dcrat | ac9fcf3216053bfe19fd248a87d53f7e84ccb8534a5b72f01f6b2312437ffa05

Analysis

max time kernel
38s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

427KB
MD5

eff23844701b078b57e2e8a50b0be864
SHA1

3a112f4d66d9600ca83e06fb0f5534680c1dbea0
SHA256

ac9fcf3216053bfe19fd248a87d53f7e84ccb8534a5b72f01f6b2312437ffa05
SHA512

125ef0f3d146212614ec696dda59257f3490a95b81417b5dad589f9c312ea8fcb5ec38af4a8b6b9de02dcd83826ba66a9d1020072ab3a3f87e5083a866392b1b
SSDEEP

6144:Kfy+bnr+Yp0yN90QEQulq82bzAWUTeeH9tK12yeRl8BJxADSBJ78C5wL:dMrAy90quFq0rTrH9Ff8BJJyL

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

redline

Botnet

luska

77.91.124.55:19071

Attributes

auth_value
a6797888f51a88afbfd8854a79ac9357

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

fabookie

http://app.nnnaajjjgc.com/check/safe

Signatures

DcRat 4 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		6132	schtasks.exe
		1668	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""		file.exe
		6052	schtasks.exe

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral2/memory/5324-525-0x0000000002CA0000-0x0000000002DD1000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 11 IoCs

resource	yara_rule
behavioral2/memory/5544-350-0x0000000004A80000-0x000000000536B000-memory.dmp	family_glupteba
behavioral2/memory/5544-382-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral2/memory/5544-409-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral2/memory/5544-539-0x0000000004A80000-0x000000000536B000-memory.dmp	family_glupteba
behavioral2/memory/5544-555-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral2/memory/5544-580-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral2/memory/5544-682-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral2/memory/5544-731-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral2/memory/5080-742-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral2/memory/5080-782-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral2/memory/5080-801-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/memory/5648-233-0x00000000007F0000-0x000000000084A000-memory.dmp	family_redline
behavioral2/files/0x00070000000230a2-275.dat	family_redline
behavioral2/files/0x00070000000230a2-276.dat	family_redline
behavioral2/memory/2136-277-0x0000000000D60000-0x0000000000DBA000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/556-784-0x00007FF7E9540000-0x00007FF7E9D80000-memory.dmp	xmrig
behavioral2/memory/556-802-0x00007FF7E9540000-0x00007FF7E9D80000-memory.dmp	xmrig

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
5956	netsh.exe

Executes dropped EXE 14 IoCs

pid	Process
4900	v4952770.exe
3588	a1326238.exe
3260	b8216858.exe
1216	c3744547.exe
1008	DA9C.exe
4536	DBD5.exe
3944	x9185365.exe
1272	x3490328.exe
1860	x9179884.exe
4316	x1354664.exe
3564	g0286977.exe
5084	DF90.exe
2984	h6714614.exe
5648	AC8.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	x1354664.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v4952770.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DA9C.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9185365.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x3490328.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x9179884.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 3876	3588	a1326238.exe	88
PID 3260 set thread context of 4292	3260	b8216858.exe	97
PID 4536 set thread context of 3336	4536	DBD5.exe	124
PID 3564 set thread context of 224	3564	g0286977.exe	171
PID 5084 set thread context of 4900	5084	DF90.exe	130

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2884	3588	WerFault.exe	84
3228	3260	WerFault.exe	93
208	4292	WerFault.exe	97
1532	4536	WerFault.exe	112
3076	3564	WerFault.exe	123
1284	224	WerFault.exe	127
3340	5084	WerFault.exe	121
5816	5648	WerFault.exe	153

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1668	schtasks.exe
6132	schtasks.exe
6052	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3876	AppLaunch.exe
3876	AppLaunch.exe
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found
536	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
536	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3876	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found
Token: SeShutdownPrivilege	536	Process not Found
Token: SeCreatePagefilePrivilege	536	Process not Found

