp\D219.exe

Filesize
755KB

MD5
3813360b2761ccd6900baa3181222f8d

SHA1
0b6c49adbc2cc2843e96fdffc5cc21953d2a5f08

SHA256
78c249396c534df474dcace36d13844d9ca61b9f386a00dcade81453b409d067

SHA512
c6bb56a8cb632e9e5713d299bdb2f86a625f18318ec0b2b4bdc4ec8ac15d3de27357e7ad07844b2d16cff927d9550eb30d1ed33c37218beaae68e78037affc08

Download Submit
C:\Users\Admin\AppData\Local\Temp\D219.exe

Filesize
755KB

MD5
3813360b2761ccd6900baa3181222f8d

SHA1
0b6c49adbc2cc2843e96fdffc5cc21953d2a5f08

SHA256
78c249396c534df474dcace36d13844d9ca61b9f386a00dcade81453b409d067

SHA512
c6bb56a8cb632e9e5713d299bdb2f86a625f18318ec0b2b4bdc4ec8ac15d3de27357e7ad07844b2d16cff927d9550eb30d1ed33c37218beaae68e78037affc08

Download Submit
C:\Users\Admin\AppData\Local\Temp\D219.exe

Filesize
755KB

MD5
3813360b2761ccd6900baa3181222f8d

SHA1
0b6c49adbc2cc2843e96fdffc5cc21953d2a5f08

SHA256
78c249396c534df474dcace36d13844d9ca61b9f386a00dcade81453b409d067

SHA512
c6bb56a8cb632e9e5713d299bdb2f86a625f18318ec0b2b4bdc4ec8ac15d3de27357e7ad07844b2d16cff927d9550eb30d1ed33c37218beaae68e78037affc08

Download Submit
C:\Users\Admin\AppData\Local\Temp\D4AA.dll

Filesize
1.4MB

MD5
ec3697f0d55b1db8f0445358e9c424f2

SHA1
557b0ec0e68cf7f1328e5e8d472ddf6a02560194

SHA256
d809fdfa818279b5fde711f3ade5d22dc4d49dbd3311d65c725ac26625c5388e

SHA512
1ff4a00325ad47ba8ca18d1ad8775a7021f858559d1f67d6b1c9d55fa1badb8c916f904b0b5ed9be518006eeea5c115e482472e1b5ec66a47a4ebfb169f472af

Download Submit
C:\Users\Admin\AppData\Local\Temp\D4AA.dll

Filesize
1.4MB

MD5
ec3697f0d55b1db8f0445358e9c424f2

SHA1
557b0ec0e68cf7f1328e5e8d472ddf6a02560194

SHA256
d809fdfa818279b5fde711f3ade5d22dc4d49dbd3311d65c725ac26625c5388e

SHA512
1ff4a00325ad47ba8ca18d1ad8775a7021f858559d1f67d6b1c9d55fa1badb8c916f904b0b5ed9be518006eeea5c115e482472e1b5ec66a47a4ebfb169f472af

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9CC.exe

Filesize
265KB

MD5
a25c8bcd78bfffff86e911122d610ff5

SHA1
a262560b7b021156a27f2f298d48e5dcb08d9506

SHA256
739c8d45ca4059f0b591bd553bdab486519b663fb092ad11868a8c6c3d9ec022

SHA512
fd485e565f03b62eb7088ec7a23d00cd0b615cd1e74fff71a4a7059d8770e15d26f67d8e78d21f7ded8cdb4f3fc89a33d8dda25713bfb381c0aa8ceb3257186a

Download Submit
C:\Users\Admin\AppData\Local\Temp\D9CC.exe

Filesize
265KB

MD5
a25c8bcd78bfffff86e911122d610ff5

SHA1
a262560b7b021156a27f2f298d48e5dcb08d9506

SHA256
739c8d45ca4059f0b591bd553bdab486519b663fb092ad11868a8c6c3d9ec022

SHA512
fd485e565f03b62eb7088ec7a23d00cd0b615cd1e74fff71a4a7059d8770e15d26f67d8e78d21f7ded8cdb4f3fc89a33d8dda25713bfb381c0aa8ceb3257186a

Download Submit
C:\Users\Admin\AppData\Local\Temp\E594.exe

Filesize
6.3MB

MD5
202b4a418a695f5fa029892e02af8ae7

SHA1
39488ec88202904e324e75acc25712262e2d9905

SHA256
521e1daebb7e7a0ad94d160e1f3f10157b87c8c744c9b2c6a5f4d1b16c5e665f

SHA512
f7ea1890c90ebd5ec652b56376a5bee8bc9ce29ff08fbb9d423d1704a05861cc8fe25d28cceaa4da0b04c426db8aca73228a4ba6ea5a9fe4179f1104abbabafc

