amadey | 7631744f38037f6f9cf0e5de0457596dd8c952ff6f88bca44861a6285d83634f

Analysis

max time kernel
108s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2024 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe
Size

404KB
MD5

df35f19c7d7e1539ca17e4d839b20a04
SHA1

7dab9f9d3ff0c6f4ee4d7f33ab81ac7118afe193
SHA256

f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54
SHA512

90e210ce12d846c42fa724ad1be934362134b5449dbe6bad49e380087bd2496fe973c4e63731ef291cc854685cd7129e980676816e4298ef617ee56896b5c00b
SSDEEP

6144:uOdRAuQwnBqt1aNbaQH2weEc55EoRvDDoeAWOd9lPinZnPmx6u5+xH2/fUp14unr:Bdjn7NWEAvoe3O5Pipmx6u5+xMcHd

Malware Config

Extracted

Family

amadey

Version

4.17

http://5.42.64.4

Attributes

install_dir
a0b3b7d4a5
install_file
Dctooux.exe
strings_key
be8779cf0e6231090471d1ca85ec4a38
url_paths
/jPdsj3d4M/index.php

rc4.plain

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

risepro

193.233.132.62:50500

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Fabookie payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1976-185-0x0000000002D20000-0x0000000002E4E000-memory.dmp	family_fabookie
behavioral2/memory/1976-274-0x0000000002D20000-0x0000000002E4E000-memory.dmp	family_fabookie

Detected Djvu ransomware 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1944-280-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/884-284-0x00000000021C0000-0x00000000022DB000-memory.dmp	family_djvu
behavioral2/memory/1944-283-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1944-285-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1944-286-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1944-307-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4144-315-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4144-313-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4144-317-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5088-39-0x0000000002E80000-0x000000000376B000-memory.dmp	family_glupteba
behavioral2/memory/5088-40-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5088-58-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5088-167-0x0000000002E80000-0x000000000376B000-memory.dmp	family_glupteba
behavioral2/memory/5088-310-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5088-438-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

4772.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4772.exe
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3652 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4772.exe

pid	process
3652	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4772.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4772.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4772.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

19C9.exeDctooux.exenst995F.tmp

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	19C9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	Dctooux.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	nst995F.tmp

Executes dropped EXE 17 IoCs

Processes:

Dctooux.exe7b0d48dbbf50fe239f1097f5d01c2a6d.exeInstallSetup9.exeBroomSetup.exetoolspub1.exenst995F.tmprty25.exeFirstZ.exe371.exe19C9.exe19C9.exe19C9.exe19C9.exe36A8.exe4772.exereakuqnanrkn.exe7b0d48dbbf50fe239f1097f5d01c2a6d.exe

pid	process
1628	Dctooux.exe
5088	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
2476	InstallSetup9.exe
1360	BroomSetup.exe
3636	toolspub1.exe
4108	nst995F.tmp
1976	rty25.exe
3404	FirstZ.exe
2732	371.exe
884	19C9.exe
1944	19C9.exe
3556	19C9.exe
4144	19C9.exe
416	36A8.exe
2924	4772.exe
2268	reakuqnanrkn.exe
560	7b0d48dbbf50fe239f1097f5d01c2a6d.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

4772.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Wine 4772.exe
Loads dropped DLL 5 IoCs

Processes:

InstallSetup9.exenst995F.tmp

pid process

2476 InstallSetup9.exe
2476 InstallSetup9.exe
4108 nst995F.tmp
4108 nst995F.tmp
2476 InstallSetup9.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5008 icacls.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Wine	4772.exe

pid	process
2476	InstallSetup9.exe
2476	InstallSetup9.exe
4108	nst995F.tmp
4108	nst995F.tmp
2476	InstallSetup9.exe

pid	process
5008	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

19C9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\88edc0a7-423a-41c6-b2c0-85ec779f517d\\19C9.exe\" --AutoStart"	19C9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

132 pastebin.com
133 pastebin.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

92 api.2ip.ua
93 api.2ip.ua
Drops file in System32 directory 1 IoCs

Processes:

FirstZ.exe

description ioc process

File opened for modification C:\Windows\system32\MRT.exe FirstZ.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4772.exe

pid process

2924 4772.exe

flow	ioc
132	pastebin.com
133	pastebin.com

flow	ioc
92	api.2ip.ua
93	api.2ip.ua

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe

pid	process
2924	4772.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

19C9.exe19C9.exe36A8.exe

description	pid	process	target process
PID 884 set thread context of 1944	884	19C9.exe	19C9.exe
PID 3556 set thread context of 4144	3556	19C9.exe	19C9.exe
PID 416 set thread context of 4576	416	36A8.exe	RegAsm.exe