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 4900	364	file.exe	83
PID 364 wrote to memory of 4900	364	file.exe	83
PID 364 wrote to memory of 4900	364	file.exe	83
PID 4900 wrote to memory of 3588	4900	v4952770.exe	84
PID 4900 wrote to memory of 3588	4900	v4952770.exe	84
PID 4900 wrote to memory of 3588	4900	v4952770.exe	84
PID 3588 wrote to memory of 3876	3588	a1326238.exe	88
PID 3588 wrote to memory of 3876	3588	a1326238.exe	88
PID 3588 wrote to memory of 3876	3588	a1326238.exe	88
PID 3588 wrote to memory of 3876	3588	a1326238.exe	88
PID 3588 wrote to memory of 3876	3588	a1326238.exe	88
PID 3588 wrote to memory of 3876	3588	a1326238.exe	88
PID 4900 wrote to memory of 3260	4900	v4952770.exe	93
PID 4900 wrote to memory of 3260	4900	v4952770.exe	93
PID 4900 wrote to memory of 3260	4900	v4952770.exe	93
PID 3260 wrote to memory of 4408	3260	b8216858.exe	95
PID 3260 wrote to memory of 4408	3260	b8216858.exe	95
PID 3260 wrote to memory of 4408	3260	b8216858.exe	95
PID 3260 wrote to memory of 2340	3260	b8216858.exe	96
PID 3260 wrote to memory of 2340	3260	b8216858.exe	96
PID 3260 wrote to memory of 2340	3260	b8216858.exe	96
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 3260 wrote to memory of 4292	3260	b8216858.exe	97
PID 364 wrote to memory of 1216	364	file.exe	102
PID 364 wrote to memory of 1216	364	file.exe	102
PID 364 wrote to memory of 1216	364	file.exe	102
PID 536 wrote to memory of 1008	536	Process not Found	111
PID 536 wrote to memory of 1008	536	Process not Found	111
PID 536 wrote to memory of 1008	536	Process not Found	111
PID 536 wrote to memory of 4536	536	Process not Found	112
PID 536 wrote to memory of 4536	536	Process not Found	112
PID 536 wrote to memory of 4536	536	Process not Found	112
PID 1008 wrote to memory of 3944	1008	DA9C.exe	114
PID 1008 wrote to memory of 3944	1008	DA9C.exe	114
PID 1008 wrote to memory of 3944	1008	DA9C.exe	114
PID 3944 wrote to memory of 1272	3944	x9185365.exe	115
PID 3944 wrote to memory of 1272	3944	x9185365.exe	115
PID 3944 wrote to memory of 1272	3944	x9185365.exe	115
PID 1272 wrote to memory of 1860	1272	x3490328.exe	116
PID 1272 wrote to memory of 1860	1272	x3490328.exe	116
PID 1272 wrote to memory of 1860	1272	x3490328.exe	116
PID 536 wrote to memory of 2492	536	Process not Found	117
PID 536 wrote to memory of 2492	536	Process not Found	117
PID 1860 wrote to memory of 4316	1860	x9179884.exe	119
PID 1860 wrote to memory of 4316	1860	x9179884.exe	119
PID 1860 wrote to memory of 4316	1860	x9179884.exe	119
PID 4316 wrote to memory of 3564	4316	x1354664.exe	123
PID 4316 wrote to memory of 3564	4316	x1354664.exe	123
PID 4316 wrote to memory of 3564	4316	x1354664.exe	123
PID 536 wrote to memory of 5084	536	Process not Found	121
PID 536 wrote to memory of 5084	536	Process not Found	121
PID 536 wrote to memory of 5084	536	Process not Found	121
PID 4536 wrote to memory of 3336	4536	DBD5.exe	124
PID 4536 wrote to memory of 3336	4536	DBD5.exe	124
PID 4536 wrote to memory of 3336	4536	DBD5.exe	124
PID 4536 wrote to memory of 3336	4536	DBD5.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4952770.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4952770.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1326238.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1326238.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 588
      4⤵
      Program crash
      PID:2884
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8216858.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8216858.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4408
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2340
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 540
        5⤵
        Program crash
        
        PID:208
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 600
      4⤵
      Program crash
      PID:3228
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3744547.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3744547.exe
  2⤵
  - Executes dropped EXE
  PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3588 -ip 3588
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3260 -ip 3260
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4292 -ip 4292
1⤵
PID:500

C:\Users\Admin\AppData\Local\Temp\DA9C.exe
C:\Users\Admin\AppData\Local\Temp\DA9C.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9185365.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9185365.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3490328.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3490328.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9179884.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9179884.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x1354664.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x1354664.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g0286977.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g0286977.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3564
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 540
        8⤵
        Program crash
        
        PID:1284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 600
        7⤵
        Program crash
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h6714614.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h6714614.exe
        6⤵
        Executes dropped EXE
        
        PID:2984

C:\Users\Admin\AppData\Local\Temp\DBD5.exe
C:\Users\Admin\AppData\Local\Temp\DBD5.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 152
  2⤵
  - Program crash
  PID:1532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DD0F.bat" "
1⤵
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x98,0x9c,0x124,0x94,0x128,0x7fff694446f8,0x7fff69444708,0x7fff69444718
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16840440246405734031,4420274762828430327,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,16840440246405734031,4420274762828430327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff694446f8,0x7fff69444708,0x7fff69444718
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15853659015157630818,745489720054023154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:2244

C:\Users\Admin\AppData\Local\Temp\DF90.exe
C:\Users\Admin\AppData\Local\Temp\DF90.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 272
  2⤵
  - Program crash
  PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4536 -ip 4536
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3564 -ip 3564
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 224 -ip 224
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5084 -ip 5084
1⤵
PID:4284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5316

C:\Users\Admin\AppData\Local\Temp\AC8.exe
C:\Users\Admin\AppData\Local\Temp\AC8.exe
1⤵
- Executes dropped EXE
PID:5648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 792
  2⤵
  - Program crash
  PID:5816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5648 -ip 5648
1⤵
PID:5764

C:\Users\Admin\AppData\Local\Temp\212F.exe
C:\Users\Admin\AppData\Local\Temp\212F.exe
1⤵
PID:6108
- C:\Users\Admin\AppData\Local\Temp\ss41.exe
  "C:\Users\Admin\AppData\Local\Temp\ss41.exe"
  2⤵
  PID:5324
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  PID:5492
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    PID:2188
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  PID:5544
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:5340
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    PID:5080
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:940
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:5956
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:6028
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1328
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:6012
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5712
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        DcRat
        Creates scheduled task(s)
        