Download Submit
C:\Users\Admin\AppData\Local\Temp\E594.exe

Filesize
6.3MB

MD5
202b4a418a695f5fa029892e02af8ae7

SHA1
39488ec88202904e324e75acc25712262e2d9905

SHA256
521e1daebb7e7a0ad94d160e1f3f10157b87c8c744c9b2c6a5f4d1b16c5e665f

SHA512
f7ea1890c90ebd5ec652b56376a5bee8bc9ce29ff08fbb9d423d1704a05861cc8fe25d28cceaa4da0b04c426db8aca73228a4ba6ea5a9fe4179f1104abbabafc

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
116B

MD5
ec6aae2bb7d8781226ea61adca8f0586

SHA1
d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3

SHA256
b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599

SHA512
aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ki3achdc.rtb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
416KB

MD5
41484c18078fdced5621a0d209d91911

SHA1
6cd4ef47e7f9408a18a590d86401f4c3769e2d79

SHA256
ce6ddf38ddc57698642bc07efc9088f66f1a6fcb421851fe668b84e7f1169726

SHA512
1864f62303606663c9e396e1c9395c52f35e5b94d34795560233dfb6a786b1228b7b46a736fc6781bfc15ff34e71ed084a60aefa1a57857bdbdc484bed058449

Download Submit
C:\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
416KB

MD5
41484c18078fdced5621a0d209d91911

SHA1
6cd4ef47e7f9408a18a590d86401f4c3769e2d79

SHA256
ce6ddf38ddc57698642bc07efc9088f66f1a6fcb421851fe668b84e7f1169726

SHA512
1864f62303606663c9e396e1c9395c52f35e5b94d34795560233dfb6a786b1228b7b46a736fc6781bfc15ff34e71ed084a60aefa1a57857bdbdc484bed058449

Download Submit
C:\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
416KB

MD5
41484c18078fdced5621a0d209d91911

SHA1
6cd4ef47e7f9408a18a590d86401f4c3769e2d79

SHA256
ce6ddf38ddc57698642bc07efc9088f66f1a6fcb421851fe668b84e7f1169726

SHA512
1864f62303606663c9e396e1c9395c52f35e5b94d34795560233dfb6a786b1228b7b46a736fc6781bfc15ff34e71ed084a60aefa1a57857bdbdc484bed058449

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1HKD2.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1HKD2.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1HKD2.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GDR0L.tmp\is-5VUUM.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GDR0L.tmp\is-5VUUM.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
265KB

MD5
7a63d490060ac081e1008c78fb0135fa

SHA1
81bda021cd9254cf786cf16aedc3b805ef10326f

SHA256
9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f

SHA512
602ef6907cc4b0b2aa16f7d4b5b5ff14c5434ea2a50854ae0fc4583eba77bb043089fb47c8963f0e9b296ee1481f4f32caa69ab48890156ed08e3b50eac11349

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
265KB

MD5
7a63d490060ac081e1008c78fb0135fa

SHA1
81bda021cd9254cf786cf16aedc3b805ef10326f

SHA256
9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f

SHA512
602ef6907cc4b0b2aa16f7d4b5b5ff14c5434ea2a50854ae0fc4583eba77bb043089fb47c8963f0e9b296ee1481f4f32caa69ab48890156ed08e3b50eac11349

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
265KB

MD5
7a63d490060ac081e1008c78fb0135fa

SHA1
81bda021cd9254cf786cf16aedc3b805ef10326f

SHA256
9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f

SHA512
602ef6907cc4b0b2aa16f7d4b5b5ff14c5434ea2a50854ae0fc4583eba77bb043089fb47c8963f0e9b296ee1481f4f32caa69ab48890156ed08e3b50eac11349

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
265KB

MD5
7a63d490060ac081e1008c78fb0135fa

SHA1
81bda021cd9254cf786cf16aedc3b805ef10326f

SHA256
9c63b33c936df8c3cca5b1e3665b3f0c1b36a1c1ca826a8bc80551610413b74f

SHA512
602ef6907cc4b0b2aa16f7d4b5b5ff14c5434ea2a50854ae0fc4583eba77bb043089fb47c8963f0e9b296ee1481f4f32caa69ab48890156ed08e3b50eac11349