Drops file in Windows directory 1 IoCs

Processes:

f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe

description ioc process

File created C:\Windows\Tasks\Dctooux.job f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
1008	sc.exe
1152	sc.exe
3448	sc.exe
4516	sc.exe
4232	sc.exe
3612	sc.exe
4916	sc.exe
4384	sc.exe
2004	sc.exe
1448	sc.exe
2588	sc.exe
856	sc.exe
2880	sc.exe
1140	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 40 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5056	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
4416	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
5008	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
4532	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
2272	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
1120	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3296	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3640	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
4544	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3128	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
1140	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
5092	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
4484	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
552	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3996	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3476	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
4224	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
8	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3044	5088	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
2916	4108	WerFault.exe	nst995F.tmp
2364	4144	WerFault.exe	19C9.exe
520	4576	WerFault.exe	RegAsm.exe
2724	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3100	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
800	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
2792	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
2260	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
4048	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3896	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
4188	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
3164	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
820	560	WerFault.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
2480	4440	WerFault.exe	csrss.exe
1388	4440	WerFault.exe	csrss.exe
4952	4440	WerFault.exe	csrss.exe
3292	4440	WerFault.exe	csrss.exe
3368	4440	WerFault.exe	csrss.exe
2520	4440	WerFault.exe	csrss.exe
3640	4440	WerFault.exe	csrss.exe
1956	4440	WerFault.exe	csrss.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

371.exetoolspub1.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	371.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	371.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nst995F.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nst995F.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nst995F.tmp

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1764 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3688 timeout.exe

pid	process
1764	schtasks.exe

pid	process
3688	timeout.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

toolspub1.exenst995F.tmp

pid	process
3636	toolspub1.exe
3636	toolspub1.exe
4108	nst995F.tmp
4108	nst995F.tmp
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440
3440

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

toolspub1.exe371.exe

pid process

3636 toolspub1.exe
2732 371.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

powershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exe7b0d48dbbf50fe239f1097f5d01c2a6d.exe

description	pid	process
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeShutdownPrivilege	2484	powercfg.exe
Token: SeCreatePagefilePrivilege	2484	powercfg.exe
Token: SeShutdownPrivilege	3312	powercfg.exe
Token: SeCreatePagefilePrivilege	3312	powercfg.exe
Token: SeShutdownPrivilege	1852	powercfg.exe
Token: SeCreatePagefilePrivilege	1852	powercfg.exe
Token: SeShutdownPrivilege	4956	powercfg.exe
Token: SeCreatePagefilePrivilege	4956	powercfg.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeShutdownPrivilege	3440
Token: SeCreatePagefilePrivilege	3440
Token: SeDebugPrivilege	5088	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
Token: SeImpersonatePrivilege	5088	7b0d48dbbf50fe239f1097f5d01c2a6d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe

pid process

1284 f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BroomSetup.exe

pid process

1360 BroomSetup.exe

pid	process
1284	f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe

pid	process
1360	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Dctooux.exe7b0d48dbbf50fe239f1097f5d01c2a6d.exeInstallSetup9.exeBroomSetup.execmd.exenst995F.tmpcmd.exe19C9.exe19C9.exe19C9.exe