        PID:1668
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:3096
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5900
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:4856
- C:\Users\Admin\AppData\Local\Temp\kos1.exe
  "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
  2⤵
  PID:5616
- - C:\Users\Admin\AppData\Local\Temp\set16.exe
    "C:\Users\Admin\AppData\Local\Temp\set16.exe"
    3⤵
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\is-U0AIH.tmp\is-KBNIR.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-U0AIH.tmp\is-KBNIR.tmp" /SL4 $90118 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
      4⤵
      PID:224
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 8
        5⤵
        
        PID:5732
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 8
        6⤵
        
        PID:5628
    - - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
        5⤵
        
        PID:4940
    - - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
        5⤵
        
        PID:6020
- - C:\Users\Admin\AppData\Local\Temp\kos.exe
    "C:\Users\Admin\AppData\Local\Temp\kos.exe"
    3⤵
    PID:6004

C:\Users\Admin\AppData\Local\Temp\240F.exe
C:\Users\Admin\AppData\Local\Temp\240F.exe
1⤵
PID:2136

C:\Users\Admin\AppData\Local\Temp\47D4.exe
C:\Users\Admin\AppData\Local\Temp\47D4.exe
1⤵
PID:776

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:5804

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:5652
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:5460
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:2916
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:1060
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3228

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml"
1⤵
- DcRat
- Creates scheduled task(s)
PID:6132

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:180

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
PID:1416

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:5208
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:3348
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:4476
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:2856
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4492

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml"
1⤵
- DcRat
- Creates scheduled task(s)
PID:6052

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
451fddf78747a5a4ebf64cabb4ac94e7

SHA1
6925bd970418494447d800e213bfd85368ac8dc9

SHA256
64d12f59d409aa1b03f0b2924e0b2419b65c231de9e04fce15cc3a76e1b9894d

SHA512
edb85a2a94c207815360820731d55f6b4710161551c74008df0c2ae10596e1886c8a9e11d43ddf121878ae35ac9f06fc66b4c325b01ed4e7bf4d3841b27e0864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
b9058cb0a2bb08ce7e9c31c66a62d7a9

SHA1
227ea6a2fff5ff4da64c63a2cb166e7769ba9d6d

SHA256
957c01832695f0f6a8c308c35eb1e74b72959f7ca0f50f10f560a9a970183c1f

SHA512
96f7029c630bf71124cef82372e0fd12f67ad7ada312e8cb2f9265e618a5573adc8005779c66753b71d84ac804d7eecc3a66ecfdbc4000a292244c9fcf9ee253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
627B

MD5
f5e5f303154bc882669519ded6dfec50

SHA1
163b0e3f955b71c386a31f3a82d2b1b49eac6178

SHA256
3e3e04fced8e6b5c95c6c9942fab259f0eda8d3c7dd8ad8320688ddc489c60ca

SHA512
d6e1be75739897df6d6544dbfc1235a968ffe8467a33a35f61acbbfc0aca1718ed7842612237b1977209e9906ecdfc59306ce0eccf1c262d68cc0bc31264bfd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2877bef5d7300bdd319c69ad0190b1c

SHA1
50ffc6efda42c4085650fc212295d595c9cb9e9f

SHA256
5138d2c7edac74cf9b346adb12248e4d0f382ebe4e92456eb9d5e0a528ce7a26

SHA512
7d0b1eae253a8ef4c27d663025855efda4853516d18c15e5d950ec1f653af2147f4130dbaa6df86a753965ccc634e14fcfef0a05ea64dbebed47703590555598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a65ec4667c18e13fb317fff6f342f16a

SHA1
8d138ffa16c3a5a830f475bc7d81d6d832819bbb

SHA256
a4a4583c9fa7a2516a7d3c333f646656eaf7e00ed9aa56dd30ebfbb379830e15

SHA512
a0e90c3e41d801a150d867812d891232b90eafde8d2f0e653688821fd5c0f157d53c4eabd67126f942c2d4d0df14f8de5459d0930cd3a5a93d8da50021602b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
563ddf92a9b5fa872346e0d9395ee625

SHA1
4933b308615a7b558f570a22bd82b16b4bd1de7e

SHA256
af1a3f9ff966005697f6120dbd57afcc16650b58a760dee13d95826ff2e1663e

SHA512
99871e8977b238b07d4f3443257568ec227afea2af4e329e467319bde5e2605ba435e03e858aafaa28bde92e8c0f1e92effd47e563f184de649864c7b03dbb57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
862B

MD5
5dc7427218c569a074f309d61500c0a2

SHA1
2ecb0d703bd988c619b31db5fdfa3ed0c6cea254

SHA256
e4baf4f019cace137b827e6b3c8035645b9920e89dec1fd1a6590a370256e941

SHA512
131ae04f660c7dcb6aa6536dd8413313356fdcdcc3e587d5398089a171bda7c60e794b6ef623c50dbfcd26434f21c03fd316145cf8018144c7b12a7b4de48158