Download Submit
C:\Users\Admin\AppData\Roaming\dagubar

Filesize
265KB

MD5
a25c8bcd78bfffff86e911122d610ff5

SHA1
a262560b7b021156a27f2f298d48e5dcb08d9506

SHA256
739c8d45ca4059f0b591bd553bdab486519b663fb092ad11868a8c6c3d9ec022

SHA512
fd485e565f03b62eb7088ec7a23d00cd0b615cd1e74fff71a4a7059d8770e15d26f67d8e78d21f7ded8cdb4f3fc89a33d8dda25713bfb381c0aa8ceb3257186a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
b0327e8ba338b5ba56c4f55e24ef0724

SHA1
716b5e69e766697e6c42dcf9b4705113e18c5a12

SHA256
ba9fef4ed5989ab6a32de91aad129002a2161b696bcb37c16c1fbfbaaa05f1b0

SHA512
f2a725fb09aa75672a7926d4c77323f08037c8c8054b65bcf3e1476f94f5d4095aa016c1f2dc8cf693e8f4e4bdb4426fac50f60cec70b998a72a40c18ed9a59d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
a27e48b4b5e318eb6b31dcc87a14f530

SHA1
d3068977d49549493307fb0eba4bf3f580116249

SHA256
64771c59f78b7b85e77491dd83f8205d7725860524fdb6b631f6a04d954fa680

SHA512
0ea7fbfdcb4b5151c5a63963308d560c21b001bf074b9369de55e14255d295a81c769beaedbf6ec983649d125bb6896f6953bd900ceb07d6b77b61576da341b6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
aab5454fdd622b61906f94a3451d3a1d

SHA1
50881fef38a633171fd721da269d6a59690d79d1

SHA256
d1d5fadd9db6b850cb1ca95ef9992cde7b52b071dcc1dbc0f913f9b3af24fabc

SHA512
97d1465ff00df97ecc80c8ee0dcc5575031c4d2e2a0d4c12896976c35b5613ad6b33edc9b537e7cb2e92de83938abb787891e7b135546d040cd40c8df4c39501

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
09f4f5b1fa444e369114bc2dc3b87675

SHA1
f1a2e94d49fc374d0d57e1cca209de98cb168c18

SHA256
2245f10740c7db5f89b3a3d90f2b724ef4b5dd341ade10a1991f0873271dfadd

SHA512
3bdb3b025abfe998b1d08e02ad76eed85a86983f2bdaefd8edddaeb3e54bf1d8779f0c30307cc8ffb57e8e484b82454eea42fbfbd408d16d9f69aa38f341067e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f54d30291ab76f8848f1d4d9fc2d60c1

SHA1
098d54d6317f0744328df030e22cbc90d04dd5f9

SHA256
4582552352e9273ec492a557af2a54433eeb860777695b9ffc5aaaa27b93addc

SHA512
50d98af06187de953f19332e0e3c542857270cbbe95d4e1697bdd01dc98341aaf9c1a037eb7ff402019ea2d7a80374b94c1a15c835bd8f16b22be7489fa95898

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
f2a6bcee6c6bb311325b1b41b5363622

SHA1
587c5b9e0d6a6f50607e461667a09806e5866745

SHA256
ae3d87edb3a831555bac3684482ac5f4f1d794b75d00809250ea8d4937e65e8a

SHA512
9e7802dd50798bfb50553396fa9a45cf0ad16ca5937a33eeb731b4b9744dc0c0b837166675bf4a169c2fe1bc1ac5883b4791b4f2ac7dea4e42e43de77d053e5b

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
f2a6bcee6c6bb311325b1b41b5363622

SHA1
587c5b9e0d6a6f50607e461667a09806e5866745

SHA256
ae3d87edb3a831555bac3684482ac5f4f1d794b75d00809250ea8d4937e65e8a

SHA512
9e7802dd50798bfb50553396fa9a45cf0ad16ca5937a33eeb731b4b9744dc0c0b837166675bf4a169c2fe1bc1ac5883b4791b4f2ac7dea4e42e43de77d053e5b

Download Submit
memory/852-17-0x0000000000A40000-0x0000000000AD6000-memory.dmp

Filesize
600KB

Download
memory/852-20-0x0000000002550000-0x000000000266B000-memory.dmp

Filesize
1.1MB

Download
memory/1572-150-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1572-63-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1572-75-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1572-67-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1572-65-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1732-195-0x00000000007B0000-0x00000000007B9000-memory.dmp