description	pid	process	target process
PID 1628 wrote to memory of 5088	1628	Dctooux.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
PID 1628 wrote to memory of 5088	1628	Dctooux.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
PID 1628 wrote to memory of 5088	1628	Dctooux.exe	7b0d48dbbf50fe239f1097f5d01c2a6d.exe
PID 5088 wrote to memory of 2204	5088	7b0d48dbbf50fe239f1097f5d01c2a6d.exe	powershell.exe
PID 5088 wrote to memory of 2204	5088	7b0d48dbbf50fe239f1097f5d01c2a6d.exe	powershell.exe
PID 5088 wrote to memory of 2204	5088	7b0d48dbbf50fe239f1097f5d01c2a6d.exe	powershell.exe
PID 1628 wrote to memory of 2476	1628	Dctooux.exe	InstallSetup9.exe
PID 1628 wrote to memory of 2476	1628	Dctooux.exe	InstallSetup9.exe
PID 1628 wrote to memory of 2476	1628	Dctooux.exe	InstallSetup9.exe
PID 2476 wrote to memory of 1360	2476	InstallSetup9.exe	BroomSetup.exe
PID 2476 wrote to memory of 1360	2476	InstallSetup9.exe	BroomSetup.exe
PID 2476 wrote to memory of 1360	2476	InstallSetup9.exe	BroomSetup.exe
PID 1628 wrote to memory of 3636	1628	Dctooux.exe	toolspub1.exe
PID 1628 wrote to memory of 3636	1628	Dctooux.exe	toolspub1.exe
PID 1628 wrote to memory of 3636	1628	Dctooux.exe	toolspub1.exe
PID 2476 wrote to memory of 4108	2476	InstallSetup9.exe	nst995F.tmp
PID 2476 wrote to memory of 4108	2476	InstallSetup9.exe	nst995F.tmp
PID 2476 wrote to memory of 4108	2476	InstallSetup9.exe	nst995F.tmp
PID 1628 wrote to memory of 1976	1628	Dctooux.exe	rty25.exe
PID 1628 wrote to memory of 1976	1628	Dctooux.exe	rty25.exe
PID 1628 wrote to memory of 3404	1628	Dctooux.exe	FirstZ.exe
PID 1628 wrote to memory of 3404	1628	Dctooux.exe	FirstZ.exe
PID 1360 wrote to memory of 4888	1360	BroomSetup.exe	cmd.exe
PID 1360 wrote to memory of 4888	1360	BroomSetup.exe	cmd.exe
PID 1360 wrote to memory of 4888	1360	BroomSetup.exe	cmd.exe
PID 4888 wrote to memory of 3392	4888	cmd.exe	chcp.com
PID 4888 wrote to memory of 3392	4888	cmd.exe	chcp.com
PID 4888 wrote to memory of 3392	4888	cmd.exe	chcp.com
PID 4888 wrote to memory of 1764	4888	cmd.exe	schtasks.exe
PID 4888 wrote to memory of 1764	4888	cmd.exe	schtasks.exe
PID 4888 wrote to memory of 1764	4888	cmd.exe	schtasks.exe
PID 4108 wrote to memory of 1484	4108	nst995F.tmp	cmd.exe
PID 4108 wrote to memory of 1484	4108	nst995F.tmp	cmd.exe
PID 4108 wrote to memory of 1484	4108	nst995F.tmp	cmd.exe
PID 1484 wrote to memory of 3688	1484	cmd.exe	timeout.exe
PID 1484 wrote to memory of 3688	1484	cmd.exe	timeout.exe
PID 1484 wrote to memory of 3688	1484	cmd.exe	timeout.exe
PID 3440 wrote to memory of 2732	3440		371.exe
PID 3440 wrote to memory of 2732	3440		371.exe
PID 3440 wrote to memory of 2732	3440		371.exe
PID 3440 wrote to memory of 884	3440		19C9.exe
PID 3440 wrote to memory of 884	3440		19C9.exe
PID 3440 wrote to memory of 884	3440		19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 884 wrote to memory of 1944	884	19C9.exe	19C9.exe
PID 1944 wrote to memory of 5008	1944	19C9.exe	icacls.exe
PID 1944 wrote to memory of 5008	1944	19C9.exe	icacls.exe
PID 1944 wrote to memory of 5008	1944	19C9.exe	icacls.exe
PID 1944 wrote to memory of 3556	1944	19C9.exe	19C9.exe
PID 1944 wrote to memory of 3556	1944	19C9.exe	19C9.exe
PID 1944 wrote to memory of 3556	1944	19C9.exe	19C9.exe
PID 3556 wrote to memory of 4144	3556	19C9.exe	19C9.exe
PID 3556 wrote to memory of 4144	3556	19C9.exe	19C9.exe
PID 3556 wrote to memory of 4144	3556	19C9.exe	19C9.exe
PID 3556 wrote to memory of 4144	3556	19C9.exe	19C9.exe
PID 3556 wrote to memory of 4144	3556	19C9.exe	19C9.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe
"C:\Users\Admin\AppData\Local\Temp\f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:1284

C:\Users\Admin\AppData\Local\Temp\a0b3b7d4a5\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\a0b3b7d4a5\Dctooux.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\1000005001\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
  "C:\Users\Admin\AppData\Local\Temp\1000005001\7b0d48dbbf50fe239f1097f5d01c2a6d.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 372
    3⤵
    - Program crash
    PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 396
    3⤵
    - Program crash
    PID:4416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 412
    3⤵
    - Program crash
    PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 680
    3⤵
    - Program crash
    PID:4532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 720
    3⤵
    - Program crash
    PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 740
    3⤵
    - Program crash
    PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 740
    3⤵
    - Program crash
    PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 768
    3⤵
    - Program crash
    PID:3640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 792
    3⤵
    - Program crash
    PID:4544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 868
    3⤵
    - Program crash
    PID:3128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 768
    3⤵
    - Program crash
    PID:1140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 832
    3⤵
    - Program crash
    PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 788
    3⤵
    - Program crash
    PID:4484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 744
    3⤵
    - Program crash
    PID:552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 768
    3⤵
    - Program crash
    PID:3996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 616
    3⤵
    - Program crash
    PID:3476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 832
    3⤵
    - Program crash
    PID:4224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 800
    3⤵
    - Program crash
    PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 856
    3⤵
    - Program crash
    PID:3044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\1000005001\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\7b0d48dbbf50fe239f1097f5d01c2a6d.exe"
    3⤵
    - Executes dropped EXE
    PID:560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 344
      4⤵
      Program crash
      PID:2724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 244
      4⤵
      Program crash
      PID:3100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 360
      4⤵
      Program crash
      PID:800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 596
      4⤵
      Program crash
      PID:2792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 688
      4⤵
      Program crash
      PID:2260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 688
      4⤵
      Program crash
      PID:4048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 732
      4⤵
      Program crash
      PID:3896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 740
      4⤵
      Program crash
      PID:4188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 748
      4⤵
      Program crash
      PID:3164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3136
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:1964
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3652
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 880
      4⤵
      Program crash
      PID:820
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:4440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 372
        5⤵
        Program crash
        
