dcrat | a2e56b293874962f8ccf1fc3d1a6f96b01222f470a6891d7cad95b70bc3e99c4

Analysis

max time kernel
133s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

976f6386a6c31fad6a4e2996306bbf3d.exe
Size

7.1MB
MD5

976f6386a6c31fad6a4e2996306bbf3d
SHA1

82018f85cab8337f8fe294a3864bada0cc5d845e
SHA256

a2e56b293874962f8ccf1fc3d1a6f96b01222f470a6891d7cad95b70bc3e99c4
SHA512

c72cf4eb4fab0e9e3cae2fbe5f39a4aa1b9b031b982f6e98453bcfcf72303a045269244f73966023eb4415038a726d2507d9f594d24919fb294e700199ff83f9
SSDEEP

196608:SqVSV1KkmYUVB9daURUyUlYS1yaxK8gb2ZcsS:SXV1r4DOYS1yaE89ZcsS

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Signatures

DcRat 4 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exe976f6386a6c31fad6a4e2996306bbf3d.exeschtasks.exeschtasks.exe

pid	process
1932	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	976f6386a6c31fad6a4e2996306bbf3d.exe
4444	schtasks.exe
3720	schtasks.exe

Detect Fabookie payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2260-81-0x0000000002C20000-0x0000000002D4C000-memory.dmp	family_fabookie
behavioral2/memory/2260-249-0x0000000002C20000-0x0000000002D4C000-memory.dmp	family_fabookie

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\486F.exe	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\486F.exe	family_zgrat_v1
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe	family_zgrat_v1

Detected Djvu ransomware 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4292-353-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4292-351-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4292-358-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4292-385-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1684-394-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1684-393-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1684-396-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 13 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2856-44-0x0000000002E50000-0x000000000373B000-memory.dmp	family_glupteba
behavioral2/memory/2856-48-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2856-130-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2856-163-0x0000000002E50000-0x000000000373B000-memory.dmp	family_glupteba
behavioral2/memory/2856-171-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2856-244-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4464-251-0x0000000002E50000-0x000000000373B000-memory.dmp	family_glupteba
behavioral2/memory/4464-252-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2856-270-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4464-291-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4464-336-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4464-410-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3956-458-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000004001\RDX.exe	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1000007001\sadsadsadsa.exe	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

119E.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest\Performance	119E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse\Performance	119E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService\Performance	119E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF\Performance	119E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo\Performance	119E.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

ladas.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ladas.exe
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

174 2916 rundll32.exe
176 684 rundll32.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4352 netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ladas.exe

flow	pid	process
174	2916	rundll32.exe
176	684	rundll32.exe

pid	process
4352	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ladas.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ladas.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ladas.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

976f6386a6c31fad6a4e2996306bbf3d.exeC2A0.exeexplorgu.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	976f6386a6c31fad6a4e2996306bbf3d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	C2A0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	explorgu.exe

Executes dropped EXE 25 IoCs

Processes:

InstallSetup9.exed21cbe21e38b385a41a68c5e6dd32f4c.exerty25.exetoolspub1.exeBroomSetup.exensf58B.tmpd21cbe21e38b385a41a68c5e6dd32f4c.exe96BD.exeC2A0.exeC2A0.exeC2A0.exeC2A0.execsrss.exeF932.exeAE6.exe119E.exe28C1.exeinjector.exe486F.exewindefender.exewindefender.exeexplorgu.exeplaza.exeladas.exealex.exe

pid	process
116	InstallSetup9.exe
2856	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2260	rty25.exe
904	toolspub1.exe
4448	BroomSetup.exe
3252	nsf58B.tmp
4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4396	96BD.exe
4508	C2A0.exe
4292	C2A0.exe
4916	C2A0.exe
1684	C2A0.exe
3956	csrss.exe
4704	F932.exe
4160	AE6.exe
4468	119E.exe
4712	28C1.exe
4740	injector.exe
4912	486F.exe
2792	windefender.exe
4972	windefender.exe
4800	explorgu.exe
3764	plaza.exe
1400	ladas.exe
1108	alex.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

ladas.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Wine ladas.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Wine	ladas.exe

Loads dropped DLL 9 IoCs

Processes:

InstallSetup9.exensf58B.tmprundll32.exerundll32.exerundll32.exe486F.exe

pid	process
116	InstallSetup9.exe
116	InstallSetup9.exe
3252	nsf58B.tmp
3252	nsf58B.tmp
116	InstallSetup9.exe
4680	rundll32.exe
2916	rundll32.exe
684	rundll32.exe
4912	486F.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2532 icacls.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2532	icacls.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exeexplorgu.exeC2A0.exed21cbe21e38b385a41a68c5e6dd32f4c.exe119E.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\plaza.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000001001\\plaza.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ladas.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000002001\\ladas.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\604e615a-0a01-4f7c-8ed1-28c832a47961\\C2A0.exe\" --AutoStart"	C2A0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win32.emulator = "C:\\Users\\Admin\\AppData\\Local\\Temp\\119E.exe "	119E.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

119E.exe

description ioc process

File opened (read-only) \??\F: 119E.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