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
862B

MD5
41ec71d0451c053a2fce6531dddd6cdc

SHA1
909e3fa799b76b268c359a6b3b218468b81359e5

SHA256
69832581f91dfa406059cd3397a5cc44e227af9a0c79987f606ef1766b62670d

SHA512
c334814f85242f6db927e7b0263d463fb3dd03a4ad6bc719a97467f2e2a49addaf9a87b5dad9f82628584e6d02523bf70d5df3a191e5afc0832489b4d39365aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe597d35.TMP

Filesize
862B

MD5
c4a060ce7c997e283b651b0e699233c3

SHA1
a1d8978bae08b884f4349d108c0422ba18e6f789

SHA256
fee00c5cb23613c214236a5633dd1a1b3089d91208fd0900e20aab432fe8453d

SHA512
ff2694913069b71856fe373c114dafaeaa87e6a54bf2a613c62d46fb310f5fa99514a489f93dbb7294066ac01b657ed25eb870eeeaeb5e0dda3b0c95408ca494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f6850b286eef080bf1522687a75a3604

SHA1
858ff40f294b30d9ac07c6e8fe2654498b083947

SHA256
2612c7290a23899fd1123b04d208a42d6e49af4809cbbabfcd3f2e53f0012c29

SHA512
53eeece50945aab487a93d3e855f7f909e40c930669b6cdc86176777aacdd649bcd1ec734dc4672374bed818031d567afd4d9673d69fe05a945c5cfe51aef4e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bb11719a4d0f50e4ae0d91375522a64f

SHA1
d3254f62c803918aa2cc89feb092b18c228b4c57

SHA256
69c829f001a902735754b73b743ad27e38c0e204f149a060ef768261aa18db01

SHA512
defae5ccedc0e7455145552ff01cb36080ed391dec8b708c8b03ed22f4ceb2a58da5ec28143759a3b4db4fc071eb8ad6b67485c1021c199394dea633433cc2c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
6c734f1f0f75959e713bbe4237cd5f14

SHA1
5c2862bc1221534e272023fb7dfbae0b64cb3d98

SHA256
156c6c4c393dc89775e40bcbf5066bdee36f567d426e971024dcc4569a7b5a0c

SHA512
afe863c6de40709ee2d7752a73a92f9546e217cc6053f151200db5f0ffbfa4a53d87a1ad621997973f998784cf5df0aa8c92a14dbf469314770ad45ca70ed8dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
6c734f1f0f75959e713bbe4237cd5f14

SHA1
5c2862bc1221534e272023fb7dfbae0b64cb3d98

SHA256
156c6c4c393dc89775e40bcbf5066bdee36f567d426e971024dcc4569a7b5a0c

SHA512
afe863c6de40709ee2d7752a73a92f9546e217cc6053f151200db5f0ffbfa4a53d87a1ad621997973f998784cf5df0aa8c92a14dbf469314770ad45ca70ed8dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\212F.exe

Filesize
6.4MB

MD5
3c81534d635fbe4bfab2861d98422f70

SHA1
9cc995fa42313cd82eacaad9e3fe818cd3805f58

SHA256
88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f

SHA512
132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

Download Submit
C:\Users\Admin\AppData\Local\Temp\212F.exe

Filesize
6.4MB

MD5
3c81534d635fbe4bfab2861d98422f70

SHA1
9cc995fa42313cd82eacaad9e3fe818cd3805f58

SHA256
88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f

SHA512
132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

Download Submit
C:\Users\Admin\AppData\Local\Temp\240F.exe

Filesize
341KB

MD5
53df0c8b56120e03e1657e366720ecd9

SHA1
a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d

SHA256
bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff

SHA512
b940864beb7a9d300173e98e343a7d21bef9b3aa48f3d198816b8e9909463f35354312ffb699893e27ef312504d1ddcad9288792ec2492086d3716d217c1011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\240F.exe

Filesize
341KB

MD5
53df0c8b56120e03e1657e366720ecd9

SHA1
a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d

SHA256
bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff

SHA512
b940864beb7a9d300173e98e343a7d21bef9b3aa48f3d198816b8e9909463f35354312ffb699893e27ef312504d1ddcad9288792ec2492086d3716d217c1011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\AC8.exe

Filesize
407KB

MD5
ab42dd45f0015269d23c14792397617f

SHA1
0d6a95083466527b58b87fcfa2ba182758c534b3

SHA256
53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f

SHA512
67d76904b2015d2368b272a0c974f712b8840b26aed555b52443a96387b0f95df5ed8523e732261f7ac8916c27a1ce1c3d3e0abc9e0b501efcf83193e91b37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AC8.exe

Filesize
407KB

MD5
ab42dd45f0015269d23c14792397617f

SHA1
0d6a95083466527b58b87fcfa2ba182758c534b3

SHA256
53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f

SHA512
67d76904b2015d2368b272a0c974f712b8840b26aed555b52443a96387b0f95df5ed8523e732261f7ac8916c27a1ce1c3d3e0abc9e0b501efcf83193e91b37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AC8.exe

Filesize
407KB

MD5
ab42dd45f0015269d23c14792397617f

SHA1
0d6a95083466527b58b87fcfa2ba182758c534b3

SHA256
53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f

SHA512
67d76904b2015d2368b272a0c974f712b8840b26aed555b52443a96387b0f95df5ed8523e732261f7ac8916c27a1ce1c3d3e0abc9e0b501efcf83193e91b37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AC8.exe