        PID:2480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 388
        5⤵
        Program crash
        
        PID:1388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 392
        5⤵
        Program crash
        
        PID:4952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 680
        5⤵
        Program crash
        
        PID:3292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 716
        5⤵
        Program crash
        
        PID:3368
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 716
        5⤵
        Program crash
        
        PID:2520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 756
        5⤵
        Program crash
        
        PID:3640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 764
        5⤵
        Program crash
        
        PID:1956
- C:\Users\Admin\AppData\Local\Temp\1000006001\InstallSetup9.exe
  "C:\Users\Admin\AppData\Local\Temp\1000006001\InstallSetup9.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:3392
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:1764
- - C:\Users\Admin\AppData\Local\Temp\nst995F.tmp
    C:\Users\Admin\AppData\Local\Temp\nst995F.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nst995F.tmp" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 2552
      4⤵
      Program crash
      PID:2916
- C:\Users\Admin\AppData\Local\Temp\1000007001\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\1000007001\toolspub1.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3636
- C:\Users\Admin\AppData\Local\Temp\1000008001\rty25.exe
  "C:\Users\Admin\AppData\Local\Temp\1000008001\rty25.exe"
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\1000009001\FirstZ.exe
  "C:\Users\Admin\AppData\Local\Temp\1000009001\FirstZ.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3404
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2792
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4000
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3448
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3612
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4916
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2588
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1008
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:4384
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1152
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "WSNKISKT"
    3⤵
    - Launches sc.exe
    PID:2004
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5088 -ip 5088
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5088 -ip 5088
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5088 -ip 5088
1⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5088 -ip 5088
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5088 -ip 5088
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5088 -ip 5088
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5088 -ip 5088
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5088 -ip 5088
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5088 -ip 5088
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5088 -ip 5088
1⤵
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5088 -ip 5088
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5088 -ip 5088
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5088 -ip 5088
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5088 -ip 5088
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5088 -ip 5088
1⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5088 -ip 5088
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5088 -ip 5088
1⤵
PID:416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4108 -ip 4108
1⤵
PID:2724

C:\Users\Admin\AppData\Local\Temp\371.exe
C:\Users\Admin\AppData\Local\Temp\371.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2732

C:\Users\Admin\AppData\Local\Temp\19C9.exe
C:\Users\Admin\AppData\Local\Temp\19C9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\19C9.exe
  C:\Users\Admin\AppData\Local\Temp\19C9.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\88edc0a7-423a-41c6-b2c0-85ec779f517d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\19C9.exe
    "C:\Users\Admin\AppData\Local\Temp\19C9.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\19C9.exe
      "C:\Users\Admin\AppData\Local\Temp\19C9.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:4144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 568
        5⤵
        Program crash
        
        PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4144 -ip 4144
1⤵
PID:1152

C:\Users\Admin\AppData\Local\Temp\36A8.exe
C:\Users\Admin\AppData\Local\Temp\36A8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 1188
    3⤵
    - Program crash
    PID:520

C:\Users\Admin\AppData\Local\Temp\4772.exe
C:\Users\Admin\AppData\Local\Temp\4772.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2924

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
PID:2268
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:1492
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3788
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2880
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4516
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1448
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4232
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1140
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:4140
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:4524
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:5072
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:2288
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4960
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4576 -ip 4576
1⤵
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 560 -ip 560
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 560 -ip 560
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 560 -ip 560
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 560 -ip 560
1⤵
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 560 -ip 560
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 560 -ip 560
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 560 -ip 560
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 560 -ip 560
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 560 -ip 560
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 560 -ip 560
1⤵
PID:3556

C:\Users\Admin\AppData\Local\Temp\228.exe
C:\Users\Admin\AppData\Local\Temp\228.exe
1⤵
PID:4412
- C:\Users\Admin\AppData\Local\Temp\is-8RP0K.tmp\228.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8RP0K.tmp\228.tmp" /SL5="$690048,6315214,54272,C:\Users\Admin\AppData\Local\Temp\228.exe"
  2⤵
  PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4440 -ip 4440
1⤵
PID:4916

C:\Users\Admin\AppData\Roaming\vwbhrrb
C:\Users\Admin\AppData\Roaming\vwbhrrb
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4440 -ip 4440
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4440 -ip 4440
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4440 -ip 4440
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4440 -ip 4440
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4440 -ip 4440
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4440 -ip 4440
1⤵
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4440 -ip 4440
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
8112ab2a9d7578692e66734917d00015

SHA1
5dc1f7cb2c66c925d195fb98784917d108a001dd

SHA256
919561b1927726f5218e79f21184c4bf7117db4466686fc93d3d5dbc1380033b

SHA512
538f1f36b44d628d2ade163cc40deb58b50cb7fbd56019d9526c8233c30771db8542ed5786d311322dfd2e9d44e979da9513c4a0bbc7416b47bb7beca90013d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
d92143cfd3de611349b35aef9820b9a7

