ammyyadmin | a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115

Analysis

max time kernel
158s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2023 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
Size

3.4MB
MD5

8b6693a9fd8f3a9ca63e933c7e1284bc
SHA1

94fe1a59213d6cb266e5e6b8761b9b7a45512e1f
SHA256

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115
SHA512

882ffd091cae2a658cb5b992a3c3c8e06519bedcee1ed629b4d933bfbea2e32531e04519ca76f450a4a014bf851360cb56d72c7bd2c13907c308b26fa0a0a2e9
SSDEEP

49152:Q5qWhABbYQFw/3MywBAfm079cyxuc5BhBKiJ+av9kgzr0dt1cOZaX:ZWhEywBgm0OQ5BhkivHr0bps

Score

10^/10

ammyyadmin phobos rhadamanthys smokeloader backdoor bootkit collection discovery evasion persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://servermlogs27.xyz/statweb255/

http://servmblog45.xyz/statweb255/

http://demblog575.xyz/statweb255/

http://admlogs85x.xyz/statweb255/

http://blogmstat389.xyz/statweb255/

http://blogmstat255.xyz/statweb255/

rc4.i32

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe	family_ammyyadmin
C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe	family_ammyyadmin

Detect rhadamanthys stealer shellcode 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1804-17-0x0000000002B50000-0x0000000002F50000-memory.dmp	family_rhadamanthys
behavioral2/memory/1804-18-0x0000000002B50000-0x0000000002F50000-memory.dmp	family_rhadamanthys
behavioral2/memory/1804-19-0x0000000002B50000-0x0000000002F50000-memory.dmp	family_rhadamanthys
behavioral2/memory/1804-20-0x0000000002B50000-0x0000000002F50000-memory.dmp	family_rhadamanthys
behavioral2/memory/1804-30-0x0000000002B50000-0x0000000002F50000-memory.dmp	family_rhadamanthys
behavioral2/memory/1804-31-0x0000000002B50000-0x0000000002F50000-memory.dmp	family_rhadamanthys
behavioral2/memory/1804-33-0x0000000002B50000-0x0000000002F50000-memory.dmp	family_rhadamanthys

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe

description pid process target process

PID 1804 created 3132 1804 a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe Explorer.EXE
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

4548 bcdedit.exe
4860 bcdedit.exe
Renames multiple (365) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

2784 wbadmin.exe
Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2244 netsh.exe
2652 netsh.exe

description	pid	process	target process
PID 1804 created 3132	1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	Explorer.EXE

pid	process
4548	bcdedit.exe
4860	bcdedit.exe

pid	process
2784	wbadmin.exe

pid	process
2244	netsh.exe
2652	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

j59MJfrX.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	j59MJfrX.exe

Deletes itself 1 IoCs

Processes:

certreq.exe

pid process

3096 certreq.exe
Drops startup file 1 IoCs

Processes:

B0CD.exe

description ioc process

File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\B0CD.exe B0CD.exe
Executes dropped EXE 9 IoCs

Processes:

j59MJfrX.exe6vT.exe6vT.exe6Ob4T.exeB0CD.exeB0CD.exeB0CD.exeB0CD.exesvchost.exe

pid process

4140 j59MJfrX.exe
4880 6vT.exe
4364 6vT.exe
3040 6Ob4T.exe
2172 B0CD.exe
4324 B0CD.exe
3688 B0CD.exe
1328 B0CD.exe
2540 svchost.exe
Loads dropped DLL 2 IoCs

Processes:

j59MJfrX.exe

pid process

4140 j59MJfrX.exe
4140 j59MJfrX.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3096	certreq.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\B0CD.exe	B0CD.exe

pid	process
4140	j59MJfrX.exe
4880	6vT.exe
4364	6vT.exe
3040	6Ob4T.exe
2172	B0CD.exe
4324	B0CD.exe
3688	B0CD.exe
1328	B0CD.exe
2540	svchost.exe

pid	process
4140	j59MJfrX.exe
4140	j59MJfrX.exe

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

Processes:

certreq.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	certreq.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