79 api.2ip.ua
80 api.2ip.ua
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened (read-only)	\??\F:	119E.exe

flow	ioc
79	api.2ip.ua
80	api.2ip.ua

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

28C1.exeexplorgu.exeplaza.exeladas.exe

pid process

4712 28C1.exe
4800 explorgu.exe
3764 plaza.exe
4800 explorgu.exe
3764 plaza.exe
4800 explorgu.exe
1400 ladas.exe
3764 plaza.exe
4800 explorgu.exe

pid	process
4712	28C1.exe
4800	explorgu.exe
3764	plaza.exe
4800	explorgu.exe
3764	plaza.exe
4800	explorgu.exe
1400	ladas.exe
3764	plaza.exe
4800	explorgu.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

C2A0.exeC2A0.exe486F.exealex.exe

description	pid	process	target process
PID 4508 set thread context of 4292	4508	C2A0.exe	C2A0.exe
PID 4916 set thread context of 1684	4916	C2A0.exe	C2A0.exe
PID 4912 set thread context of 3312	4912	486F.exe	MsBuild.exe
PID 1108 set thread context of 4704	1108	alex.exe	RegAsm.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN d21cbe21e38b385a41a68c5e6dd32f4c.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Drops file in Windows directory 5 IoCs

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exe28C1.execsrss.exe

description	ioc	process
File created	C:\Windows\rss\csrss.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\Tasks\explorgu.job	28C1.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4428 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4428	sc.exe

Program crash 52 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1648	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4456	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4168	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2620	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1684	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3104	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3028	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3956	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
436	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4480	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
464	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4332	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3584	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1656	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3784	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3344	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4568	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2836	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2252	2856	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
5100	3252	WerFault.exe	nsf58B.tmp
4112	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4740	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4360	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4004	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2532	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4384	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3308	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3024	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2252	4464	WerFault.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1772	1684	WerFault.exe	C2A0.exe
1200	3956	WerFault.exe	csrss.exe
1648	3956	WerFault.exe	csrss.exe
3048	3956	WerFault.exe	csrss.exe
1240	3956	WerFault.exe	csrss.exe
4852	3956	WerFault.exe	csrss.exe
712	3956	WerFault.exe	csrss.exe
2804	3956	WerFault.exe	csrss.exe
4764	3956	WerFault.exe	csrss.exe
2612	3956	WerFault.exe	csrss.exe
4712	3956	WerFault.exe	csrss.exe
4376	3956	WerFault.exe	csrss.exe
3404	3956	WerFault.exe	csrss.exe
4428	4704	WerFault.exe	F932.exe
2612	4704	WerFault.exe	F932.exe
228	3956	WerFault.exe	csrss.exe
4984	3956	WerFault.exe	csrss.exe
1800	3312	WerFault.exe	MsBuild.exe
2096	4144	WerFault.exe	55555.exe
2352	4144	WerFault.exe	55555.exe
2672	4144	WerFault.exe	55555.exe
3204	4144	WerFault.exe	55555.exe
4840	4144	WerFault.exe	55555.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub1.exe96BD.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	96BD.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	96BD.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	96BD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nsf58B.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsf58B.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsf58B.tmp

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4444 schtasks.exe
3720 schtasks.exe
1932 schtasks.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

684 tasklist.exe

pid	process
4444	schtasks.exe
3720	schtasks.exe
1932	schtasks.exe

pid	process
684	tasklist.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

windefender.exed21cbe21e38b385a41a68c5e6dd32f4c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-161 = "Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

toolspub1.exensf58B.tmp

pid	process
904	toolspub1.exe
904	toolspub1.exe
3252	nsf58B.tmp
3252	nsf58B.tmp
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496
3496

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

toolspub1.exe96BD.exe

pid process

904 toolspub1.exe
4396 96BD.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exed21cbe21e38b385a41a68c5e6dd32f4c.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeDebugPrivilege	2856	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeImpersonatePrivilege	2856	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496
Token: SeShutdownPrivilege	3496
Token: SeCreatePagefilePrivilege	3496

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

28C1.exe

pid process

4712 28C1.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

BroomSetup.exe28C1.exeexplorgu.exeplaza.exe

pid process

4448 BroomSetup.exe
4712 28C1.exe
4800 explorgu.exe
3764 plaza.exe

pid	process
4712	28C1.exe

pid	process
4448	BroomSetup.exe
4712	28C1.exe
4800	explorgu.exe
3764	plaza.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

976f6386a6c31fad6a4e2996306bbf3d.exeInstallSetup9.exeBroomSetup.execmd.exed21cbe21e38b385a41a68c5e6dd32f4c.exed21cbe21e38b385a41a68c5e6dd32f4c.execmd.exeC2A0.exeC2A0.exe