SHA1
b87227984bb9b4c15a94421695e312f4e2e076f5

SHA256
0a2e6d6c570da5d9370c899d5c887e1fa6e5548fb432ef46dc15fabe6880ebd7

SHA512
3ac6f68f32a0c5626b9b9da574dd9349436f603859de8e4ae78a466888fee1b6e196e65f74279fa730e3625b89b2c9aeef0db25816df2d2c2ff74ea8464385a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
f0636cf3ceacf3f605b3c34636813b4e

SHA1
4ab9e0d85205123b29f158e0b24d116e42b20f71

SHA256
3b434979c73614161cdbed2b707c0daed0f5145b0c83452501ec7923d5e33c3e

SHA512
6482a7d27bf25022d96314f7ddc937d9dc7e2f09be1b9d564d5233d324016eb1feab0212355c033b2669af4fb6324e51b2ab1554e4229214e47d416c80303891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
4d3386a86d11a96e2e9e1791b8d50705

SHA1
971d31d3a1b990f5bc8aaea0bd852bc724475e60

SHA256
41b8425d98b5740d8e8e74f6405099422251caeeddd815077e94bac6774f15c2

SHA512
876010c7d74ed778d2e5ab880b40431e708ed6a1aa7c061726469abcd4de90e0fe82bfa8985b0974dadef0fa0a20d069b6e528e224bd3bae6313632498d1f2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\7b0d48dbbf50fe239f1097f5d01c2a6d.exe

Filesize
4.2MB

MD5
d15d8313fce6c2ffab50ecb06bb0d8ed

SHA1
0817b35ec3a9f6128feda383d93d133429087b16

SHA256
22041f55afde5812d674415359fa960afde895651a71b41b7e80f4e1fc00bd26

SHA512
41af83ec31f19a09557b9909f39cf0893a3a05768a66c9a3685b7a7b6214ddd8df3b238f4e02840ba64c0b777af44823a4c7c837b6d2b58c4e0f28561a7a4880

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\InstallSetup9.exe

Filesize
2.0MB

MD5
0315254a52bc012cd27310f9e8cc0a0c

SHA1
81f33ba791c05da97c0406a90d827c44bd26d630

SHA256
4f883a42e2baa671520a7471c0fefe56fd75be8fd5abedde10e2873fed11662d

SHA512
4e5280e655e143369dcd897789a6947c4868fab8450cd977b3a8099565d406d7b9b6f4823827f9bf454f10f416e42b77822390e41a690b177e505b680aefe81a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\InstallSetup9.exe

Filesize
64KB

MD5
fd7431015eb5f5ebfe9e4a7397bb7b45

SHA1
fc0bbfb3c8d8c10fa1cb9e5024431d0dc0229914

SHA256
47ccc5eb2875be84fe389eedd4c9cccfe54ccd3acd4fc7ebfb5edd937b466a04

SHA512
dec0698ab0fe8beeee499af410255707239d19d7d1806b42f4124694ea0f38011e89c61d53e79f173418151ec8fc43322890e0aac84d1c5025aad60b678ff208

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\toolspub1.exe

Filesize
208KB

MD5
3459e4e3b8c2023cb721b547fda205f6

SHA1
c4cc7eb4d2e016b762e685a87b16144fda258f9c

SHA256
9e5c6920cc755310726ff3ba27373a487206238dd24667a58c0c67219db79cbd

SHA512
eba48ac97ca9d2ca6626cd7fbcdb17f5a7173e03f6d8164c9b0c91902741e38043800d8815e0385ee3e57690fcc5a77d71f2c811b859e3e5d8a886b96a0070bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\rty25.exe

Filesize
298KB

MD5
5fd7aff48d27771ca0aec6776afefb93

SHA1
5d57e1e85a836b736d3b3c2056d500d1d2b92dd2

SHA256
a9498e18f267a568b57d3a281d14118c70ffd1aae42411ee9a7661092beee97b

SHA512
aea36265cf13aa252ee06086b22002165401fed256d1bdfd26aee61f4b26e7c29b430237a6941a5a09f923b246cf84cf75b110aad9f01c694e992c6b076bc293

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\FirstZ.exe

Filesize
2.5MB

MD5
ffada57f998ed6a72b6ba2f072d2690a

SHA1
6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

SHA256
677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

SHA512
1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\19C9.exe

Filesize
824KB

MD5
f2676ea250de972076b79913ffa7fbb8

SHA1
5b6b1b7e54736260173f6e8b44f33bcc8260b6e2

SHA256
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22

SHA512
f2f2a6eec3139c233378fb8888edbe5c8bdd76869a3e3e10d1275a7fcc2e43667ea5031a6db629556d4d92d9d188dc3acd772fe3709ff664efc66deb196881d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\19C9.exe

