dcrat | d2682ee0fe9e5bf429b7bea89d32cf417c3b684429dbff5e060b07e7335aaa76

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

6.3MB
MD5

c67cb967230036816fd0cbbfd96959c6
SHA1

d2fe988a302dce4bc0f34a1003a623f96a06b250
SHA256

d2682ee0fe9e5bf429b7bea89d32cf417c3b684429dbff5e060b07e7335aaa76
SHA512

2f51046e44bdfa470f676071c69da8c05d50d8f79e748748f25ac13ec53d346f1c3988148000fea3ece38623fd629d1b3dcc943006e80b7bee95da7f1f42920c
SSDEEP

196608:GHqO3grg0lAc4G+JCJjsP8BXkf/hmzJzFYngA13jvHKvj4:GHzCOc4G+oB0BmdFY31zq

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detected Djvu ransomware 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3888-435-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3888-440-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3888-439-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3888-452-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1976-463-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1976-461-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1976-460-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4924-43-0x0000000002D90000-0x000000000367B000-memory.dmp	family_glupteba
behavioral2/memory/4924-46-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2900-104-0x0000000002EA0000-0x000000000378B000-memory.dmp	family_glupteba
behavioral2/memory/2900-106-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4924-108-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2900-283-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4916-388-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4916-428-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4916-468-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

F84D.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ F84D.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3720 netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	F84D.exe

pid	process
3720	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

F84D.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	F84D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	F84D.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

tmp.exenst43D1.tmpC506.exeRegAsm.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	nst43D1.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	C506.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Drops startup file 1 IoCs

Processes:

RegAsm.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	RegAsm.exe

Executes dropped EXE 23 IoCs

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exeInstallSetup9.exeRegAsm.exeBroomSetup.exenst43D1.tmpd21cbe21e38b385a41a68c5e6dd32f4c.execsrss.exeinjector.exeA410.exewindefender.exewindefender.exeC506.exeC506.exeC506.exeC506.exeF2ED.exeF84D.exeFEB7.exeFEB7.tmpqtziroutine.exeqtziroutine.exe57E.exeqemu-ga.exe

pid	process
4924	d21cbe21e38b385a41a68c5e6dd32f4c.exe
736	InstallSetup9.exe
1596	RegAsm.exe
700	BroomSetup.exe
868	nst43D1.tmp
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4916	csrss.exe
2492	injector.exe
1980	A410.exe
4200	windefender.exe
4056	windefender.exe
1284	C506.exe
3888	C506.exe
5112	C506.exe
1976	C506.exe
4072	F2ED.exe
3092	F84D.exe
2484	FEB7.exe
4452	FEB7.tmp
5092	qtziroutine.exe
3088	qtziroutine.exe
3748	57E.exe
2724	qemu-ga.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

F84D.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Wine F84D.exe
Loads dropped DLL 8 IoCs

Processes:

InstallSetup9.exenst43D1.tmpFEB7.tmp

pid process

736 InstallSetup9.exe
736 InstallSetup9.exe
868 nst43D1.tmp
868 nst43D1.tmp
736 InstallSetup9.exe
4452 FEB7.tmp
4452 FEB7.tmp
4452 FEB7.tmp
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1448 icacls.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Wine	F84D.exe

pid	process
736	InstallSetup9.exe
736	InstallSetup9.exe
868	nst43D1.tmp
868	nst43D1.tmp
736	InstallSetup9.exe
4452	FEB7.tmp
4452	FEB7.tmp
4452	FEB7.tmp

pid	process
1448	icacls.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx
behavioral2/memory/4200-413-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4056-456-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

C506.exed21cbe21e38b385a41a68c5e6dd32f4c.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\9386f491-0736-4136-a49b-1736a3e32d91\\C506.exe\" --AutoStart"	C506.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

66 api.2ip.ua
67 api.2ip.ua
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

flow	ioc
66	api.2ip.ua
67	api.2ip.ua

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exeConhost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	Conhost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	Conhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

F84D.exe

pid process

3092 F84D.exe

pid	process
3092	F84D.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

C506.exeC506.exe57E.exe

description	pid	process	target process
PID 1284 set thread context of 3888	1284	C506.exe	C506.exe
PID 5112 set thread context of 1976	5112	C506.exe	C506.exe
PID 3748 set thread context of 1596	3748	57E.exe	RegAsm.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN d21cbe21e38b385a41a68c5e6dd32f4c.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Drops file in Windows directory 4 IoCs

Processes:

csrss.exed21cbe21e38b385a41a68c5e6dd32f4c.exe

description	ioc	process
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\rss\csrss.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3432 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3432	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2428	4740	WerFault.exe	powershell.exe
4728	868	WerFault.exe	nst43D1.tmp
3404	1976	WerFault.exe
3440	4072	WerFault.exe	F2ED.exe
2808	4072	WerFault.exe	F2ED.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

A410.exeRegAsm.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A410.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A410.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nst43D1.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nst43D1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nst43D1.tmp

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

3492 schtasks.exe
660 schtasks.exe
2952 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

400 timeout.exe

pid	process
3492	schtasks.exe
660	schtasks.exe
2952	schtasks.exe

pid	process
400	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exewindefender.exed21cbe21e38b385a41a68c5e6dd32f4c.exeConhost.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RegAsm.exepowershell.exed21cbe21e38b385a41a68c5e6dd32f4c.exeConhost.exed21cbe21e38b385a41a68c5e6dd32f4c.exe

pid	process
1596	RegAsm.exe
1596	RegAsm.exe
4740	powershell.exe
4740	powershell.exe
4924	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4924	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3444
3444
4936	Conhost.exe
3444
3444
4936	Conhost.exe
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
3444
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3444
3444
3444
3444
3444
3444
3444
3444