B0CD.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B0CD = "C:\\Users\\Admin\\AppData\\Local\\B0CD.exe"	B0CD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\B0CD = "C:\\Users\\Admin\\AppData\\Local\\B0CD.exe"	B0CD.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 4 IoCs

Processes:

B0CD.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3811856890-180006922-3689258494-1000\desktop.ini	B0CD.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3811856890-180006922-3689258494-1000\desktop.ini	B0CD.exe
File opened for modification	C:\Program Files\desktop.ini	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	B0CD.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

svchost.exe

description ioc process

File opened for modification \??\PhysicalDrive0 svchost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe6vT.exeB0CD.exeB0CD.exe

description	pid	process	target process
PID 1360 set thread context of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 4880 set thread context of 4364	4880	6vT.exe	6vT.exe
PID 2172 set thread context of 4324	2172	B0CD.exe	B0CD.exe
PID 3688 set thread context of 1328	3688	B0CD.exe	B0CD.exe

Drops file in Program Files directory 64 IoCs

Processes:

B0CD.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png	B0CD.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll	B0CD.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\BuildInfo.xml	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms	B0CD.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Reflection.DispatchProxy.dll	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36_altform-unplated.png	B0CD.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties	B0CD.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OSFPROXY.DLL.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-125.png	B0CD.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png	B0CD.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_MouseNose.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\tab_mru_darktheme.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-20.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-30.png	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms	B0CD.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.scale-200.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxManifest.xml	B0CD.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-125.png	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso20win32client.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_SplashScreen.scale-200.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-200_contrast-white.png	B0CD.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\WISC30.DLL	B0CD.exe
File created	C:\Program Files\Mozilla Firefox\vcruntime140.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png	B0CD.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_contrast-black.png	B0CD.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\RunningLate.scale-64.png	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\WideTile.scale-200.png	B0CD.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\2.jpg	B0CD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.contrast-black_scale-100.png	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms	B0CD.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.id[D15C46D2-3483].[[email protected]].8base	B0CD.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll	B0CD.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll	B0CD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1060 4140 WerFault.exe j59MJfrX.exe

pid	pid_target	process	target process
1060	4140	WerFault.exe	j59MJfrX.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6vT.exevds.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6vT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6vT.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6vT.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

certreq.exej59MJfrX.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	certreq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	j59MJfrX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	j59MJfrX.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	certreq.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2836 timeout.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2840 vssadmin.exe

pid	process
2836	timeout.exe

pid	process
2840	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exea75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.execertreq.exej59MJfrX.exe6vT.exeExplorer.EXE

pid	process
1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
3096	certreq.exe
3096	certreq.exe
3096	certreq.exe
3096	certreq.exe
4140	j59MJfrX.exe
4140	j59MJfrX.exe
4364	6vT.exe
4364	6vT.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3132 Explorer.EXE

pid	process
3132	Explorer.EXE

Suspicious behavior: MapViewOfSection 33 IoCs

Processes:

6vT.exeExplorer.EXEexplorer.exe

pid	process
4364	6vT.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3584	explorer.exe
3584	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe6vT.exeExplorer.EXEB0CD.exeB0CD.exeB0CD.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
Token: SeDebugPrivilege	4880	6vT.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	2172	B0CD.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	3688	B0CD.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	4324	B0CD.exe
Token: SeBackupPrivilege	464	vssvc.exe
Token: SeRestorePrivilege	464	vssvc.exe
Token: SeAuditPrivilege	464	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3828	WMIC.exe
Token: SeSecurityPrivilege	3828	WMIC.exe
Token: SeTakeOwnershipPrivilege	3828	WMIC.exe
Token: SeLoadDriverPrivilege	3828	WMIC.exe
Token: SeSystemProfilePrivilege	3828	WMIC.exe
Token: SeSystemtimePrivilege	3828	WMIC.exe
Token: SeProfSingleProcessPrivilege	3828	WMIC.exe
Token: SeIncBasePriorityPrivilege	3828	WMIC.exe
Token: SeCreatePagefilePrivilege	3828	WMIC.exe
Token: SeBackupPrivilege	3828	WMIC.exe
Token: SeRestorePrivilege	3828	WMIC.exe
Token: SeShutdownPrivilege	3828	WMIC.exe
Token: SeDebugPrivilege	3828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3828	WMIC.exe
Token: SeRemoteShutdownPrivilege	3828	WMIC.exe
Token: SeUndockPrivilege	3828	WMIC.exe
Token: SeManageVolumePrivilege	3828	WMIC.exe
Token: 33	3828	WMIC.exe
Token: 34	3828	WMIC.exe
Token: 35	3828	WMIC.exe
Token: 36	3828	WMIC.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	3828	WMIC.exe
Token: SeSecurityPrivilege	3828	WMIC.exe
Token: SeTakeOwnershipPrivilege	3828	WMIC.exe
Token: SeLoadDriverPrivilege	3828	WMIC.exe
Token: SeSystemProfilePrivilege	3828	WMIC.exe
Token: SeSystemtimePrivilege	3828	WMIC.exe
Token: SeProfSingleProcessPrivilege	3828	WMIC.exe
Token: SeIncBasePriorityPrivilege	3828	WMIC.exe
Token: SeCreatePagefilePrivilege	3828	WMIC.exe
Token: SeBackupPrivilege	3828	WMIC.exe
Token: SeRestorePrivilege	3828	WMIC.exe
Token: SeShutdownPrivilege	3828	WMIC.exe
Token: SeDebugPrivilege	3828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3828	WMIC.exe
Token: SeRemoteShutdownPrivilege	3828	WMIC.exe
Token: SeUndockPrivilege	3828	WMIC.exe
Token: SeManageVolumePrivilege	3828	WMIC.exe
Token: 33	3828	WMIC.exe
Token: 34	3828	WMIC.exe
Token: 35	3828	WMIC.exe
Token: 36	3828	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

svchost.exe

pid process

2540 svchost.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3132 Explorer.EXE

pid	process
2540	svchost.exe

pid	process
3132	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exea75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe6vT.exej59MJfrX.execmd.exeExplorer.EXEB0CD.exeB0CD.exeB0CD.execmd.execmd.exe