Filesize
256KB

MD5
2dc76a1b5e45b57c7014c869565288b0

SHA1
1f82c95f92879135870c46545f2a8b72e17e4046

SHA256
81e7902f20539e010a89df09cdddd1fc8919f0b8bfe6f404316529bece136ec1

SHA512
ef8a45788b05d8a9ede7b6b610377bc6577b5b7a42fa6a5caa48231364b9f5016f9aab9ff59d3164d4a910000e4993190513e2fd04dd53fb7e315f2f69807d9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\228.exe

Filesize
1.1MB

MD5
cc5b9e83ee470495064d7b9b62900f65

SHA1
8452fd5a4ebc949850ce62cc4dd6fbd822d5f93a

SHA256
7c85acc145985708e7a3acfbf71259e54593e1b8a2b3bab4faa1880aa824e3fc

SHA512
bfb1f2ecd8036fb75e1747f0bd737867ff1b7166b62182a419b4aad9a0f029f3f3465d9826dd15cc2416da66f26cfe28d1e02f0b62f1fc8b4946c2fdb03439da

Download Submit
C:\Users\Admin\AppData\Local\Temp\228.exe

Filesize
1.6MB

MD5
1e9044001f63d81c136d4953fc75c0db

SHA1
bf60226ec5738b6a7ed54112378640f812a5e26b

SHA256
e849879709e92f03508bd22cc1064e62bf36cc34b1f6dcffa9b2755df2900125

SHA512
555c5a002bd1741c4b6dd2e73e88088b512a308b2118736fe2a69d3209e4aad90dabe629b12d0d2d9bf095fc2f954148e5a3b396cf9243553debddb191660890

Download Submit
C:\Users\Admin\AppData\Local\Temp\36A8.exe

Filesize
630KB

MD5
8806217d770aceb98510c8a6a3324c33

SHA1
86194acf54b0546d981ceab5986c578372af1664

SHA256
85aa304fcb04d0bcf5aa14a9fedc4c820f9d0bb3dc5fda3219c29e876300bd03

SHA512
40d8229af81ea635e2a5d9ffeb2d891645797f63f549362ab406d164e64d9414df989f1a07a194df6e5b412884829df636eb77d74aa1316fa9a0f330f11f1ee5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4772.exe

Filesize
512KB

MD5
d00390151cb5fb081f6774d4e9b203e9

SHA1
de894aea75c56dac528780072476a49ac22f224a

SHA256
926c4a87e067239ff08a8fa70b11f726f74d294c632b3c8fe937715b02ee2b1b

SHA512
bd53739490ba82fe673d02486b36dbe098dcfc81395759dd17ac961f7fd83a4b77656769bd051f05d9a19c4f065bbb97fd4e75691b93e4efce4f81ec0671302d

Download Submit
C:\Users\Admin\AppData\Local\Temp\4772.exe

Filesize
384KB

MD5
1edcd7f9dcaa117c83e225aa30a5975a

SHA1
ceeb3904f13fadeb1f66639b72260452d06e88b6

SHA256
427422da9cc444673a4c2ccfdf98088489ac356cb95d500cca7fd4145ffcb77d

SHA512
7f32ce191faf83b312d1a1f5369c590d752da928470f3d1970002708b44a06106fd7850086d2467fa78de2749af647aa30a7a38e6af991a5b6f188a66fa692e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

Filesize
4.7MB

MD5
5e94f0f6265f9e8b2f706f1d46bbd39e

SHA1
d0189cba430f5eea07efe1ab4f89adf5ae2453db

SHA256
50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503

SHA512
473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b40kk5el.ygu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a0b3b7d4a5\Dctooux.exe

Filesize
404KB

MD5
df35f19c7d7e1539ca17e4d839b20a04

SHA1
7dab9f9d3ff0c6f4ee4d7f33ab81ac7118afe193

SHA256
f50c34273870841df335fa73d1cd9c2acb9de70e4ed77dabfcc9eb98dcff9b54

SHA512
90e210ce12d846c42fa724ad1be934362134b5449dbe6bad49e380087bd2496fe973c4e63731ef291cc854685cd7129e980676816e4298ef617ee56896b5c00b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8RP0K.tmp\228.tmp

Filesize
576KB

MD5
ce96bc143dc08c1dcd2ee5bb4caed4a1

SHA1
b8cec496b48098e64c1ece0045a69fd96375d0f7

SHA256
d357b901de328cb9896d631f6696e12ff0b38f31c04204d461375262bbc29450

SHA512
230f29c5b07877016c69eadc132049a56c71be5dbba55c7446f8b5b3b186e842f710f36aa7edd928065cd708dde0a6070004d4620211cf7f9ff0bcc6dc12626d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8RP0K.tmp\228.tmp

Filesize
320KB

MD5
21b5633d4ee0b8263bc7fb1e548022ce

SHA1
4eb5acb5bbb4e28d14c9324427db33bd9dc6469d

SHA256
232392d361db1e35efe8d9f5a6bb2ba3f64858d191e291094e714b750ff99314

SHA512
23513997ce9c7e686d5e1a6889548acb71e1a9366b47f15b66f126e98cff1dd7d6e23346114f9e10338761ee54eb178a9a8521b29891433ea25cfa50f6aa757a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q9JT9.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb93D0.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst995F.tmp