Filesize
407KB

MD5
ab42dd45f0015269d23c14792397617f

SHA1
0d6a95083466527b58b87fcfa2ba182758c534b3

SHA256
53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f

SHA512
67d76904b2015d2368b272a0c974f712b8840b26aed555b52443a96387b0f95df5ed8523e732261f7ac8916c27a1ce1c3d3e0abc9e0b501efcf83193e91b37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA9C.exe

Filesize
1.0MB

MD5
26a94d3fea2244861be8140c6acb2b49

SHA1
de730504e44110a9f1923b858cd5ee2a3cd72cd2

SHA256
c9695798ea1e94e39d82b6624fec3f9aea38086b109de06a7e4bd3411e998fa9

SHA512
7b5515a581cfed0afbd99eef41315a82e0494a814dc16f989e1d14a65288d1c67c3f4a7d9892e68f499b8f6b6782b9da72a38887724fe744b532ff93854e1d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA9C.exe

Filesize
1.0MB

MD5
26a94d3fea2244861be8140c6acb2b49

SHA1
de730504e44110a9f1923b858cd5ee2a3cd72cd2

SHA256
c9695798ea1e94e39d82b6624fec3f9aea38086b109de06a7e4bd3411e998fa9

SHA512
7b5515a581cfed0afbd99eef41315a82e0494a814dc16f989e1d14a65288d1c67c3f4a7d9892e68f499b8f6b6782b9da72a38887724fe744b532ff93854e1d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\DBD5.exe

Filesize
276KB

MD5
8fcdd768668c750919704d83e48dc905

SHA1
5c346c0070b1916f34817ef6d70df45be7f6d72e

SHA256
943331c244cbbdccb54759760a2520be456ea2847878d5a61b6c1c239e758f06

SHA512
336dd28205785c3c57e9f70b598b2d1736f27906ffc88edf77b93dd20abf2f722e4d64cde67c0711702d61d7fbcda687569b6f95375e68bcd6c4a58675366563

Download Submit
C:\Users\Admin\AppData\Local\Temp\DBD5.exe

Filesize
276KB

MD5
8fcdd768668c750919704d83e48dc905

SHA1
5c346c0070b1916f34817ef6d70df45be7f6d72e

SHA256
943331c244cbbdccb54759760a2520be456ea2847878d5a61b6c1c239e758f06

SHA512
336dd28205785c3c57e9f70b598b2d1736f27906ffc88edf77b93dd20abf2f722e4d64cde67c0711702d61d7fbcda687569b6f95375e68bcd6c4a58675366563

Download Submit
C:\Users\Admin\AppData\Local\Temp\DD0F.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF90.exe

Filesize
310KB

MD5
da21b103cbfa0cffc6beab2abcb5be8a

SHA1
a7f250d84b21f61d7b0f6c01e4986aff4a648a40

SHA256
7c3a088040cbd7895bc654dcc40cd0055758ac2e613d170afe04a547528fdc7b

SHA512
b4f02701f6ab3d3b84c68773f220b1089702c2e88ca17a1ec2e355706e41be88d363ac1e0fd9296eff239a4d2e710115ec8aff8c562b8512006ec176aa673b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF90.exe

Filesize
310KB

MD5
da21b103cbfa0cffc6beab2abcb5be8a

SHA1
a7f250d84b21f61d7b0f6c01e4986aff4a648a40

SHA256
7c3a088040cbd7895bc654dcc40cd0055758ac2e613d170afe04a547528fdc7b

SHA512
b4f02701f6ab3d3b84c68773f220b1089702c2e88ca17a1ec2e355706e41be88d363ac1e0fd9296eff239a4d2e710115ec8aff8c562b8512006ec176aa673b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3744547.exe

Filesize
23KB

MD5
76bd95317b6cd2dd823639e4cd227d58

SHA1
1d5983e1c1da64dc373656fb1f48b99f293c829e

SHA256
cc78675026048df50bfa940e10756802f7805baa061e6cfc55ce3ca3ab20a11b

SHA512
da759b4886c9edeb86ae4983306befcce940a6604ebda5c80538fe4f11be59034d97c2f08aa432f54008c709415c0d5cc9b865cb09a2cf216e5c761c6973ebda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c3744547.exe

Filesize
23KB

MD5
76bd95317b6cd2dd823639e4cd227d58

SHA1
1d5983e1c1da64dc373656fb1f48b99f293c829e

SHA256
cc78675026048df50bfa940e10756802f7805baa061e6cfc55ce3ca3ab20a11b

SHA512
da759b4886c9edeb86ae4983306befcce940a6604ebda5c80538fe4f11be59034d97c2f08aa432f54008c709415c0d5cc9b865cb09a2cf216e5c761c6973ebda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l9044239.exe

Filesize
23KB

MD5
50178a2b40e66313967b8d47ffe5d9e1

SHA1
5550b23a1065edc5d315130a51094b0f53861a1e

SHA256
72da442c94b7140717b8dd25afbd61b769646f83d38cd7ddaedcbaee5e1dccc5

SHA512
aacda177cd8cd1e0ead3571dc19e53474431fae6366ecdafa4de8fcddf37b4a6a5fa2f9312309580d39adf253a45bda40af3602fbaad9a62fc87909d3acdc35a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4952770.exe