description	pid	process	target process
PID 4816 wrote to memory of 116	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	InstallSetup9.exe
PID 4816 wrote to memory of 116	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	InstallSetup9.exe
PID 4816 wrote to memory of 116	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	InstallSetup9.exe
PID 4816 wrote to memory of 2856	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 4816 wrote to memory of 2856	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 4816 wrote to memory of 2856	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 4816 wrote to memory of 2260	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	rty25.exe
PID 4816 wrote to memory of 2260	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	rty25.exe
PID 4816 wrote to memory of 904	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	toolspub1.exe
PID 4816 wrote to memory of 904	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	toolspub1.exe
PID 4816 wrote to memory of 904	4816	976f6386a6c31fad6a4e2996306bbf3d.exe	toolspub1.exe
PID 116 wrote to memory of 4448	116	InstallSetup9.exe	BroomSetup.exe
PID 116 wrote to memory of 4448	116	InstallSetup9.exe	BroomSetup.exe
PID 116 wrote to memory of 4448	116	InstallSetup9.exe	BroomSetup.exe
PID 116 wrote to memory of 3252	116	InstallSetup9.exe	nsf58B.tmp
PID 116 wrote to memory of 3252	116	InstallSetup9.exe	nsf58B.tmp
PID 116 wrote to memory of 3252	116	InstallSetup9.exe	nsf58B.tmp
PID 4448 wrote to memory of 3460	4448	BroomSetup.exe	cmd.exe
PID 4448 wrote to memory of 3460	4448	BroomSetup.exe	cmd.exe
PID 4448 wrote to memory of 3460	4448	BroomSetup.exe	cmd.exe
PID 3460 wrote to memory of 4764	3460	cmd.exe	chcp.com
PID 3460 wrote to memory of 4764	3460	cmd.exe	chcp.com
PID 3460 wrote to memory of 4764	3460	cmd.exe	chcp.com
PID 3460 wrote to memory of 4444	3460	cmd.exe	schtasks.exe
PID 3460 wrote to memory of 4444	3460	cmd.exe	schtasks.exe
PID 3460 wrote to memory of 4444	3460	cmd.exe	schtasks.exe
PID 2856 wrote to memory of 4704	2856	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2856 wrote to memory of 4704	2856	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2856 wrote to memory of 4704	2856	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4464 wrote to memory of 4216	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4464 wrote to memory of 4216	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4464 wrote to memory of 4216	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 3496 wrote to memory of 4396	3496		96BD.exe
PID 3496 wrote to memory of 4396	3496		96BD.exe
PID 3496 wrote to memory of 4396	3496		96BD.exe
PID 4464 wrote to memory of 1860	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	cmd.exe
PID 4464 wrote to memory of 1860	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	cmd.exe
PID 1860 wrote to memory of 4352	1860	cmd.exe	netsh.exe
PID 1860 wrote to memory of 4352	1860	cmd.exe	netsh.exe
PID 4464 wrote to memory of 2132	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4464 wrote to memory of 2132	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4464 wrote to memory of 2132	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4464 wrote to memory of 1204	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4464 wrote to memory of 1204	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 4464 wrote to memory of 1204	4464	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 3496 wrote to memory of 4508	3496		C2A0.exe
PID 3496 wrote to memory of 4508	3496		C2A0.exe
PID 3496 wrote to memory of 4508	3496		C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4508 wrote to memory of 4292	4508	C2A0.exe	C2A0.exe
PID 4292 wrote to memory of 2532	4292	C2A0.exe	icacls.exe
PID 4292 wrote to memory of 2532	4292	C2A0.exe	icacls.exe
PID 4292 wrote to memory of 2532	4292	C2A0.exe	icacls.exe
PID 4292 wrote to memory of 4916	4292	C2A0.exe	C2A0.exe
PID 4292 wrote to memory of 4916	4292	C2A0.exe	C2A0.exe
PID 4292 wrote to memory of 4916	4292	C2A0.exe	C2A0.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\976f6386a6c31fad6a4e2996306bbf3d.exe
"C:\Users\Admin\AppData\Local\Temp\976f6386a6c31fad6a4e2996306bbf3d.exe"
1⤵
- DcRat
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4816

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:116

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:3460

C:\Windows\SysWOW64\chcp.com
chcp 1251
5⤵
PID:4764

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
5⤵
- DcRat
- Creates scheduled task(s)
PID:4444

C:\Users\Admin\AppData\Local\Temp\nsf58B.tmp
C:\Users\Admin\AppData\Local\Temp\nsf58B.tmp
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 2404
4⤵
- Program crash
PID:5100

C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
"C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 372
3⤵
- Program crash
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 388
3⤵
- Program crash
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 404
3⤵
- Program crash
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 680
3⤵
- Program crash
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 692
3⤵
- Program crash
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 692
3⤵
- Program crash
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 748
3⤵
- Program crash
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 756
3⤵
- Program crash
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 768
3⤵
- Program crash
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 740
3⤵
- Program crash
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 632
3⤵
- Program crash
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 748
3⤵
- Program crash
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 776
3⤵
- Program crash
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 808
3⤵
- Program crash
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 740
3⤵
- Program crash
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 644
3⤵
- Program crash
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 768
3⤵
- Program crash
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 624
3⤵
- Program crash
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 740
3⤵
- Program crash
PID:2252

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
"C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 340
4⤵
- Program crash
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 356
4⤵
- Program crash
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 360
4⤵
- Program crash
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 652
4⤵
- Program crash
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 664
4⤵
- Program crash
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 664
4⤵
- Program crash
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 720
4⤵
- Program crash
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 728
4⤵
- Program crash
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 744
4⤵
- Program crash
PID:2252

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
4⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
5⤵
- Modifies Windows Firewall
PID:4352