Filesize
36KB

Download
memory/1732-201-0x00000000007F8000-0x000000000080B000-memory.dmp

Filesize
76KB

Download
memory/1980-60-0x0000000002420000-0x00000000024B4000-memory.dmp

Filesize
592KB

Download
memory/1980-61-0x00000000024C0000-0x00000000025DB000-memory.dmp

Filesize
1.1MB

Download
memory/2020-193-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2020-199-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2020-189-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2208-194-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-204-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2224-181-0x00000000008F0000-0x0000000000989000-memory.dmp

Filesize
612KB

Download
memory/2924-143-0x0000000002D50000-0x0000000002D56000-memory.dmp

Filesize
24KB

Download
memory/2924-165-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/2924-149-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/2924-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3168-229-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3216-78-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-98-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-128-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-123-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-125-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-120-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-116-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-131-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-94-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-115-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-100-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-130-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-4-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3216-82-0x00000000090B0000-0x00000000090B2000-memory.dmp

Filesize
8KB

Download
memory/3216-162-0x00000000027C0000-0x00000000027D6000-memory.dmp

Filesize
88KB

Download
memory/3216-126-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-102-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-105-0x00000000027C0000-0x00000000027C3000-memory.dmp

Filesize
12KB

Download
memory/3216-89-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-210-0x00000000088F0000-0x0000000008906000-memory.dmp

Filesize
88KB

Download
memory/3216-122-0x00000000027D0000-0x00000000027DC000-memory.dmp

Filesize
48KB

Download
memory/3216-74-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-106-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-92-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3216-95-0x0000000008C80000-0x0000000008C90000-memory.dmp

Filesize
64KB

Download
memory/3380-200-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/3380-185-0x0000000000C60000-0x0000000000DD4000-memory.dmp

Filesize
1.5MB

Download
memory/3464-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3464-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3464-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3464-21-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3464-97-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3624-205-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/3624-69-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3624-186-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/3624-66-0x0000000005140000-0x000000000524A000-memory.dmp

Filesize
1.0MB

Download
memory/3624-50-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download
memory/3624-68-0x0000000005250000-0x0000000005262000-memory.dmp

Filesize
72KB

Download
memory/3624-52-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/3624-37-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3624-38-0x00000000005E0000-0x0000000000610000-memory.dmp

Filesize
192KB

Download
memory/3624-141-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/4152-196-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/4152-118-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/4152-117-0x0000000000E90000-0x00000000014DA000-memory.dmp

Filesize
6.3MB

Download
memory/4296-224-0x0000000002A90000-0x0000000002B93000-memory.dmp

Filesize
1.0MB

Download
memory/4296-73-0x0000000010000000-0x000000001015E000-memory.dmp

Filesize
1.4MB

Download
memory/4296-77-0x0000000000C90000-0x0000000000C96000-memory.dmp

Filesize
24KB

Download
memory/4296-291-0x0000000002BA0000-0x0000000002C89000-memory.dmp

Filesize
932KB

Download
memory/4308-2-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4308-3-0x0000000002460000-0x0000000002469000-memory.dmp

Filesize
36KB

Download
memory/4308-5-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4308-1-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/4664-209-0x0000000002D80000-0x000000000366B000-memory.dmp

Filesize
8.9MB

Download
memory/4664-290-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4664-206-0x0000000002980000-0x0000000002D7A000-memory.dmp

Filesize
4.0MB

Download
memory/4756-48-0x0000000002470000-0x0000000002476000-memory.dmp

Filesize
24KB

Download
memory/4756-32-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/4756-203-0x0000000005430000-0x00000000054A6000-memory.dmp

Filesize
472KB

Download
memory/4756-207-0x0000000005550000-0x0000000005AF4000-memory.dmp

Filesize
5.6MB

Download
memory/4756-79-0x0000000004AB0000-0x0000000004AFC000-memory.dmp

Filesize
304KB

Download
memory/4756-45-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/4756-132-0x0000000073CB0000-0x0000000074460000-memory.dmp

Filesize
7.7MB

Download
memory/4756-208-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/4756-34-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4756-62-0x0000000004C60000-0x0000000005278000-memory.dmp

Filesize
6.1MB

Download
memory/4756-71-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4756-72-0x00000000025C0000-0x00000000025FC000-memory.dmp

Filesize
240KB

Download
memory/4756-192-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4992-101-0x0000000000840000-0x0000000000849000-memory.dmp

Filesize
36KB

Download
memory/4992-103-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4992-177-0x0000000000400000-0x0000000000711000-memory.dmp

Filesize
3.1MB

Download
memory/4992-99-0x0000000000890000-0x0000000000990000-memory.dmp

Filesize
1024KB

Download
memory/5024-152-0x00007FF67E300000-0x00007FF67E36A000-memory.dmp

Filesize
424KB

Download