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

RegAsm.exeA410.exe

pid process

1596 RegAsm.exe
1980 A410.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exed21cbe21e38b385a41a68c5e6dd32f4c.exeConhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	4924	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeImpersonatePrivilege	4924	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeDebugPrivilege	4936	Conhost.exe
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeDebugPrivilege	544	powershell.exe
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeSystemEnvironmentPrivilege	4916	csrss.exe
Token: SeSecurityPrivilege	3432	sc.exe
Token: SeSecurityPrivilege	3432	sc.exe
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeDebugPrivilege	1596	RegAsm.exe
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444
Token: SeCreatePagefilePrivilege	3444
Token: SeShutdownPrivilege	3444

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

FEB7.tmp

pid process

4452 FEB7.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BroomSetup.exe

pid process

700 BroomSetup.exe

pid	process
4452	FEB7.tmp

pid	process
700	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.exeInstallSetup9.exeBroomSetup.exed21cbe21e38b385a41a68c5e6dd32f4c.execmd.exed21cbe21e38b385a41a68c5e6dd32f4c.execmd.execsrss.exewindefender.execmd.exenst43D1.tmp

description	pid	process	target process
PID 4060 wrote to memory of 4924	4060	tmp.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 4060 wrote to memory of 4924	4060	tmp.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 4060 wrote to memory of 4924	4060	tmp.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 4060 wrote to memory of 736	4060	tmp.exe	InstallSetup9.exe
PID 4060 wrote to memory of 736	4060	tmp.exe	InstallSetup9.exe
PID 4060 wrote to memory of 736	4060	tmp.exe	InstallSetup9.exe
PID 4060 wrote to memory of 1596	4060	tmp.exe	RegAsm.exe
PID 4060 wrote to memory of 1596	4060	tmp.exe	RegAsm.exe
PID 4060 wrote to memory of 1596	4060	tmp.exe	RegAsm.exe
PID 736 wrote to memory of 700	736	InstallSetup9.exe	BroomSetup.exe
PID 736 wrote to memory of 700	736	InstallSetup9.exe	BroomSetup.exe
PID 736 wrote to memory of 700	736	InstallSetup9.exe	BroomSetup.exe
PID 736 wrote to memory of 868	736	InstallSetup9.exe	nst43D1.tmp
PID 736 wrote to memory of 868	736	InstallSetup9.exe	nst43D1.tmp
PID 736 wrote to memory of 868	736	InstallSetup9.exe	nst43D1.tmp
PID 700 wrote to memory of 2964	700	BroomSetup.exe	cmd.exe
PID 700 wrote to memory of 2964	700	BroomSetup.exe	cmd.exe
PID 700 wrote to memory of 2964	700	BroomSetup.exe	cmd.exe
PID 4924 wrote to memory of 4740	4924	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4924 wrote to memory of 4740	4924	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4924 wrote to memory of 4740	4924	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2964 wrote to memory of 756	2964	cmd.exe	chcp.com
PID 2964 wrote to memory of 756	2964	cmd.exe	chcp.com
PID 2964 wrote to memory of 756	2964	cmd.exe	chcp.com
PID 2964 wrote to memory of 660	2964	cmd.exe	schtasks.exe
PID 2964 wrote to memory of 660	2964	cmd.exe	schtasks.exe
PID 2964 wrote to memory of 660	2964	cmd.exe	schtasks.exe
PID 2900 wrote to memory of 4936	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	Conhost.exe
PID 2900 wrote to memory of 4936	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	Conhost.exe
PID 2900 wrote to memory of 4936	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	Conhost.exe
PID 2900 wrote to memory of 5020	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	cmd.exe
PID 2900 wrote to memory of 5020	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	cmd.exe
PID 5020 wrote to memory of 3720	5020	cmd.exe	netsh.exe
PID 5020 wrote to memory of 3720	5020	cmd.exe	netsh.exe
PID 2900 wrote to memory of 3636	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2900 wrote to memory of 3636	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2900 wrote to memory of 3636	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2900 wrote to memory of 3832	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2900 wrote to memory of 3832	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2900 wrote to memory of 3832	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2900 wrote to memory of 4916	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 2900 wrote to memory of 4916	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 2900 wrote to memory of 4916	2900	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 4916 wrote to memory of 544	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 544	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 544	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 4500	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 4500	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 4500	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 1792	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 1792	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 1792	4916	csrss.exe	powershell.exe
PID 4916 wrote to memory of 2492	4916	csrss.exe	injector.exe
PID 4916 wrote to memory of 2492	4916	csrss.exe	injector.exe
PID 3444 wrote to memory of 1980	3444		A410.exe
PID 3444 wrote to memory of 1980	3444		A410.exe
PID 3444 wrote to memory of 1980	3444		A410.exe
PID 4200 wrote to memory of 2396	4200	windefender.exe	cmd.exe
PID 4200 wrote to memory of 2396	4200	windefender.exe	cmd.exe
PID 4200 wrote to memory of 2396	4200	windefender.exe	cmd.exe
PID 2396 wrote to memory of 3432	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 3432	2396	cmd.exe	sc.exe
PID 2396 wrote to memory of 3432	2396	cmd.exe	sc.exe
PID 868 wrote to memory of 2972	868	nst43D1.tmp	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
  "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 2628
      4⤵
      Program crash
      PID:2428
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:3636
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:3832
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4500
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:4664
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:2952
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        
        PID:2492
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:3492
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
- C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:756
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:660
- - C:\Users\Admin\AppData\Local\Temp\nst43D1.tmp
    C:\Users\Admin\AppData\Local\Temp\nst43D1.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 2520
      4⤵
      Program crash
      PID:4728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nst43D1.tmp" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      PID:2972
- C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
  2⤵
  PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4740 -ip 4740
1⤵
PID:3468