description	pid	process	target process
PID 1360 wrote to memory of 2872	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 2872	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 2872	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1360 wrote to memory of 1804	1360	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
PID 1804 wrote to memory of 3096	1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	certreq.exe
PID 1804 wrote to memory of 3096	1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	certreq.exe
PID 1804 wrote to memory of 3096	1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	certreq.exe
PID 1804 wrote to memory of 3096	1804	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe	certreq.exe
PID 4880 wrote to memory of 4364	4880	6vT.exe	6vT.exe
PID 4880 wrote to memory of 4364	4880	6vT.exe	6vT.exe
PID 4880 wrote to memory of 4364	4880	6vT.exe	6vT.exe
PID 4880 wrote to memory of 4364	4880	6vT.exe	6vT.exe
PID 4880 wrote to memory of 4364	4880	6vT.exe	6vT.exe
PID 4880 wrote to memory of 4364	4880	6vT.exe	6vT.exe
PID 4140 wrote to memory of 3556	4140	j59MJfrX.exe	cmd.exe
PID 4140 wrote to memory of 3556	4140	j59MJfrX.exe	cmd.exe
PID 4140 wrote to memory of 3556	4140	j59MJfrX.exe	cmd.exe
PID 3556 wrote to memory of 2836	3556	cmd.exe	timeout.exe
PID 3556 wrote to memory of 2836	3556	cmd.exe	timeout.exe
PID 3556 wrote to memory of 2836	3556	cmd.exe	timeout.exe
PID 3132 wrote to memory of 2172	3132	Explorer.EXE	B0CD.exe
PID 3132 wrote to memory of 2172	3132	Explorer.EXE	B0CD.exe
PID 3132 wrote to memory of 2172	3132	Explorer.EXE	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 2172 wrote to memory of 4324	2172	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 3688 wrote to memory of 1328	3688	B0CD.exe	B0CD.exe
PID 4324 wrote to memory of 1592	4324	B0CD.exe	cmd.exe
PID 4324 wrote to memory of 1592	4324	B0CD.exe	cmd.exe
PID 4324 wrote to memory of 4836	4324	B0CD.exe	cmd.exe
PID 4324 wrote to memory of 4836	4324	B0CD.exe	cmd.exe
PID 1592 wrote to memory of 2840	1592	cmd.exe	vssadmin.exe
PID 1592 wrote to memory of 2840	1592	cmd.exe	vssadmin.exe
PID 4836 wrote to memory of 2652	4836	cmd.exe	netsh.exe
PID 4836 wrote to memory of 2652	4836	cmd.exe	netsh.exe
PID 4836 wrote to memory of 2244	4836	cmd.exe	netsh.exe
PID 4836 wrote to memory of 2244	4836	cmd.exe	netsh.exe
PID 1592 wrote to memory of 3828	1592	cmd.exe	WMIC.exe
PID 1592 wrote to memory of 3828	1592	cmd.exe	WMIC.exe
PID 1592 wrote to memory of 4548	1592	cmd.exe	bcdedit.exe
PID 1592 wrote to memory of 4548	1592	cmd.exe	bcdedit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3132

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
"C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
3⤵
PID:2872

C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec.exe
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\system32\certreq.exe
"C:\Windows\system32\certreq.exe"
2⤵
- Deletes itself
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3096

C:\Users\Admin\AppData\Local\Temp\B0CD.exe
C:\Users\Admin\AppData\Local\Temp\B0CD.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\B0CD.exe
C:\Users\Admin\AppData\Local\Temp\B0CD.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324

C:\Users\Admin\AppData\Local\Temp\B0CD.exe
"C:\Users\Admin\AppData\Local\Temp\B0CD.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688

C:\Users\Admin\AppData\Local\Temp\B0CD.exe
C:\Users\Admin\AppData\Local\Temp\B0CD.exe
5⤵
- Executes dropped EXE
PID:1328

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
5⤵
- Modifies Windows Firewall
PID:2652

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
5⤵
- Modifies Windows Firewall
PID:2244

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
5⤵
- Interacts with shadow copies
PID:2840

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
5⤵
- Modifies boot configuration data using bcdedit
PID:4548

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
5⤵
- Modifies boot configuration data using bcdedit
PID:4860

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
5⤵
- Deletes backup catalog
PID:2784

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:5048

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:3084

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:4840

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:4508

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:3368

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:4896

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:3772

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:3056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:2244

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1192

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:4040

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:3484

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:4228

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:224

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
- Suspicious behavior: MapViewOfSection
PID:3584

C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe -debug
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
PID:2540

C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe
"C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe" & del "C:\ProgramData\*.dll"" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
3⤵
- Delays execution with timeout.exe
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 2564
2⤵
- Program crash
PID:1060

C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
"C:\Users\Admin\AppData\Local\Microsoft\6vT.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4364

C:\Users\Admin\AppData\Local\Microsoft\6Ob4T.exe
"C:\Users\Admin\AppData\Local\Microsoft\6Ob4T.exe"
1⤵
- Executes dropped EXE
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4140 -ip 4140
1⤵
PID:448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2720

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[D15C46D2-3483].[[email protected]].8base
Filesize
3.2MB

MD5
eb8edb1a6835240fd2268ea346239781

SHA1
98f929ddd52f83c51957965cff9faa1476fbfd5b

SHA256
313178517776024e31913d8f14d6a2f377de2f03093d182559043f9f1fb50bdc

SHA512
e6d4eff06246ed71cb2f682a4a7729825688c754691ccff4290a2b69ca81099b830c87291e27a09fcdb5bcada189171c67d22de1f12576dfa8cec00750fc6952