Filesize
325KB

MD5
9c5f6b6f7d55921ce52c8145e9d0a3b6

SHA1
ec1bb8da4c4b833616dcd9175247ab2c4290bb31

SHA256
a477c7e234f8d3318fc741bd31e738d1c90ef335b88aeed9dd18b8769ff69659

SHA512
37161767ede7f531e4d7be978e2af48a68267f13d2acde819e63df9a34e02bba18b5e02069912758d1b5b932cb29dd8c617efc4ede74ee00f495b475a3c29d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4952770.exe

Filesize
325KB

MD5
9c5f6b6f7d55921ce52c8145e9d0a3b6

SHA1
ec1bb8da4c4b833616dcd9175247ab2c4290bb31

SHA256
a477c7e234f8d3318fc741bd31e738d1c90ef335b88aeed9dd18b8769ff69659

SHA512
37161767ede7f531e4d7be978e2af48a68267f13d2acde819e63df9a34e02bba18b5e02069912758d1b5b932cb29dd8c617efc4ede74ee00f495b475a3c29d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9185365.exe

Filesize
931KB

MD5
48b1727650d180d5d2bfc51ea90108e4

SHA1
ad447f7fa768d276b2c5ee37574e93b8594778a3

SHA256
0d7b047cfcada969198aea6162c434d48cbacffec0e6bb06e2f9763275de053f

SHA512
8bc0dddd28bb7dcb45db83cdfa576a99e7cad70f1bc8f409e6b0f5480750b5b1a272a93b08e88581a2495e2e6924c5018110fc2bc1c6149cfe289bf905d46ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9185365.exe

Filesize
931KB

MD5
48b1727650d180d5d2bfc51ea90108e4

SHA1
ad447f7fa768d276b2c5ee37574e93b8594778a3

SHA256
0d7b047cfcada969198aea6162c434d48cbacffec0e6bb06e2f9763275de053f

SHA512
8bc0dddd28bb7dcb45db83cdfa576a99e7cad70f1bc8f409e6b0f5480750b5b1a272a93b08e88581a2495e2e6924c5018110fc2bc1c6149cfe289bf905d46ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1326238.exe

Filesize
166KB

MD5
db287dc09c43495a2bde4f74ed080b49

SHA1
0a13fba4d387566a270027aa4510834d2089804d

SHA256
894629cee13f03cb0253031c238a4389bd6902202d1412656a1c1f0ee8f5b33c

SHA512
e0b4e8ec08b6032381fd97ecbb7f214c66e25bb507d326741659e734d55f3f7960545782b957a9d405a0ec257826beb004f4572d797d72508af40770517f95bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a1326238.exe

Filesize
166KB

MD5
db287dc09c43495a2bde4f74ed080b49

SHA1
0a13fba4d387566a270027aa4510834d2089804d

SHA256
894629cee13f03cb0253031c238a4389bd6902202d1412656a1c1f0ee8f5b33c

SHA512
e0b4e8ec08b6032381fd97ecbb7f214c66e25bb507d326741659e734d55f3f7960545782b957a9d405a0ec257826beb004f4572d797d72508af40770517f95bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8216858.exe

Filesize
276KB

MD5
3b08f4571e930aa67dacbaace0edae29

SHA1
b89f86a739b26542f2ccf794a93e29a565131b40

SHA256
d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3

SHA512
5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8216858.exe

Filesize
276KB

MD5
3b08f4571e930aa67dacbaace0edae29

SHA1
b89f86a739b26542f2ccf794a93e29a565131b40

SHA256
d0f163dfe61ad4f478cf43d5efc6c086c23618f60bd581a5214a61133aba53e3

SHA512
5988b5420d62724d7abeec2f0024dc6f9287c1302180ac89a97370efa81829ce59b5779ce2bfb1a34b8b481ee262ae58b7a4749c5f9a84d97d9147c1974510fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3490328.exe

Filesize
748KB

MD5
fc728d6abd04be5401735385b82706b6

SHA1
a5a74781b9a768ef30fa1ba7b890f6049da51352

SHA256
ab2eadf977f954413b51fa720a749cce15d84aca42ff12b674e7a1599f014cf1

SHA512
69007ea0c967734e6995c0dfcdbb0ddbd59cf91518cb61e492af3380f6c9863e51983e994ca589755e76634b7885bdb395236213685108a4240c22b76e8166b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3490328.exe

Filesize
748KB

MD5
fc728d6abd04be5401735385b82706b6

SHA1
a5a74781b9a768ef30fa1ba7b890f6049da51352

SHA256
ab2eadf977f954413b51fa720a749cce15d84aca42ff12b674e7a1599f014cf1

SHA512
69007ea0c967734e6995c0dfcdbb0ddbd59cf91518cb61e492af3380f6c9863e51983e994ca589755e76634b7885bdb395236213685108a4240c22b76e8166b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9179884.exe