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Users\Admin\AppData\Local\Temp\A410.exe
C:\Users\Admin\AppData\Local\Temp\A410.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1980

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4056

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
1⤵
- Delays execution with timeout.exe
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 868 -ip 868
1⤵
PID:2428

C:\Users\Admin\AppData\Local\Temp\C506.exe
C:\Users\Admin\AppData\Local\Temp\C506.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1284
- C:\Users\Admin\AppData\Local\Temp\C506.exe
  C:\Users\Admin\AppData\Local\Temp\C506.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3888
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\9386f491-0736-4136-a49b-1736a3e32d91" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\C506.exe
    "C:\Users\Admin\AppData\Local\Temp\C506.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\C506.exe
      "C:\Users\Admin\AppData\Local\Temp\C506.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1976 -ip 1976
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 568
1⤵
- Program crash
PID:3404

C:\Users\Admin\AppData\Local\Temp\F2ED.exe
C:\Users\Admin\AppData\Local\Temp\F2ED.exe
1⤵
- Executes dropped EXE
PID:4072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1044
  2⤵
  - Program crash
  PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1064
  2⤵
  - Program crash
  PID:2808

C:\Users\Admin\AppData\Local\Temp\F84D.exe
C:\Users\Admin\AppData\Local\Temp\F84D.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3092

C:\Users\Admin\AppData\Local\Temp\FEB7.exe
C:\Users\Admin\AppData\Local\Temp\FEB7.exe
1⤵
- Executes dropped EXE
PID:2484
- C:\Users\Admin\AppData\Local\Temp\is-HIJPG.tmp\FEB7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HIJPG.tmp\FEB7.tmp" /SL5="$520028,7069030,54272,C:\Users\Admin\AppData\Local\Temp\FEB7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:4452
- - C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe
    "C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe" -i
    3⤵
    - Executes dropped EXE
    PID:5092
- - C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe
    "C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3088

C:\Users\Admin\AppData\Local\Temp\57E.exe
C:\Users\Admin\AppData\Local\Temp\57E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
    3⤵
    - Executes dropped EXE
    PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4072 -ip 4072
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4072 -ip 4072
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
131KB

MD5
3ce681b08967749866443da207350d4d

SHA1
5413620f8dbd4047467ffa73a44fb4fb83f5e7df

SHA256
f239d266a63dd5d7caeaca8848a3bb8bff80d361627686ced9278537b13952a9

SHA512
3b8e05fd3d90a9b6f82b25d0cde7a7b52bc976af513e259f80d3b46cddab9cb880fa6a1bd3fd4c34c02ee4682fe80e0c2f3d7715cd242967d2c98734bad756af

Download Submit
C:\ProgramData\mozglue.dll

Filesize
79KB

MD5
4a2a1ab4e8feb78d17299117b97ac94a

SHA1
ff9f51d6061b51f71fc0340e02772fc67acb1f71

SHA256
5fff9c9ab50e73a7e1caf2ca61d80d566a00c285f260dce45d31f7c56e8969ca

SHA512
e984989fd9514646a384c0686ea77f078881578743ff2e80cd2c69abfce25a6a2e4eda945caa697875fcb10d21dde59ed58b365a81d8f8cd9cc5b58cf93feda9

Download Submit
C:\ProgramData\nss3.dll

Filesize
175KB

MD5
84c84f7bf7b40de33ca45dc357c0f567

SHA1
8a48af91614cd6547ffe5cda486fa4bc3eba9347

SHA256
543959701b4e5b57779679148e5b598b90f359b3aeaf8f9fed9e19a2a361f430

SHA512
858c4035fc538329b68bb584d4b6d8e8d58baa389e0c0ff9c18b5362479e8ae3668599caf275bd5b8a3fb39b9c22fe454528322829124edfc129340fd8febd24

Download Submit
C:\Users\Admin\AppData\Local\9386f491-0736-4136-a49b-1736a3e32d91\C506.exe

Filesize
400KB

MD5
c33b690772be7ff5b6eab8998a731f25

SHA1
791ce1de291cc5b41504390059e3898c0cef158e

SHA256
f282dd6d31b5325b6a25b5bf1c981135498a484976d34f4c062be2fc30cf4778

SHA512
9e8ef51fb898fa5d6a59575eda406bc55ff855cfe5204c4f75e0b119a972260efaf60fca24c03293fa3a402d645264ff1420af2358b813c466b882e1c0bb9cc6

Download Submit
C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe

Filesize
748KB

MD5
a9915341a118f72ada6897e4d0b3b0ad

SHA1
5d7128f39a05234537b4cd544c801acef7943176

SHA256
6adf1ada38fc3dac5670f7ea9d834ad26fd1e58dd9cfd0e4010bd56235e6a0bc

SHA512
e09e526740da51eda7c1b511d5f51a3a062bc43c7a1f507eb5c36b0934f2aef8f39a2a12f66abaa835077e1147c6f98c59b5dbbc69e466e33234d5c62d13372e