Filesize
299KB

MD5
2499b904abed0fc39e40119f608e56f7

SHA1
d0feb429b146c5ac22832a09c6fa0c84d3ad0181

SHA256
fd7cfbb04225c20524895c1650b35812559c4e18db005bba2e3ffb14eeb7c448

SHA512
08d1b70525319cb63140eec7c372ecd37b61146c0f370e2e7f250edbe7e25b19cc0540b547d1c00b24dde820b2f99d15c11d2cc54374540b1c6a3239ec0b45c6

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat

Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
2f30cc6a2518972d6d0b89138180ef16

SHA1
bf20a06b6d5d96c73ee433bf96c2cfc004725711

SHA256
105df385abecc927e0e6391574c98df9e9dd3098152dd7e1b0d39d5649c4b494

SHA512
a6efe00dde6f284014aa01817f17346b56887fb18fe664a8bf6a276d82a1829131be1f75b153eabaf1630ef1ad68ea16148561c6d1ec52a5fc004f56f66c5b45

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
fb6868d03d83267d270808513bd9247d

SHA1
e78500c0067f83429fb31a9b0f2cff2f50baf841

SHA256
e40712d0371d4be7058ea25e166928bca410f48dceef31abefc4f0a7f6556e2b

SHA512
a70201a8d351d52c128b1e7aa7b743cf4ca657a434854cb64513f27843cf8dfa9e0cad0001520c12d92ef431ba7e2380505b162e81c6c4584e6ef4e012c5a36d

Download Submit
C:\Windows\rss\csrss.exe

Filesize
2.1MB

MD5
76d09e87a8ce4a8c99f591b7e2c7728f

SHA1
5afb35f01968c55cffb3af70f97bddb116ad5801

SHA256
3ce4fa974caf934bf167ff77ff85bf8930931fc54e91d70e6eb6c0a48cc5a4eb

SHA512
5357ec0803053e366049bf8b07c981b979786176e7c836397312544d77967ca9b53c7c688871e9016d657ef0dd7575f64f0617413b5ec94275485c32f26802e8

Download Submit
C:\Windows\rss\csrss.exe

Filesize
2.2MB

MD5
3c91726c9e5515b30a8d9a5bb37571f5

SHA1
455611103fa7778c29da150ea5a54e63a9a83e02

SHA256
1533e195735c6e45a333d4f7d048a70849058b616d26b97352ef4755748a95c9

SHA512
ce5789c872af4fe25c8661c78e8717f370f311781d6ac989eedbb264fcfb0860d38045ea28328fcd33e06ac6a5091629fe47f9f47976e41b5a546f21e2f5a75d

Download Submit
memory/416-373-0x0000000072E00000-0x00000000735B0000-memory.dmp

Filesize
7.7MB

Download
memory/416-359-0x0000000000F10000-0x0000000000FB2000-memory.dmp

Filesize
648KB

Download
memory/416-361-0x0000000072E00000-0x00000000735B0000-memory.dmp

Filesize
7.7MB

Download
memory/416-362-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/416-366-0x00000000033F0000-0x00000000053F0000-memory.dmp

Filesize
32.0MB

Download
memory/884-284-0x00000000021C0000-0x00000000022DB000-memory.dmp

Filesize
1.1MB

Download
memory/884-281-0x00000000020E0000-0x0000000002179000-memory.dmp

Filesize
612KB

Download
memory/1360-221-0x0000000000400000-0x00000000008E2000-memory.dmp

Filesize
4.9MB

Download
memory/1360-255-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/1360-81-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/1944-285-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1944-307-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1944-286-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1944-283-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1944-280-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1976-274-0x0000000002D20000-0x0000000002E4E000-memory.dmp

Filesize
1.2MB

Download
memory/1976-115-0x00007FF64BF80000-0x00007FF64BFCE000-memory.dmp

Filesize
312KB

Download
memory/1976-185-0x0000000002D20000-0x0000000002E4E000-memory.dmp

Filesize
1.2MB

Download
memory/1976-184-0x0000000002AE0000-0x0000000002BEB000-memory.dmp

Filesize
1.0MB

Download
memory/2204-335-0x000000006E5D0000-0x000000006E61C000-memory.dmp

Filesize
304KB

Download
memory/2204-333-0x0000000007990000-0x00000000079C2000-memory.dmp

Filesize
200KB

Download
memory/2204-231-0x0000000006390000-0x00000000063F6000-memory.dmp

Filesize
408KB

Download
memory/2204-350-0x0000000007C00000-0x0000000007CA3000-memory.dmp

Filesize
652KB

Download
memory/2204-230-0x0000000006270000-0x00000000062D6000-memory.dmp

Filesize
408KB

Download
memory/2204-174-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/2204-172-0x0000000005360000-0x0000000005396000-memory.dmp