Download Submit
C:\ProgramData\Are.docx
Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\B0CD.exe
Filesize
2.6MB

MD5
f4d64c9ae825a8b1e0db64c93d37eb2a

SHA1
03d03b2fcafc1fc36b960b6351e951fe40fb0c66

SHA256
c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec

SHA512
5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\6Ob4T.exe
Filesize
968KB

MD5
2a40a56b3dbe361864baac57a7815de4

SHA1
a0b67c7eb5bb378010ada7a3cf6bfe4101df9049

SHA256
3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99

SHA512
6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\6Ob4T.exe
Filesize
968KB

MD5
2a40a56b3dbe361864baac57a7815de4

SHA1
a0b67c7eb5bb378010ada7a3cf6bfe4101df9049

SHA256
3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99

SHA512
6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
Filesize
2.5MB

MD5
a5e52d00a57904485aeb8e6580ce4666

SHA1
8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92

SHA256
13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71

SHA512
f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
Filesize
2.5MB

MD5
a5e52d00a57904485aeb8e6580ce4666

SHA1
8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92

SHA256
13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71

SHA512
f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\6vT.exe
Filesize
2.5MB

MD5
a5e52d00a57904485aeb8e6580ce4666

SHA1
8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92

SHA256
13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71

SHA512
f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B0CD.exe.log
Filesize
1016B

MD5
4353288293ab8929e492327245a7ccb2

SHA1
89b365f2f5e14faaf17715e5764b60d344250d67

SHA256
61954fc5184dd88a959f803ee98ca9af53eb0c942dbb00b98ba4f8a46081b587

SHA512
48c07ca1b769cf02af6ec938aad8b5a03133e82a451bdff5a03bf4ba47cfd7add0ab28ee6622c22fb54e127472a7cf68dd7d05da15ec439cc18aed2ca76cd08a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe
Filesize
284KB

MD5
f445dce24fe09b59d9affb9f0a16ee7e

SHA1
9d2b2ef3e57c7a571c20d078dbac82576cdfcb30

SHA256
7476d2335a1f3cf87f1995a40147d6ee0acaf9cf0c9895a595365942b64be5a3

SHA512
6e721fbfc49a7780b20be1173795f602b3b4ccf9a8ce5625fc38ec15f818943dd7a0e56a75b4cb9719f2255b28d2ec538257f55ea383f2407069e5f93314edb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\j59MJfrX.exe
Filesize
284KB

MD5
f445dce24fe09b59d9affb9f0a16ee7e

SHA1
9d2b2ef3e57c7a571c20d078dbac82576cdfcb30

SHA256
7476d2335a1f3cf87f1995a40147d6ee0acaf9cf0c9895a595365942b64be5a3

SHA512
6e721fbfc49a7780b20be1173795f602b3b4ccf9a8ce5625fc38ec15f818943dd7a0e56a75b4cb9719f2255b28d2ec538257f55ea383f2407069e5f93314edb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\14D9.tmp
Filesize
92KB

MD5
985339a523cfa3862ebc174380d3340c

SHA1
73bf03c8f7bc58b4e28bcbfdd1c2ba52dea5dfb7

SHA256
57c7f10cd97c8db447281ad0f47d4694035056e050b85b81f5a5124f461621a2

SHA512
b5d34c43330f8070b3f353c826a54aecd99b7129a214913a365b66009a1a6744093bf085d3f86681ed40c714d6ebdfff40d99d7bd7a3508a0a0caed6304ac27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\14FB.tmp
Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe
Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\699D.tmp\svchost.exe
Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\B0CD.exe
Filesize
2.6MB

MD5
f4d64c9ae825a8b1e0db64c93d37eb2a

SHA1
03d03b2fcafc1fc36b960b6351e951fe40fb0c66

SHA256
c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec

SHA512
5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\B0CD.exe
Filesize
2.6MB