Download Submit
C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe

Filesize
914KB

MD5
833e362d0804890dfd3e192dcc80f4cb

SHA1
56dcf26e54f3e305213ef1025bc42fccbbbd2d35

SHA256
9e44cecd72667b41b38d6f698e06ea00cfc06f33c2416dc87ec9f6e20c0c99af

SHA512
5fb86e54e22d3811d833f93c5a3224d7352b9666a04c80dbb69ca78885283d80ae4748c642fe5f0958d71d55e94f3ee4f9981fed7adcfd0df98c894fad7e1f3a

Download Submit
C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe

Filesize
661KB

MD5
42b97ebcb10dd991f654e3f07debfb3e

SHA1
4ab28e1315d3fb6a7c4b51de56d2bffc59c971af

SHA256
76e3122c8b95bdd5ce735bb4e8f93e13421a778ed7320fcb641130f16b1b4e31

SHA512
a3162d7ea7138f0620d1865f3d858e778310f09a387ac31ac44dffc4fe6f2a5215e23197af0e2b42b3d2c9be58e50ad1901044f6121d278f79d6742b199badb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\57E.exe

Filesize
585KB

MD5
455af7b85c5f2f4f7bd03fccc9f38ffe

SHA1
f415c96afd3a66644da6b374ac1dd721d88a472c

SHA256
cb341f04a9d035bac65c5c7538733c06c23a26543dbe64cc6e8a9d9ccd7859e6

SHA512
17f95f98841d72b0eca1ebe51b6a91da86d8d9541721296891a782527e32b52cf374917da40ffb62cf62d49d8a125595967dd7e1e07584e1387116ddd0078d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\A410.exe

Filesize
183KB

MD5
beffaffcc9489c258943fc3df7a5fa3b

SHA1
be37b9f7f4689cacdf885663dde1977a309ed39b

SHA256
df66a2112a34f0696dfc4b1488dce0dd114e7036bb5b3faeffd666570c33a113

SHA512
08b2b472a02fad65358b5ba0bf7075dae423fff5dd756dd1581e7ced8c342fb2abe8d6d8a69f160b7d76e92e486e825a868b1b9de165e1b03f2f4921854618a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

Filesize
4.7MB

MD5
4662c30fa994e62645a29829159daa6a

SHA1
dafe48564ab8723a1f49c98b887f42bd1e0d8b06

SHA256
b9eeff388e165decefa1ffe7016b4c8b346f671c0bc8a2cbdab148ce0f0cadef

SHA512
b034ea52a71eb67ee0affc96b59363989c964d8061e92fa6bbf28832576bd8548d7ac30b829bc9112b1bdbd1a9f3df7726ecb146023e64dade9433f785037365

Download Submit
C:\Users\Admin\AppData\Local\Temp\C506.exe

Filesize
591KB

MD5
65592be32acaa00c0283068f678208ee

SHA1
a78e081bf1e0b48f39b4c5b7d93a290126fc2c4c

SHA256
54e6391bf5772b36023d13e0c63227fef17667212f054500acd285be3f1f8f0e

SHA512
90c6e43d3c1562f162efa9ce6dac46f937d575cab7c1a018bee84e7bf0511e09362b57dc121af65b2cb8b8cd7721a188191cdaa450e5d012b9c5fef98edbaf7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\C506.exe

Filesize
661KB

MD5
ceccc2bbbb2830e59ec49711d552f375

SHA1
f775e4517ab672ab7cfb3038fd3ecc443f080557

SHA256
3ca598e3cbe7380d9c6a30fb0866e8df3c8e3802335bd96656d8bc8e0c3cb8b3

SHA512
0de4c64ab1428e4bd2505e4d4d2945b71a51391b828a637feb3ea737b92cfe5b2a988ace8603c08649fefbcef69c151d55a28494e18f850b5e5b4509194d7163

Download Submit
C:\Users\Admin\AppData\Local\Temp\C506.exe

Filesize
24KB

MD5
8a20be9abc5d22fc7bcc74606ef80062

SHA1
7f875d8b2c1572fb24acab5156250f5d25b6371a

SHA256
9802d55f76b202eddad5571dcbfe0963790667f6e3b3809571e946e18b39b869

SHA512
262f094503a87ff7b54133e7476fab90d2ede35a531ed341f5bc676ad81c0569c81f2166ca4cb2f32c51f54e891638bf006392f5c0d51fd0dac3e027f89b9cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\C506.exe

Filesize
437KB

MD5
440cabdfd8f800e270c59ab8722631ca

SHA1
39b6d086db9ec68427b3e68b437ae0cbacf225a2

SHA256
36634c76470d2d1bbf0f14a9c2b6db3d8344d82cdc54134a9dd2fe591bbcd982

SHA512
98b1aad2b81d8525f2239f27f194589d043df25abe37d3f147d9fba1ca4011d43122f190feb92387726854934742bebd477dbbd40fdb44e8dafb4bb6c9635e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\C506.exe