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 372
5⤵
- Program crash
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 388
5⤵
- Program crash
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 404
5⤵
- Program crash
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 684
5⤵
- Program crash
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 724
5⤵
- Program crash
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 724
5⤵
- Program crash
PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 724
5⤵
- Program crash
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 752
5⤵
- Program crash
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 724
5⤵
- Program crash
PID:2612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3436

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- DcRat
- Creates scheduled task(s)
PID:3720

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
5⤵
PID:4112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 820
5⤵
- Program crash
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 892
5⤵
- Program crash
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 920
5⤵
- Program crash
PID:3404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 932
5⤵
- Program crash
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 952
5⤵
- Program crash
PID:4984

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
5⤵
- Executes dropped EXE
PID:4740

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- DcRat
- Creates scheduled task(s)
PID:1932

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
5⤵
- Executes dropped EXE
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
PID:660

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
- Launches sc.exe
PID:4428

C:\Users\Admin\AppData\Local\Temp\rty25.exe
"C:\Users\Admin\AppData\Local\Temp\rty25.exe"
2⤵
- Executes dropped EXE
PID:2260

C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2856 -ip 2856
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2856 -ip 2856
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2856 -ip 2856
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2856 -ip 2856
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2856 -ip 2856
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2856 -ip 2856
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2856 -ip 2856
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2856 -ip 2856
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2856 -ip 2856
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2856 -ip 2856
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2856 -ip 2856
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2856 -ip 2856
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2856 -ip 2856
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2856 -ip 2856
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2856 -ip 2856
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2856 -ip 2856
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2856 -ip 2856
1⤵
PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2856 -ip 2856
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2856 -ip 2856
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3252 -ip 3252
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4464 -ip 4464
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4464 -ip 4464
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4464 -ip 4464
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4464 -ip 4464
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4464 -ip 4464
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4464 -ip 4464
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4464 -ip 4464
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4464 -ip 4464
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4464 -ip 4464
1⤵
PID:4816

C:\Users\Admin\AppData\Local\Temp\96BD.exe
C:\Users\Admin\AppData\Local\Temp\96BD.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4396

C:\Users\Admin\AppData\Local\Temp\C2A0.exe
C:\Users\Admin\AppData\Local\Temp\C2A0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4508

C:\Users\Admin\AppData\Local\Temp\C2A0.exe
C:\Users\Admin\AppData\Local\Temp\C2A0.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\604e615a-0a01-4f7c-8ed1-28c832a47961" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2532

C:\Users\Admin\AppData\Local\Temp\C2A0.exe
"C:\Users\Admin\AppData\Local\Temp\C2A0.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4916

C:\Users\Admin\AppData\Local\Temp\C2A0.exe
"C:\Users\Admin\AppData\Local\Temp\C2A0.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 568
5⤵
- Program crash
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1684 -ip 1684
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3956 -ip 3956
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3956 -ip 3956
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3956 -ip 3956
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3956 -ip 3956
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3956 -ip 3956
1⤵
PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3956 -ip 3956
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3956 -ip 3956
1⤵
PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3956 -ip 3956
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3956 -ip 3956
1⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\F932.exe
C:\Users\Admin\AppData\Local\Temp\F932.exe
1⤵
- Executes dropped EXE
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1092
2⤵
- Program crash
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1060
2⤵
- Program crash
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3956 -ip 3956
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3956 -ip 3956
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3956 -ip 3956
1⤵
PID:2936

C:\Users\Admin\AppData\Local\Temp\AE6.exe
C:\Users\Admin\AppData\Local\Temp\AE6.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Users\Admin\AppData\Local\Temp\119E.exe
C:\Users\Admin\AppData\Local\Temp\119E.exe
1⤵
- Enumerates VirtualBox registry keys
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
PID:4468

C:\Windows\system32\cmd.exe
"cmd" /C tasklist
2⤵
PID:4500

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:684

C:\Windows\system32\cmd.exe
"cmd" /C "dir "
2⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4704 -ip 4704
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4704 -ip 4704
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3956 -ip 3956
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3956 -ip 3956
1⤵
PID:436

C:\Users\Admin\AppData\Local\Temp\28C1.exe
C:\Users\Admin\AppData\Local\Temp\28C1.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4712

C:\Users\Admin\AppData\Local\Temp\486F.exe
C:\Users\Admin\AppData\Local\Temp\486F.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:4912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
2⤵
PID:4020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
2⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 996
3⤵
- Program crash
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
2⤵
PID:4376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
2⤵
PID:1244

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4972

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4800

C:\Users\Admin\AppData\Local\Temp\1000001001\plaza.exe
"C:\Users\Admin\AppData\Local\Temp\1000001001\plaza.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3764

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
2⤵
- Loads dropped DLL
PID:4680

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2916

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:1340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\073191680435_Desktop.zip' -CompressionLevel Optimal
4⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\1000002001\ladas.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\ladas.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1400

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:684

C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4704

C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"
4⤵
PID:2076

C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"
4⤵
PID:2916

C:\Users\Admin\AppData\Local\Temp\1000004001\RDX.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\RDX.exe"
2⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\1000005001\55555.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\55555.exe"
2⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 316
3⤵
- Program crash
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1064
3⤵
- Program crash
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1080
3⤵
- Program crash
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 656
3⤵
- Program crash
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1148
3⤵
- Program crash
PID:4840