MD5
f4d64c9ae825a8b1e0db64c93d37eb2a

SHA1
03d03b2fcafc1fc36b960b6351e951fe40fb0c66

SHA256
c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec

SHA512
5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\B0CD.exe
Filesize
2.6MB

MD5
f4d64c9ae825a8b1e0db64c93d37eb2a

SHA1
03d03b2fcafc1fc36b960b6351e951fe40fb0c66

SHA256
c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec

SHA512
5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\B0CD.exe
Filesize
2.6MB

MD5
f4d64c9ae825a8b1e0db64c93d37eb2a

SHA1
03d03b2fcafc1fc36b960b6351e951fe40fb0c66

SHA256
c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec

SHA512
5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\B0CD.exe
Filesize
2.6MB

MD5
f4d64c9ae825a8b1e0db64c93d37eb2a

SHA1
03d03b2fcafc1fc36b960b6351e951fe40fb0c66

SHA256
c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec

SHA512
5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f3zxqty5.default-release\cookies.sqlite.id[D15C46D2-3483].[[email protected]].8base
Filesize
96KB

MD5
5859fb39f856a489fa08d7a5376bfdcb

SHA1
6a4ffa31cdcdd44440a837e8a340dd7467adf710

SHA256
61090e02da87d4bdc9d2813025539b00a879f658c3c23bd4f96e648ce57de8a3

SHA512
30ae5fd1ece9614552f32fe6fed4d6d5adc39ecbd87a5e04d590115a91a7e1b523e72f9a382ceb2179d54115adbb77301a5d9b4e90da5a605cb1d4562994c2f8

Download Submit
memory/1328-205-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1328-1326-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1360-0-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/1360-14-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/1360-1-0x0000000000830000-0x0000000000B92000-memory.dmp

Filesize
3.4MB

Download
memory/1360-2-0x0000000005580000-0x0000000005612000-memory.dmp

Filesize
584KB

Download
memory/1360-3-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/1360-4-0x0000000005620000-0x000000000580E000-memory.dmp

Filesize
1.9MB

Download
memory/1360-5-0x0000000005C80000-0x0000000005D00000-memory.dmp

Filesize
512KB

Download
memory/1360-6-0x0000000005950000-0x00000000059B8000-memory.dmp

Filesize
416KB

Download
memory/1360-7-0x00000000059F0000-0x0000000005A58000-memory.dmp

Filesize
416KB

Download
memory/1360-8-0x0000000005A60000-0x0000000005AAC000-memory.dmp

Filesize
304KB

Download
memory/1360-9-0x00000000062C0000-0x0000000006864000-memory.dmp

Filesize
5.6MB

Download
memory/1804-10-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1804-18-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/1804-17-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/1804-16-0x0000000000EB0000-0x0000000000EB7000-memory.dmp

Filesize
28KB

Download
memory/1804-32-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1804-15-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1804-29-0x0000000003890000-0x00000000038C6000-memory.dmp

Filesize
216KB

Download
memory/1804-20-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/1804-19-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/1804-13-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1804-31-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/1804-30-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/1804-23-0x0000000003890000-0x00000000038C6000-memory.dmp

Filesize
216KB

Download
memory/1804-22-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1804-33-0x0000000002B50000-0x0000000002F50000-memory.dmp