Filesize
200KB

MD5
708c938c5aef305caf8bffec77809b7b

SHA1
6edcdab2c99d043e954faa4ce90df1b3c884c059

SHA256
b4ea72fb625af4a25a52391d5ea35400254771650b8fa2d73ea42bafc1231d1b

SHA512
e6a592a453051f8f4244f0cee6ade8b28769cdc96c55c3f6e77f14791821e932428999fa5a35ca8c3b1c7c7e76027af44b62c248b3ac4e6d5e994c5b5b08dca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2ED.exe

Filesize
2.2MB

MD5
a756c8f4735f6909903356749a449e29

SHA1
da40d363980e9d9393e75af37e151b6e79b9e155

SHA256
8ad0420fcecd101615053f2d4b1a7fbd7f15b6aad8d81f39d2f0b40fa67e2543

SHA512
ac50231d9945b6bdff7b73cbb00746029f06055946798be028d77306016767e621433b625a8437ecb9084fa85b68df45a27638a099a7afa942f20882ab21897f

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2ED.exe

Filesize
972KB

MD5
6006db41ff1b635ec2e76080f0670009

SHA1
5aba965d5fa12cda3d660c4a5159f1eca822a540

SHA256
3ec0dd4ac7ea07cbceb905b0197f523728ac630848fe7b9b2383fc8ee121e5c9

SHA512
236916ea65bb274e79dff94e24a0abfd54641ce81a7ad0764ac26ce17a60f4b1301f858779dab613899477f3611e8a5e2124d4e595bf4bd553ca4de33197be88

Download Submit
C:\Users\Admin\AppData\Local\Temp\F84D.exe

Filesize
432KB

MD5
1123099fe5af2f31328e7edbe9e74bdb

SHA1
b53e33ed9172127f30d920dc0acb28dd1c4ca36d

SHA256
39848bc36a94bda5544fdff8e0ea9617d3b7d317a159fd43e358ccaaa28f6893

SHA512
880634c187c23844877cad73b5ca9909f1c75903b14f61fb47f4f00097c096df5ce28d3b97362c7d846056fcbef46dd58abb5f1926751cb7351532200786e6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\F84D.exe

Filesize
389KB

MD5
2817adc4567ae5954ff6f97a1ca3a45c

SHA1
fa0b81a588d047d4315e2d1e4316b531d065ec6b

SHA256
580afd55375f225ea5f5925d4170b65581ee85dc226b93c8ce83cfbd7675b26b

SHA512
6b0d2745fe88ff4476bb78e41cb66350c5536811824d5ca61f62fc1e639f7a7d227f9ff4b2034a34839f22f378d7e829eddccbaecb4a5b35808456afe8a8faf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEB7.exe

Filesize
265KB

MD5
cba168154533fbf1012c545548015844

SHA1
ef0ca654e3d65c348c23355d6ba16cdbbc963cb6

SHA256
a9aef370c77444cb25127f3308c70dbb7b6b6263e2dda3292deca67339ffc3d1

SHA512
709dd882d7e19ef2f053dcec6034bacc525f5448bf3888d2b89625d9f4b241329b56533c5bd83425b6f42fee74c62971ab1aa1c82e88b10bbc7a53f213279882

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEB7.exe

Filesize
247KB

MD5
3680182b8b37c63229ff3a98b6005120

SHA1
bf5d7d355f8c06cf45f1f18582d42d4b27e0423f

SHA256
77bf5c60742b9ead48cf96c4c3a73a9e31541b62073bb7e9db828f22f67723cd

SHA512
580aa61661c3802ca11b57c2aa5553cdbe017ba63a9356a69bd8e4adffccfc2f50bbcf69568ea98fdf2b07eb620bce176885839df2141dbeca2888aa041235b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

Filesize
2.0MB

MD5
c7dfcf13b0dc4dd685114a6a2f0233ac

SHA1
ade01a01ce38e49de0136340333aa26f92a6f43f

SHA256
3786f3f45f703b7faa2b971ac1d9cddfa14115b1926a874a294809bf747355dc

SHA512
ff5769daa32508b261d807eaa2a70ff5e942f02b1903523d6cc280ce8c07c0bc58dcc2e555e5d24ddf240570da5f821ba01540904350804dea6eafa7131f9d29

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvgzhsw5.s14.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
247KB

MD5
940c6123e03737d738a4fffa07f836a5

SHA1
ce90b071a4656120216517b13b60c53870db2ce7

SHA256
c908aab09834733132f9a675737d465dc02f109cfd303d0b5b21de10dcffe6dd

SHA512
d7d784276828146d616a47a4ba6662095014d5ea77fe67eb72bca36522c0e282d71cb8b8622f711b1e8d72a331eed2b03d3d090cc927ce57a484a1584e4a301d

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
188KB

MD5
ba71d4c75b41e14f4efa449e97db09b5

SHA1
2ac02a1d91792acd818ff8d9a977cbae35ed14bf

SHA256
d694ff1a5837edeb7998186c58fb0cbf68fa016ba0b93d6470ba7c7037e3b5ea

SHA512
94de20d0f798242e072c410a5bd9393a6f54c7e1bcb4e265a51d3fa591559062b4fb68baf8a4949f1b5a8097c36fb857ce96ac54f6cf2dce550868a32a8bcf64

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
141KB

MD5
e494979f4618bf512b95af9c2291931c

SHA1
0b6abd8d4e48157532de2ccce962a81cb8d2e8bf

SHA256
39cac5b290d953ac251dd67822fe61acffb1e5decf0e0c6094a108c67e7a7479

SHA512
231a7f4e6bae6c5f75e177c0537d2615fea804b4851e85d23590518089e222dd3318899a19b3b14b6ed22449291a9182d979c37556b24164d44fe2c58e9eaa0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
1.9MB