C:\Users\Admin\AppData\Local\Temp\1000006001\1233213123213.exe
"C:\Users\Admin\AppData\Local\Temp\1000006001\1233213123213.exe"
2⤵
PID:2408

C:\Users\Admin\AppData\Local\Temp\1000007001\sadsadsadsa.exe
"C:\Users\Admin\AppData\Local\Temp\1000007001\sadsadsadsa.exe"
2⤵
PID:32

C:\Users\Admin\AppData\Local\Temp\1000008001\goldklassd.exe
"C:\Users\Admin\AppData\Local\Temp\1000008001\goldklassd.exe"
2⤵
PID:4428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4020

C:\Users\Admin\AppData\Local\Temp\1000009001\lumma1234.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\lumma1234.exe"
2⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3312 -ip 3312
1⤵
PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4144 -ip 4144
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4144 -ip 4144
1⤵
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4144 -ip 4144
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4144 -ip 4144
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4144 -ip 4144
1⤵
PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx
Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000001001\plaza.exe
Filesize
1.1MB

MD5
0749a701f3f686203e5d7b34ca80acfb

SHA1
ce00aa0b01f84e40d3d341931c3378bafbb29454

SHA256
956c464c761ef40e82e07788f2ec2bfe847b9917d7800d16d9d68cb361d3869d

SHA512
3867bd227bbf9bbb0d3bcbb81ab9b04dc0be4fff75514c7dae66b01945b398d788a7b3ae1863aa8528e4346fc31b9e61d5837c3b6b0718c17ac25bed94814044

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002001\ladas.exe
Filesize
2.2MB

MD5
0fe2b018c120446c837d7c7396c7c0e8

SHA1
b3c2bf3733e5cd01fc2cc7aea6dac95d31567d30

SHA256
af303b73a61c54da686d6250f49b0c5bc053e9dd7324b883a237a63f26a0dd86

SHA512
374340eaa437dd622e483abd96ee92243aae916f7d2a4a74685791ae1b7792395ae88b3dc92c33d7fc8b9a50bd07181bcb7acbcc650e4cc18598650c473b8e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
Filesize
1.7MB

MD5
a615f2eee64c5d7449a8792cc782b6d6

SHA1
cf1dff4fbbf172c6870c30fc3784bdbd53d49a69

SHA256
4e6015f1e7c8790a2907de407d2ea9e14ccc04e925c81607fb815bd73c372389

SHA512
9b0a2e7c7c4310300cb7f1f14d8b9ec11c7e5d6013b0bdf5c33af9e8f3de92be74ac95d83c0b637e6919f61cdffd8f7a9bf7c5411c23fcdf56b2a753a2830f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\RDX.exe
Filesize
313KB

MD5
f733785f9d088490b784d4dc5584ebfb

SHA1
6c073d4208fee7cc88a235a3759b586889b91adf

SHA256
e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59

SHA512
43589b18333b0edcd6e300577f86de685058df5533bcbfdd3e30497aa76176008125fbd28deecaca5e6132c42cc5c0a583c34497f40dbe4ea577333eaebab899

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\55555.exe
Filesize
655KB

MD5
167c40ace009f5d5cda541008804c3b3

SHA1
541bc50815f39227b9e01e5e4db6a08c02cedf4d

SHA256
620bace13215ee69bcbdf8ac237798e8ab2ff052492303e2bac32d0a5a03f44a

SHA512
60aa62eb8803bc2a8e95ea3ecadeb93e3859288d1b06a1d63451f48b10b8bbeef862c978143b419cf82d9f0fb6e1792cf82dd466f184173ca9bc8a7ffae09c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\1233213123213.exe
Filesize
2.6MB

MD5
b69036a695b48549380a64c8df3a00f1

SHA1
1f70d2f6e9b3172291fba309d60adea856af6be0

SHA256
e5c80844063be3cea01fa549f22c23723909ce5e596e2f9001b8c37099657210

SHA512
4d5c763842c556eca464cb6aceb3cb6b68ed16794f159c06f28873f32580ee977cef9e9697b92b2f3b1c1d72592f03460b53964ff5d2593a05b7f6a7aafd9cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\sadsadsadsa.exe
Filesize
313KB

MD5
5a6358bb95f251ab50b99305958a4c98

SHA1
c7efa3847114e6fa410c5b2d3056c052a69cda01

SHA256
54b5e43af21ab13e87ff59f80a62d1703f02f53db2b43ddca2bbd6b79eb953c5

SHA512
4ba31d952bffbe877a9d0d5df647e695e16166d0efe7e05e00ddb48487ab703413351a49043965d5d67ed9faca52832ed01bf9fa24d5943fd591b2d263cf05c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\goldklassd.exe
Filesize
399KB

MD5
a647afc0219638fb62a777cd2f32a4bd

SHA1
ef5ad8aaac4adcf8856a939e8d17259cccb22035

SHA256
b5e5a6adbbb37ddc7b3aa54df9bfb61c2038d887db8f44d1deb63e64fddf4436

SHA512
411a4a24aa37242276798cda5cce488165b828d9929c71891d5af926229068161796684e9f6476f8ca460d79facbc45fa8125c030c3645a3dcab7dca2ebfa044

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\lumma1234.exe
Filesize
631KB