Filesize
4.0MB

Download
memory/2172-187-0x0000000005660000-0x0000000005696000-memory.dmp

Filesize
216KB

Download
memory/2172-182-0x00000000746E0000-0x0000000074E90000-memory.dmp

Filesize
7.7MB

Download
memory/2172-183-0x0000000000550000-0x00000000007EA000-memory.dmp

Filesize
2.6MB

Download
memory/2172-185-0x00000000050E0000-0x0000000005206000-memory.dmp

Filesize
1.1MB

Download
memory/2172-184-0x0000000005030000-0x0000000005040000-memory.dmp

Filesize
64KB

Download
memory/2172-186-0x0000000005610000-0x000000000565E000-memory.dmp

Filesize
312KB

Download
memory/2172-188-0x00000000056D0000-0x0000000005704000-memory.dmp

Filesize
208KB

Download
memory/2172-194-0x00000000746E0000-0x0000000074E90000-memory.dmp

Filesize
7.7MB

Download
memory/3084-3270-0x0000000000510000-0x0000000000517000-memory.dmp

Filesize
28KB

Download
memory/3084-3283-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/3096-36-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-42-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-21-0x000001C0F2B10000-0x000001C0F2B13000-memory.dmp

Filesize
12KB

Download
memory/3096-34-0x000001C0F2B10000-0x000001C0F2B13000-memory.dmp

Filesize
12KB

Download
memory/3096-35-0x000001C0F2CB0000-0x000001C0F2CB7000-memory.dmp

Filesize
28KB

Download
memory/3096-37-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-39-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-38-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-40-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-41-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-44-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-45-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-46-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-47-0x00007FFB7E1F0000-0x00007FFB7E3E5000-memory.dmp

Filesize
2.0MB

Download
memory/3096-168-0x000001C0F2CB0000-0x000001C0F2CB5000-memory.dmp

Filesize
20KB

Download
memory/3096-169-0x00007FFB7E1F0000-0x00007FFB7E3E5000-memory.dmp

Filesize
2.0MB

Download
memory/3096-48-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-49-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-50-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-51-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3096-59-0x00007FFB7E1F0000-0x00007FFB7E3E5000-memory.dmp

Filesize
2.0MB

Download
memory/3096-52-0x00007FF411FA0000-0x00007FF4120CF000-memory.dmp

Filesize
1.2MB

Download
memory/3132-146-0x0000000001090000-0x00000000010A6000-memory.dmp

Filesize
88KB

Download
memory/3688-198-0x00000000746E0000-0x0000000074E90000-memory.dmp

Filesize
7.7MB

Download
memory/3688-204-0x00000000746E0000-0x0000000074E90000-memory.dmp

Filesize
7.7MB

Download
memory/3688-199-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4140-151-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4140-159-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4140-57-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/4140-60-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4140-58-0x0000000000750000-0x000000000076B000-memory.dmp

Filesize
108KB

Download
memory/4140-171-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/4140-126-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/4140-76-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4324-189-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4324-195-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4324-193-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4324-644-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4364-71-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4364-148-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4364-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4508-3524-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/4840-3456-0x00000000014E0000-0x00000000014E4000-memory.dmp

Filesize
16KB

Download
memory/4840-3459-0x00000000014D0000-0x00000000014D9000-memory.dmp

Filesize
36KB

Download
memory/4880-67-0x0000000005400000-0x000000000551A000-memory.dmp

Filesize
1.1MB

Download
memory/4880-69-0x0000000005910000-0x0000000005942000-memory.dmp

Filesize
200KB

Download
memory/4880-70-0x0000000005960000-0x0000000005992000-memory.dmp

Filesize
200KB

Download
memory/4880-68-0x0000000005680000-0x00000000056CA000-memory.dmp

Filesize
296KB

Download
memory/4880-75-0x00000000736F0000-0x0000000073EA0000-memory.dmp

Filesize
7.7MB

Download
memory/4880-66-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/4880-65-0x00000000007D0000-0x0000000000A5E000-memory.dmp

Filesize
2.6MB

Download
memory/4880-64-0x00000000736F0000-0x0000000073EA0000-memory.dmp

Filesize
7.7MB

Download
memory/5048-3142-0x0000000000960000-0x00000000009CB000-memory.dmp

Filesize
428KB

Download
memory/5048-2988-0x0000000000960000-0x00000000009CB000-memory.dmp

Filesize
428KB

Download
memory/5048-2985-0x0000000000C00000-0x0000000000C75000-memory.dmp

Filesize
468KB

Download