MD5
963219c4879144ff333e92b19215eb74

SHA1
efd4c40e353634f08051c81e85a251b2e68d86b9

SHA256
93af265b7bf5ffcd2d812112d3204373e6c644434836d76e4c7c1d572625573d

SHA512
59551cbb03da6781a9b7632ea3cb3c4c8cb902a49dfb780a4e4af388c0716f7361bdc3ea5baa5a112244dbd4ec3efb9fab6a78debbb2240d4e04fffb3239eae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
2.1MB

MD5
624018778e4ce5f5add602c92a80b175

SHA1
d745578bc26c472f61cbc9ad6fb5a9ee9f529355

SHA256
7a75d6858259c02bc1fe309dd9d7a257864b7705f1f7f083a2e6e34b99ad3464

SHA512
b5c0fe989eb6ca3f0f0689d75a47f6ec87a7fe7602348610908636bc044dad15012037cfac9b8f79fd34f5ad9fd91b6bedee33032d33ffa7ecab364a999687ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
2.2MB

MD5
715442730775808895e19097736ffea2

SHA1
89b11189b1519e792703ee8652550fdafa64464a

SHA256
e740b2724c576953e634141bbbbf1e2d40782f1c842420d44170bfd953e226ca

SHA512
7dd1822430fc2cf44fcf493b53b56e317257e3436b317e1bb079cbb469d68eaf2c53bf0eb46d9af624814a0d889e472083bb4df32934311dff6ed66ff1ff54d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HIJPG.tmp\FEB7.tmp

Filesize
291KB

MD5
b289d53ed80971a6c30f6ad69be036e3

SHA1
065f85e55f507df28ecce62a21840c30a9f3a51e

SHA256
f8056e3317113fdf933c9bc738742953e078b867aaa002e0dafa281b42e8f924

SHA512
2aef7a9db103e5a3224d0871020b3cf9ad203fc5afe4b90cf5323c5679fcb54fb5820f1d435921ca01bffc77dedef370ba39506d64c7cea550c9c428bc1bf301

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HIJPG.tmp\FEB7.tmp

Filesize
147KB

MD5
b2c00fcc5d815f6a25cf59780ecbed90

SHA1
246270db0758a573dd842c0ee2c3447a2cd2c33f

SHA256
44d1571b71ee396f3a491bea2cdfb183a64c838ce6a8e5a7bdc820738a7199c4

SHA512
b60f5445616d48f88e7f936b8bf0bcb168682ede1e51bce789650210a70bcf5515c59becf983fca3be6ca8ea9337662b3cda34037318e9fe91399c372c10e375

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VSVT3.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VSVT3.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr3EA0.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst43D1.tmp

Filesize
184KB

MD5
4e5777fa873290ac25f6120324ac41c1

SHA1
d0ccdcf58e069e26aca711dc9d9d9eab25f94d11

SHA256
01280ad872d9f72c7bc4a3b53e27f05220fd186d5033a2dd036f4a0fcb1b19ad

SHA512
d82eaf553c2e61b7863d625e86a9c2fed8c9b393158d09ca96b2dcd367dd13a2edbbcf59d1109ae5b51e572996f57ee026e34b82ddeb61732b2a6b3957185734

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe

Filesize
171KB

MD5
4d1a4b3096f4a39f3a91df2f6efd43c6

SHA1
af7b52300363fa6f5ce8b5f99f753a9b1e0af94f

SHA256
ca5b5e71addd8a56460eefad5cd368a5f6aca71b7a2d6dcfb312f45d1ae6e20b

SHA512
d7cc6cf36fa0da5c22b531f7b3f58cbbcc206aaa47d40ebc0256fa5ede758fa7f636f9b70fa8077664067c8cbd3b38633ef2ca1e2e8e349b3b05c3cec1f8afd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe

Filesize
4KB

MD5
a5ce3aba68bdb438e98b1d0c70a3d95c

SHA1
013f5aa9057bf0b3c0c24824de9d075434501354

SHA256
9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a

SHA512
7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat

Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
5a5b20b4cfc2d1750037a626d6e12507

SHA1
82e092242463340f3fd9c8754e21de3f34c87cf4

SHA256
3ba1521d6fcc8f7a0e16f1ab4e09c4bfe602b1ab10801373163f6f11a35f1f74

SHA512
15014cfee85cb8b22a87edb3d8cd432348531eca54715dba19d11c6b1c0d00a15a42349d78c2710edd1ed21a7bfbfb394a7141b8a73fb2642a7e1a4fd4985ba6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ac185f52d9fe1fc988c376ad64bd6b42

SHA1
f63561724fb4bc207a033e22c15a9a7f940b2eec

SHA256
0a3fae0cfefa204b5440c8b9449e1c806732ebf6cb97430d52348acfee3c7033

SHA512
f0df190890a475ce5456365033c314d31200b10fc9e1b81fd69b4c895a62ced3661416f51a70aa0a74135c91efdc1a02fff794c720c16b7fa7021e8ab3e74d70

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
d78ba8060c9cd3ba2a7081cddf795c37