Filesize
516KB

MD5
3559853a0486dfc73dddbacbdd7d168d

SHA1
192df594266e7782acbfed0a51e7720a3f48a237

SHA256
3d2f43acbd43a31276d831a5f12aa6c89c353673bb044c8d4f6c8db0399f4ed6

SHA512
b7c5efc5db4cf3ff85d58e5bc055980f24a4c0646ce8ee2be3fa1a07ae4397e48bd91758566d751075cbdbb16cb6e826e4a599f042337571a57e26feb2bc11c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9179884.exe

Filesize
516KB

MD5
3559853a0486dfc73dddbacbdd7d168d

SHA1
192df594266e7782acbfed0a51e7720a3f48a237

SHA256
3d2f43acbd43a31276d831a5f12aa6c89c353673bb044c8d4f6c8db0399f4ed6

SHA512
b7c5efc5db4cf3ff85d58e5bc055980f24a4c0646ce8ee2be3fa1a07ae4397e48bd91758566d751075cbdbb16cb6e826e4a599f042337571a57e26feb2bc11c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x1354664.exe

Filesize
350KB

MD5
b86a7ec2d00b6390007a92ce3e6e2fdf

SHA1
f204601ad9af77f5f89e583465cfa208315b1fb6

SHA256
b79cb93c8cc1b40b43cdbbed584d00cb8966a9892bb506f820dafe6b05a33c6f

SHA512
58e29caa58fa3b6cd4e3f9e22449ed67288ce7c936eefac9ea2498b909b8f858616caf197769c86daca64d82c76ebc2f7ba86a9fba45628ee57daf8f5db179b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x1354664.exe

Filesize
350KB

MD5
b86a7ec2d00b6390007a92ce3e6e2fdf

SHA1
f204601ad9af77f5f89e583465cfa208315b1fb6

SHA256
b79cb93c8cc1b40b43cdbbed584d00cb8966a9892bb506f820dafe6b05a33c6f

SHA512
58e29caa58fa3b6cd4e3f9e22449ed67288ce7c936eefac9ea2498b909b8f858616caf197769c86daca64d82c76ebc2f7ba86a9fba45628ee57daf8f5db179b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g0286977.exe

Filesize
276KB

MD5
36e2da51b07559373a2086a3782677f2

SHA1
df3d784f80514b0f2a21e1ea3c811c582303eba1

SHA256
d6c56fac3d2b69bad7589bb1b4d2ecc790e918c0cf0733065ed8c20160c53f5d

SHA512
5cd2dca321c4b672603350844c4ea4f67507b8db42fe65936f466a94944c95a49c53cf68e50573abd8fe295a86031513df1759ee80889e31c59b77f595bbb11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g0286977.exe

Filesize
276KB

MD5
36e2da51b07559373a2086a3782677f2

SHA1
df3d784f80514b0f2a21e1ea3c811c582303eba1

SHA256
d6c56fac3d2b69bad7589bb1b4d2ecc790e918c0cf0733065ed8c20160c53f5d

SHA512
5cd2dca321c4b672603350844c4ea4f67507b8db42fe65936f466a94944c95a49c53cf68e50573abd8fe295a86031513df1759ee80889e31c59b77f595bbb11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h6714614.exe

Filesize
174KB

MD5
8a254dba7ac8103464b5642c5b2bdd9c

SHA1
29bdc6ab822c75aaffe20c3644a70f8fc081418f

SHA256
bdf260d568714e782801fb8a97161c7e91b1bfb6a4d3545d0ef7bbe3a130c10c

SHA512
82deec349e2f6b30a2e9828979072bb13445b7bd017d7e67eb3c6b0fe0efdc1cda3393491c1d2828f3aa9a1febf0addbabe8f767925f7335299432dc2f9975a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h6714614.exe

Filesize
174KB

MD5
8a254dba7ac8103464b5642c5b2bdd9c

SHA1
29bdc6ab822c75aaffe20c3644a70f8fc081418f

SHA256
bdf260d568714e782801fb8a97161c7e91b1bfb6a4d3545d0ef7bbe3a130c10c

SHA512
82deec349e2f6b30a2e9828979072bb13445b7bd017d7e67eb3c6b0fe0efdc1cda3393491c1d2828f3aa9a1febf0addbabe8f767925f7335299432dc2f9975a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
116B

MD5
ec6aae2bb7d8781226ea61adca8f0586

SHA1
d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3

SHA256
b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599

SHA512
aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_meuk1mjp.efo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-U0AIH.tmp\is-KBNIR.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
memory/224-454-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/224-402-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/224-91-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/224-92-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/224-94-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/536-410-0x00000000033C0000-0x00000000033D6000-memory.dmp

Filesize
88KB

Download
memory/536-16-0x0000000008930000-0x0000000008946000-memory.dmp

Filesize
88KB

Download
memory/556-759-0x0000000000750000-0x0000000000770000-memory.dmp

Filesize
128KB

Download
memory/556-784-0x00007FF7E9540000-0x00007FF7E9D80000-memory.dmp

Filesize
8.2MB

Download
memory/556-802-0x00007FF7E9540000-0x00007FF7E9D80000-memory.dmp

Filesize
8.2MB

Download
memory/776-654-0x00007FF79C000000-0x00007FF79C530000-memory.dmp

Filesize
5.2MB

Download
memory/776-457-0x00007FF79C000000-0x00007FF79C530000-memory.dmp

Filesize
5.2MB

Download
memory/1416-760-0x00007FF74D920000-0x00007FF74DE50000-memory.dmp

Filesize
5.2MB

Download
memory/1416-720-0x00007FF74D920000-0x00007FF74DE50000-memory.dmp

Filesize
5.2MB

Download
memory/2136-428-0x0000000007D10000-0x0000000007D20000-memory.dmp

Filesize
64KB

Download
memory/2136-282-0x0000000007B30000-0x0000000007BC2000-memory.dmp

Filesize
584KB

Download
memory/2136-278-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/2136-277-0x0000000000D60000-0x0000000000DBA000-memory.dmp