Filesize
216KB

Download
memory/2204-218-0x0000000005970000-0x0000000005992000-memory.dmp

Filesize
136KB

Download
memory/2204-268-0x00000000069F0000-0x0000000006A3C000-memory.dmp

Filesize
304KB

Download
memory/2204-112-0x0000000072E00000-0x00000000735B0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-187-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/2204-186-0x00000000059D0000-0x0000000005FF8000-memory.dmp

Filesize
6.2MB

Download
memory/2204-267-0x0000000006910000-0x000000000692E000-memory.dmp

Filesize
120KB

Download
memory/2204-270-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/2204-347-0x0000000006FA0000-0x0000000006FBE000-memory.dmp

Filesize
120KB

Download
memory/2204-305-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/2204-257-0x0000000072E00000-0x00000000735B0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-336-0x000000006EAF0000-0x000000006EE44000-memory.dmp

Filesize
3.3MB

Download
memory/2204-252-0x0000000006400000-0x0000000006754000-memory.dmp

Filesize
3.3MB

Download
memory/2204-334-0x000000007F700000-0x000000007F710000-memory.dmp

Filesize
64KB

Download
memory/2204-360-0x0000000007D10000-0x0000000007D2A000-memory.dmp

Filesize
104KB

Download
memory/2204-363-0x0000000007D80000-0x0000000007D8A000-memory.dmp

Filesize
40KB

Download
memory/2204-357-0x0000000008350000-0x00000000089CA000-memory.dmp

Filesize
6.5MB

Download
memory/2288-318-0x000001B81EFF0000-0x000001B81F012000-memory.dmp

Filesize
136KB

Download
memory/2288-328-0x00007FFE25300000-0x00007FFE25DC1000-memory.dmp

Filesize
10.8MB

Download
memory/2288-329-0x000001B81F090000-0x000001B81F0A0000-memory.dmp

Filesize
64KB

Download
memory/2288-330-0x000001B81F090000-0x000001B81F0A0000-memory.dmp

Filesize
64KB

Download
memory/2288-331-0x000001B81F090000-0x000001B81F0A0000-memory.dmp

Filesize
64KB

Download
memory/2288-356-0x00007FFE25300000-0x00007FFE25DC1000-memory.dmp

Filesize
10.8MB

Download
memory/2288-348-0x000001B81F090000-0x000001B81F0A0000-memory.dmp

Filesize
64KB

Download
memory/2732-303-0x0000000000400000-0x0000000002B0D000-memory.dmp

Filesize
39.1MB

Download
memory/2732-271-0x0000000002ED0000-0x0000000002FD0000-memory.dmp

Filesize
1024KB

Download
memory/2732-272-0x0000000000400000-0x0000000002B0D000-memory.dmp

Filesize
39.1MB

Download
memory/2924-453-0x0000000000E90000-0x0000000001447000-memory.dmp

Filesize
5.7MB

Download
memory/3440-169-0x0000000001270000-0x0000000001286000-memory.dmp

Filesize
88KB

Download
memory/3440-300-0x0000000007860000-0x0000000007876000-memory.dmp

Filesize
88KB

Download
memory/3556-314-0x000000000220E000-0x00000000022A0000-memory.dmp

Filesize
584KB

Download
memory/3636-117-0x0000000002E00000-0x0000000002F00000-memory.dmp

Filesize
1024KB

Download
memory/3636-171-0x0000000000400000-0x0000000002B0D000-memory.dmp

Filesize
39.1MB

Download
memory/3636-114-0x0000000000400000-0x0000000002B0D000-memory.dmp

Filesize
39.1MB

Download
memory/3636-113-0x0000000002C60000-0x0000000002C6B000-memory.dmp

Filesize
44KB

Download
memory/4108-93-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/4108-94-0x0000000002230000-0x000000000224C000-memory.dmp

Filesize
112KB

Download
memory/4108-134-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4108-95-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/4108-222-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/4108-254-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/4108-256-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/4144-313-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4144-315-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4144-317-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4576-374-0x0000000000F80000-0x0000000000FC0000-memory.dmp

Filesize
256KB

Download
memory/4576-377-0x0000000000F80000-0x0000000000FC0000-memory.dmp

Filesize
256KB

Download
memory/4576-376-0x0000000000F80000-0x0000000000FC0000-memory.dmp

Filesize
256KB

Download
memory/4576-367-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4576-370-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4576-375-0x0000000000F80000-0x0000000000FC0000-memory.dmp

Filesize
256KB

Download
memory/4576-372-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4960-473-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4960-476-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4960-477-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4960-474-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4960-472-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/5088-116-0x0000000002A70000-0x0000000002E72000-memory.dmp

Filesize
4.0MB

Download
memory/5088-310-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5088-438-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5088-167-0x0000000002E80000-0x000000000376B000-memory.dmp

Filesize
8.9MB

Download
memory/5088-58-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5088-40-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5088-39-0x0000000002E80000-0x000000000376B000-memory.dmp

Filesize
8.9MB

Download
memory/5088-38-0x0000000002A70000-0x0000000002E72000-memory.dmp

Filesize
4.0MB

Download