SHA1
09914d9b9eecf24358620ec5bec7512c7a9e973b

SHA256
a43fe9b9165ba35c1433bb758396ebd3ce8ad514ed68826e56bdbbda26987910

SHA512
4ae48bb52514637f2a25a2ec458624f750d9ec347dcd7a35fcbca91b8bd0054a8acd9728b2d91cbbf349ff77aa5fb159e51fc685a69121adb26d2a61fb206147

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
7dc3661ef54df54221cd56c42f57d06b

SHA1
98c63b7b05615bd6d51d3119a0bd976712507849

SHA256
d79a767b6a5798205a202556b9292b7a111e6bb8a10acb205053f2714574df50

SHA512
2fb2797defb8d787b08abf587984f4117c8d51ae626bf9961629412b297fed5a4b41b3189c9286a7f028a7a1e1a552b34585c7e692e3774d729e28fd07495f08

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
1616cf3699b7b7b1e6fd9c832031c0c5

SHA1
493fb198febf1abc112dfca4f235a2a3dd4b53f8

SHA256
69ed55bbc0f92b02babde8dd99e503bef5717e59e35e76d4beb8d3c3384fe551

SHA512
85ab05357a3220d6ee71f8a4b5b0964d846767d3bc735cf3eff79896d3d71ef768720a96e67b436e7853bb119268592f904cfb2bd988382e00328f45568ba1ca

Download Submit
C:\Windows\rss\csrss.exe

Filesize
579KB

MD5
030761b9376e8eb24cffa5bc4ebc53cd

SHA1
b9047ab596014f052f314674e50f8ac5534ac486

SHA256
3c8b7a243160d296d62a3bb6035f285412aa3410f501bff6f05c3468793a5d6e

SHA512
cca7bab49d077819781fa6cb64a1ee55232a8c46ed2de59b12470e2b39de8d33b0097ec1aa3b95fa5946dd43e9126c30ccced3b3a94c43084bf79828f261e938

Download Submit
C:\Windows\rss\csrss.exe

Filesize
574KB

MD5
2bc12efaa584cfc6d2ed5b34cba0ba98

SHA1
26852c3b7fe64acee884862abe4ac972e7fed65d

SHA256
6ebacdf7b0107b0221ed2fb98b21f8955cf1e5ea20a09aea5eabc00916999be4

SHA512
1075be047750bb5c9fdab66a2025adaa494911a49f1a18462d22d5286a4167bc9b23d22c14855a64b513b949116211b46ddd790e302df9e0e75278a0eac90b91

Download Submit
C:\Windows\windefender.exe

Filesize
540KB

MD5
3e404f434e169a8f4a8632af45854d84

SHA1
d696f2da8bc933070c56e686fcead1bf2bdc200c

SHA256
47225505117e0f44226be44bdda713c8b4dd3f9ba85b678185855831883cfe40

SHA512
bb057584b4fb6768a73b550e173d07da6200104e08acd06553eb3afa40377984c031861e0f413d689ff3fd0d952112c4c1c6e35bc0f131f2525993710a88c7f7

Download Submit
C:\Windows\windefender.exe

Filesize
434KB

MD5
c0a66042a2bef66537f5bb8a4bac2abb

SHA1
0a0d505be5b8d1bc5e7a123833f016dd6bff8626

SHA256
fe0ad22005aef552a7efca1dfecfe8831b7c740b5dcc75bb06b79358095c90f5

SHA512
2519d85da7e18ef5fd573ae8fb2122c74b3b632da6d9480d33a382e950445f53be59d902a1d2a6302fdb141a77708f90a03ea47922352b75d7c12af6f4922556

Download Submit
C:\Windows\windefender.exe

Filesize
365KB

MD5
dc3f02f24b7f132559517c85f64e33a9

SHA1
640f0b41afcc16d128fcd94048d97db31b6d340c

SHA256
693afed3cfd4467cd03bcbbeaeb2a359a0e54d0e48c52f19758cbc6ece3a13bf

SHA512
2eb20a4c51d9be5d95d857beb42832cee2e14f57602eac380ae5fe08de0cc08a4a0a32f5ecaacea416c0b8b9fa87980beb9e6c6ad47a889a5177608d4b7e45f7

Download Submit
memory/700-169-0x0000000000400000-0x00000000008E2000-memory.dmp

Filesize
4.9MB

Download
memory/700-105-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/700-37-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/868-77-0x0000000002230000-0x000000000224C000-memory.dmp

Filesize
112KB

Download
memory/868-387-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/868-418-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/868-76-0x0000000000700000-0x0000000000800000-memory.dmp

Filesize
1024KB

Download
memory/868-79-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/868-318-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1596-45-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1596-44-0x0000000000660000-0x000000000066B000-memory.dmp

Filesize
44KB

Download
memory/1596-47-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/1596-114-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1976-463-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1976-460-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1976-461-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1980-425-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2900-106-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2900-104-0x0000000002EA0000-0x000000000378B000-memory.dmp

Filesize
8.9MB

Download
memory/2900-103-0x0000000002A90000-0x0000000002E96000-memory.dmp

Filesize
4.0MB

Download
memory/2900-283-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3444-109-0x0000000000A10000-0x0000000000A26000-memory.dmp

Filesize
88KB

Download
memory/3444-424-0x0000000002AC0000-0x0000000002AD6000-memory.dmp

Filesize
88KB

Download
memory/3636-153-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/3636-152-0x0000000073C60000-0x0000000074410000-memory.dmp

Filesize
7.7MB

Download
memory/3636-154-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/3636-155-0x0000000005BE0000-0x0000000005F34000-memory.dmp