MD5
1850ff637de86020fe977b676b5c81ca

SHA1
3e4774068a1412a979644427ed505c9a1ae72f8e

SHA256
58ace8404d8fbfca96c562f3415948073f713c799eb466627dbd9988cabd1c56

SHA512
73597991c552f44cab018b57278a416a32ee42b886bfa9b6697bb6a6040093b2ec9980b20c58b28f57939e5a80fa7850862ea7f8f8c1d556d8d3fb814c5c4d0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\119E.exe
Filesize
1.7MB

MD5
5b32fd55fe0d459269f2c09bb286cddf

SHA1
73343cbf7c655f92226cfdd5454c1440bbb720cf

SHA256
bc72ff9af642f90aed120dbd3c9c0ff0315b88f9badf6b59f55943252c7c366f

SHA512
8b3be98fe15db6d15af13a6022e9ab0613a9314d1a351b7c824bfcf174fe7836d91e517d1d9be5f573d8d0ce10f679bf937a8a9fad772697f5ae1e836409fa41

Download Submit
C:\Users\Admin\AppData\Local\Temp\28C1.exe
Filesize
2.5MB

MD5
05aef2221ea6cc47def254618a61d437

SHA1
2d9e79b680ab3e570761d337857e674280f8c64f

SHA256
9da4c067d4be2414c6dd9a7dc7ee89faa4ad19b474b55e73605c707405a71339

SHA512
ae233a76fac1d7b7d9a9fabecd1c6c1178a1a5fe6be8e6f8325f579773806c0333a9081381f63a79af1e19dfba2f4708ca0ba1db431a927c3ae3ef7aff104f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\486F.exe
Filesize
1.9MB

MD5
ecc17de55de15cc4516843d8d0aa3f9f

SHA1
6219e7ca33efd332dcb0cd8665d7019302ee7caf

SHA256
bf8699ebf5013f027ece4d5f87ca3b9278ac430d5d35a2b44dd40ec1b1afcb61

SHA512
4c33b67810f44ba56a93da7a9124b90cf86f59ccf6ee5a71ae4fb66b7fb374ba654f157b6fc1cb6e7081faade04d8360b88cd930b655413224ded6cf563e4a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\486F.exe
Filesize
2.9MB

MD5
b6b6574d3f4732654ccfb60ce86ee64f

SHA1
f3a0f83bfaf4b2c1098bd7b9ffd8c9feb70c49f4

SHA256
d2e348332e82410206d1a5b00d943b3cd7ad9d601ce1b8b1dd14db42fb651484

SHA512
f20146fbc5ef28a8410cc37311bf1e45e6bec178ffe512d3a462f965b722f05803caa0030fe03ef11c74588826caa079b68c1c0f80cc37039ae5ddd969edf92a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AE6.exe
Filesize
1.3MB

MD5
6543dfd527080cd599e8905c90903b33

SHA1
2e4acc0fa59d8fd5cf6ce164add913216a69ed01

SHA256
a58bc51e98ea724efade706eac4e09fec449312f0ba08362560d551324d179e6

SHA512
3f176226f5b2b2030769a2600566976cb9db79d2072d254e1e9dfe2d4474bcaab75d3929a9d6051cf7b4bb478d9ab292c9adb5690ca3bef63058939c60f64589

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
Filesize
640KB

MD5
0d13b2f0e75a0ffa55b688f1c6b627ca

SHA1
29330be89b4b854b6190fc600f7b386c0aece103

SHA256
03c847db446562df0a88f996c5be14f916948b7adc91036fe8ae02898bde84ca

SHA512
90d1713c6fcb24913972a8fda35b18b6e6407c8eb7c2e32019a71cdc783205db7dbc8bfa401fe9d7084b2cf301841c90445c4d72c70a11e14a30034aeadddbe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\C2A0.exe
Filesize
774KB

MD5
a775dae66ce141797fe36ee3509c6177

SHA1
b822ee79f6cdfe299c70bbb14cb96f9560edb4f6

SHA256
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf

SHA512
c94d0bfc21d4ac08b13b45aacb30a7411cf59d01139c6a5c78146cfcdafa7375b55f48be4192b331ae47a86e4a591cebe95f2a2878dc963e9160e62c9d42590f

Download Submit
C:\Users\Admin\AppData\Local\Temp\F932.exe
Filesize
5.5MB

MD5
b93a21b8150139fcd2cf5288ff1d5139

SHA1
ec8694ce461ff6eda5a438dd12e23ff2ca57866f

SHA256
5cdc5563e76016b0227a6c0627b2101ffc2c8092100b420e1ac04ccc7f92bb6f

SHA512
ded51d249e6f55db0a2a0cb70a98877754560d07eb5cfe8297de15b5fbcc54d5f5a7909959e16088742afd7495e920d8a70e1561f037d07035e01a7abb598062

Download Submit
C:\Users\Admin\AppData\Local\Temp\F932.exe
Filesize
5.6MB

MD5
618c676243b5c21a46202776e3a49f67

SHA1
ed71f13ddf8a0826e506a3277eb55c44a2344480

SHA256
48d750b761b3c12a8c19abe1aeef8eb8da5f085e12e29d08c89d8b7307917658

SHA512
4a5accb3d2bd247f21d8b7514a9132b75777563526fbfb8d9d60a9b66694f975e8ff16f193d2a1fc62a44771f471343374d50c4f51abd1ced94e82169a761b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
Filesize
832KB