Filesize
360KB

Download
memory/2136-400-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/2136-286-0x0000000007CE0000-0x0000000007CEA000-memory.dmp

Filesize
40KB

Download
memory/2136-352-0x0000000008720000-0x0000000008786000-memory.dmp

Filesize
408KB

Download
memory/2136-285-0x0000000007D10000-0x0000000007D20000-memory.dmp

Filesize
64KB

Download
memory/2136-279-0x0000000007FF0000-0x0000000008594000-memory.dmp

Filesize
5.6MB

Download
memory/2188-412-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2188-331-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2188-336-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-104-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/2984-124-0x0000000005A80000-0x0000000006098000-memory.dmp

Filesize
6.1MB

Download
memory/2984-161-0x0000000005460000-0x00000000054AC000-memory.dmp

Filesize
304KB

Download
memory/2984-140-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/2984-239-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-103-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-146-0x00000000053E0000-0x000000000541C000-memory.dmp

Filesize
240KB

Download
memory/2984-131-0x0000000005570000-0x000000000567A000-memory.dmp

Filesize
1.0MB

Download
memory/2984-253-0x0000000005450000-0x0000000005460000-memory.dmp

Filesize
64KB

Download
memory/2984-102-0x0000000000A00000-0x0000000000A30000-memory.dmp

Filesize
192KB

Download
memory/3276-401-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3276-357-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3336-96-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3336-88-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3336-87-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3336-89-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3876-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3876-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3876-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4292-27-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4292-25-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4292-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4292-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4900-138-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/4900-235-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4900-95-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4900-97-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4900-98-0x0000000007350000-0x0000000007356000-memory.dmp

Filesize
24KB

Download
memory/4900-137-0x0000000005050000-0x0000000005062000-memory.dmp

Filesize
72KB

Download
memory/4940-453-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/4940-449-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/4940-450-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5080-742-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5080-801-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5080-782-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5324-298-0x00007FF788D80000-0x00007FF788DEA000-memory.dmp

Filesize
424KB

Download
memory/5324-525-0x0000000002CA0000-0x0000000002DD1000-memory.dmp

Filesize
1.2MB

Download
memory/5324-487-0x0000000002B20000-0x0000000002C91000-memory.dmp

Filesize
1.4MB

Download
memory/5340-618-0x00000000056E0000-0x0000000005702000-memory.dmp

Filesize
136KB

Download
memory/5340-611-0x0000000005000000-0x0000000005036000-memory.dmp

Filesize
216KB

Download
memory/5340-613-0x0000000005780000-0x0000000005DA8000-memory.dmp

Filesize
6.2MB

Download
memory/5340-614-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/5340-612-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/5340-615-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/5492-327-0x0000000002630000-0x0000000002639000-memory.dmp

Filesize
36KB

Download
memory/5492-325-0x00000000027E0000-0x00000000028E0000-memory.dmp

Filesize
1024KB

Download
memory/5544-555-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5544-382-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5544-342-0x0000000004670000-0x0000000004A73000-memory.dmp

Filesize
4.0MB

Download
memory/5544-539-0x0000000004A80000-0x000000000536B000-memory.dmp

Filesize
8.9MB

Download
memory/5544-350-0x0000000004A80000-0x000000000536B000-memory.dmp

Filesize
8.9MB

Download
memory/5544-472-0x0000000004670000-0x0000000004A73000-memory.dmp

Filesize
4.0MB

Download
memory/5544-580-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5544-731-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5544-409-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5544-682-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/5616-335-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/5616-381-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/5616-326-0x0000000000F00000-0x0000000001074000-memory.dmp

Filesize
1.5MB

Download
memory/5648-237-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/5648-378-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/5648-328-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/5648-370-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/5648-233-0x00000000007F0000-0x000000000084A000-memory.dmp

Filesize
360KB

Download
memory/5648-246-0x0000000073600000-0x0000000073DB0000-memory.dmp

Filesize
7.7MB

Download
memory/6004-376-0x0000000000010000-0x0000000000018000-memory.dmp

Filesize
32KB

Download
memory/6004-399-0x000000001ABF0000-0x000000001AC00000-memory.dmp

Filesize
64KB

Download
memory/6004-616-0x000000001ABF0000-0x000000001AC00000-memory.dmp

Filesize
64KB

Download
memory/6004-556-0x00007FFF64FD0000-0x00007FFF65A91000-memory.dmp

Filesize
10.8MB

Download
memory/6004-398-0x00007FFF64FD0000-0x00007FFF65A91000-memory.dmp

Filesize
10.8MB

Download
memory/6020-461-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/6020-764-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/6020-787-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/6020-535-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/6020-719-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download