Filesize
3.3MB

Download
memory/3888-452-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3888-440-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3888-435-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3888-439-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4056-456-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4060-29-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/4060-0-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/4060-1-0x0000000000120000-0x000000000076A000-memory.dmp

Filesize
6.3MB

Download
memory/4072-474-0x0000000000550000-0x0000000001064000-memory.dmp

Filesize
11.1MB

Download
memory/4072-478-0x0000000000550000-0x0000000001064000-memory.dmp

Filesize
11.1MB

Download
memory/4200-413-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4740-80-0x0000000006160000-0x00000000061A4000-memory.dmp

Filesize
272KB

Download
memory/4740-74-0x00000000057C0000-0x0000000005B14000-memory.dmp

Filesize
3.3MB

Download
memory/4740-57-0x0000000002620000-0x0000000002656000-memory.dmp

Filesize
216KB

Download
memory/4740-58-0x0000000073C60000-0x0000000074410000-memory.dmp

Filesize
7.7MB

Download
memory/4740-59-0x0000000002610000-0x0000000002620000-memory.dmp

Filesize
64KB

Download
memory/4740-61-0x0000000004D20000-0x0000000005348000-memory.dmp

Filesize
6.2MB

Download
memory/4740-60-0x0000000002610000-0x0000000002620000-memory.dmp

Filesize
64KB

Download
memory/4740-62-0x0000000004C50000-0x0000000004C72000-memory.dmp

Filesize
136KB

Download
memory/4740-73-0x00000000054D0000-0x0000000005536000-memory.dmp

Filesize
408KB

Download
memory/4740-63-0x0000000005540000-0x00000000055A6000-memory.dmp

Filesize
408KB

Download
memory/4740-75-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Filesize
120KB

Download
memory/4740-78-0x0000000005CA0000-0x0000000005CEC000-memory.dmp

Filesize
304KB

Download
memory/4740-81-0x0000000006F10000-0x0000000006F86000-memory.dmp

Filesize
472KB

Download
memory/4740-83-0x0000000006FB0000-0x0000000006FCA000-memory.dmp

Filesize
104KB

Download
memory/4740-82-0x0000000007610000-0x0000000007C8A000-memory.dmp

Filesize
6.5MB

Download
memory/4740-86-0x00000000718F0000-0x000000007193C000-memory.dmp

Filesize
304KB

Download
memory/4740-98-0x00000000071D0000-0x0000000007273000-memory.dmp

Filesize
652KB

Download
memory/4740-99-0x00000000072C0000-0x00000000072CA000-memory.dmp

Filesize
40KB

Download
memory/4740-97-0x00000000071B0000-0x00000000071CE000-memory.dmp

Filesize
120KB

Download
memory/4740-87-0x0000000071940000-0x0000000071C94000-memory.dmp

Filesize
3.3MB

Download
memory/4740-85-0x0000000007170000-0x00000000071A2000-memory.dmp

Filesize
200KB

Download
memory/4740-84-0x000000007F450000-0x000000007F460000-memory.dmp

Filesize
64KB

Download
memory/4740-100-0x0000000073C60000-0x0000000074410000-memory.dmp

Filesize
7.7MB

Download
memory/4916-468-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4916-388-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4916-428-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4924-108-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4924-39-0x0000000002980000-0x0000000002D82000-memory.dmp

Filesize
4.0MB

Download
memory/4924-43-0x0000000002D90000-0x000000000367B000-memory.dmp

Filesize
8.9MB

Download
memory/4924-46-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4924-107-0x0000000002980000-0x0000000002D82000-memory.dmp

Filesize
4.0MB

Download
memory/4936-140-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/4936-143-0x0000000007860000-0x0000000007871000-memory.dmp

Filesize
68KB

Download
memory/4936-139-0x0000000007530000-0x00000000075D3000-memory.dmp

Filesize
652KB

Download
memory/4936-141-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/4936-126-0x0000000006860000-0x00000000068AC000-memory.dmp

Filesize
304KB

Download
memory/4936-128-0x0000000071900000-0x000000007194C000-memory.dmp

Filesize
304KB

Download
memory/4936-150-0x0000000073C60000-0x0000000074410000-memory.dmp

Filesize
7.7MB

Download
memory/4936-127-0x000000007F250000-0x000000007F260000-memory.dmp

Filesize
64KB

Download
memory/4936-142-0x0000000007930000-0x00000000079C6000-memory.dmp

Filesize
600KB

Download
memory/4936-129-0x0000000071950000-0x0000000071CA4000-memory.dmp

Filesize
3.3MB

Download
memory/4936-144-0x00000000078A0000-0x00000000078AE000-memory.dmp

Filesize
56KB

Download
memory/4936-125-0x0000000005F60000-0x00000000062B4000-memory.dmp

Filesize
3.3MB

Download
memory/4936-145-0x00000000078B0000-0x00000000078C4000-memory.dmp

Filesize
80KB

Download
memory/4936-147-0x00000000078E0000-0x00000000078E8000-memory.dmp

Filesize
32KB

Download
memory/4936-146-0x00000000078F0000-0x000000000790A000-memory.dmp

Filesize
104KB

Download
memory/4936-110-0x0000000073C60000-0x0000000074410000-memory.dmp

Filesize
7.7MB

Download
memory/4936-111-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download
memory/4936-112-0x0000000002DF0000-0x0000000002E00000-memory.dmp

Filesize
64KB

Download