MD5
8e69ace63f36fe41124f9e26ee9c6455

SHA1
7aea810409bf64cb3db4da2964fca21b399d53ce

SHA256
a9c8133056108c2a28e544f1976d397ad19eb716a2caf94bc0ceac2c197ceedb

SHA512
eecf50f5b90ea7bb4fe93cd73ae48def85b20584fad379f072150543e7f12bd87d3dd3a58f36fe0b9d8d356bc10942e2aab0969f8000538e225d0f8929456502

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
Filesize
2.0MB

MD5
b1a9afd3bc46ae4c4b74865631c601a5

SHA1
16c1f5d71c5a32eed997784dc0cc7eeee5cd9b34

SHA256
dabe25fc56340aef9cdb1841199b90fd5ed0b2854c2dfc2eac7406bacba015d2

SHA512
da40c07a1acffc9e952fa4a15de2f0aa54168a1a8f177530940fdb23b893e91db1b95a32ff53db78ee0f4174696b8aee22b4bd540aacbe11b22c0ded0b8c723b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_anakcb11.flz.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
Filesize
3.1MB

MD5
026e9695ffe87b63c1797bee49404384

SHA1
72636d587ce62486473c2e45bead9c091176ca65

SHA256
3017e5c925236ad760ce90f426c9aaf2718f944f0ab4cb488d4974c2dae26771

SHA512
1e25b094b24c078c8014201e8bbcd13d1b16abfa4d4439c29af2f273b074a893b5269f96b45901395629ff9bb0960fcdcc4124b1478931e4f3a1e80451e799a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
Filesize
896KB

MD5
9e3d41fad3a17de5dbbc62a9a31bd332

SHA1
7fa0226a7593c50e72168f7330d95c9d145bd8c1

SHA256
49114ce0154a412923c645876b8c2e749d216106a96dd1de0632976566b8643c

SHA512
3b8cc1ab2b7b0fb174e109e523ea9234af0683a562328f3af72074c4f324cb20ad429f54a84914e57f287f70556845ce67d9e7db4eff4eebb230d183896bc5c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
Filesize
1.8MB

MD5
d8bf737a36f77b912dac14f1a0aeba0f

SHA1
a9341a8b579f8d080c9d8d0c935272427960ab14

SHA256
58d25939ce3a8e7baf13b5bc0cfbd4ac7788650e6148a762f66172905b2b310c

SHA512
a1d898389c4c1ed1ae317df366ff8a3d5f75c314d3c059ec8d89f9c63db72c7e86396ef0aa1423c870aa517af73a09c16792c169b654fea2068ba04f3aa6e1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
Filesize
1.1MB

MD5
2920038060c6c297dcce3ba8cf9c53c4

SHA1
50d6658998a6ff48c9a43004d60f98702fa3187d

SHA256
f56960c7e4682a8e6dfe286f3d30e2d6e8cbb05cc7fd0274bd5f4ef2a1009e86

SHA512
0b1324082d7ebf794ab36e4259575d931e14e41120f96082d11e9621b7865c0b35327ecf41f1c58c24382e65bf6f8490740ce9e8faa01f3b27f3244aa974ae4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf58B.tmp
Filesize
287KB

MD5
8631575486d7c2fa771a0878c4a43e91

SHA1
ea4fbb4a1f2e1324815743ff75c4e2a8996a4fed

SHA256
0f929d45b2cf8bcd6a55a6fb6f8e7d61fe65b0dfbe0b27b56850644567027922

SHA512
032d5019045cdaa86c9181d71cfc34d9e6bc33facfc5d18db6a9cea28fdd4fe94427c37b19881c38dab093c849383f1c8fa05737697bf3e61338c066097d74a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqFA9D.tmp\INetC.dll
Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\rty25.exe
Filesize
640KB

MD5
57a1416ef8f3b7ef6d50ceaf9aa5007e

SHA1
c1850891459401c4a5363940ceeec77ecebbce55

SHA256
d3e4799c37a853945917238bdd8cfa76626f990e03d7db0dab216466611dc079

SHA512
5c5cc16d1f1a92feb3c1ea930687c3df8a98a2ae7606c0571fb8f2ea503cc08a4c28c8a964af2c95441ecdd6d059ba16d76e161128054726961ded4b048b5ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rty25.exe
Filesize
128KB

MD5
ce3033fe7ef081c32a5b7969dd6e3648

SHA1
8bba2a76423f38e7a30930a4c06b3840e693d069

SHA256
c9bd8d2ac6fed35669781eaea6e35eab0c77b8176ad6108236e0139d45c9d2a5

SHA512
879b00a328fb0c0a2bc33564db292fccc18a91a6c4c8e31bf4e9b7e6a8f27b94ce994d24d0a4fb250a728f8b26d8e6f9b89a2ec9ae93ff55abfeff90bbeb1988

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
Filesize
238KB

MD5
8c20d9745afb54a1b59131314c15d61c

SHA1
1975f997e2db1e487c1caf570263a6a3ba135958

SHA256
a613b6598e0d4c2e52e6ff91538aca8d92c66ef7c13a9baadcba0039570a69d1

SHA512
580021850dfc90647854dd9f8124418abffbe261e3d7f2e1d355dd3a40f31be24f1b9df77ad52f7fa63503a5ee857e270c156e5575e3a32387335018296128d7

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
109KB

MD5
2afdbe3b99a4736083066a13e4b5d11a

SHA1
4d4856cf02b3123ac16e63d4a448cdbcb1633546

SHA256
8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

SHA512
d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
1.2MB

MD5
92fbdfccf6a63acef2743631d16652a7

SHA1
971968b1378dd89d59d7f84bf92f16fc68664506

SHA256
b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

SHA512
b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat
Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe
Filesize
325KB

MD5
3058f10b2fe431d9f8a487a35cd89ba3

SHA1
adf31cfada940e96a02305177bea754d4ee41861

SHA256
73e5d1b5c0d2134f08a76a09b913efa9076bd492e509cd0346794db436c54d30

SHA512
4f59602a4f557a9947d15a1ed13d8e1b09d0ba3660130fa7e029219b21062a3dba55f7da6db0efa9f2f5ac5053dda51ed4e183ae171789374e239c4d7609eae5

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe
Filesize
313KB

MD5
5ea776e43112b097b024104d6319b6dc

SHA1
abd48a2ec2163a85fc71be96914b73f3abef994c

SHA256
cf650d13eea100a691f7f8f64674189a9c13d7948e31468963e10a23726dc341

SHA512
83667045b7da8596fad90320880d8d7c83f71a1f043d73f7b68a0ad948ae2e530a753d5c7943a096a307e696f8d9fa433025b30078af6d4530d1a2f2a4b12ed2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
5b539898b54c76c9c25eb0981a833166

SHA1
8531e7e581839432f765fae0c19481efd892c8ca

SHA256
9ad589fdbc61a011021925b4a87f2de6501e401c66799eb4d30cdbd93d083f55

SHA512
3a3d531cad24c8920953d431343baf5c0396a55c44f5150aa2f35704bf4dc124ba9584b7abc2f776267613cbb66fe6e5d394be8c46a7a8837859e23a362d21de

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
04bb8a6540653fbeeba3304323458d2b

SHA1
5d5444da2de6911e6368c8f351c5448b16e1bf1f

SHA256
8316a4156e9cfc403ce7dfc83ed4bb7354ddbb4da7a89ae6fa08bdc851b00c5d

SHA512
2e37849a4ecb3f38338190f3b30ae46f8ac46e1d631fc4074b98ae9234ad0e881cca00beda6e875f93b0befc80e41613dd5824c76040ac90a6d6a6da1502f464

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
f4906d2c90db6670f1ce2f3e23b09e49

SHA1
ce55c0ac30305c435f5c0b3f58aecc5a8196b131

SHA256
20655df2dc74610b4e245b324dd5003066aa01b557ea91044977836327d02cde

SHA512
68623f929ece53699c2d148e206babf8c7261fa001d8b32c1dd4290ee63c68aef379690016706c76a40be5b298407dd07e082dc69c2c7cf2ece1d88917a85ad6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
b85302450a88959dc320d1ea19fd522a

SHA1
561b9fe87eaca0d0e98cd8943dd49db6190ea8b4

SHA256
00d8d8a666897bb58acb8bdcea48717dce0d066bc430ecf762481b0a4035ad30

SHA512
880d4fcd1dea4624c25b569f31ff6e14a2f6d7f74073eab89336aee15adb0a18ef3ae03f97fbf769e29513ac01219f4488d5a6ce0a681cad0f26b61eb7d031c1

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
63ce2e92f65ea5de03f5ed34279be262

SHA1
a4e68d0fc25bbfb114f0a54db9547ede27010410

SHA256
03e5338636787739b31d88ae20a382a3dfe8e4eb01c88f56f0c30fff2485bd63

SHA512
ee7baf8e2e0f10682d6a8f0ee1faad0fb5defc4d6734f6d8a2cb01da4b5937b413bb75f96d776205b525f64e8e1d3ed3881f0a2b150c739e7b477131da9689df

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
9d786177258efa030e9246dea62af319

SHA1
f0e9ac0f3e511cd3c727604b753bff27a5929e74

SHA256
d27ce412607298a308906801084e836679cfd97721264d45af61696c26baac69

SHA512
4cf2814e1c268601408722030380e0b493381408841c1481d7fe8f3381e99698c168dc30b8d51b5c783a37c998d5851a89e99bf87c875989693272e3a4495e68

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/904-70-0x0000000000490000-0x000000000049B000-memory.dmp

Filesize
44KB

Download
memory/904-73-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/904-128-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/904-68-0x00000000006A0000-0x00000000007A0000-memory.dmp

Filesize
1024KB

Download
memory/1684-396-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1684-394-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1684-393-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2260-249-0x0000000002C20000-0x0000000002D4C000-memory.dmp

Filesize
1.2MB

Download
memory/2260-45-0x00007FF7AEF80000-0x00007FF7AF037000-memory.dmp

Filesize
732KB

Download
memory/2260-81-0x0000000002C20000-0x0000000002D4C000-memory.dmp

Filesize
1.2MB

Download
memory/2260-80-0x00000000029E0000-0x0000000002AEA000-memory.dmp

Filesize
1.0MB

Download
memory/2856-163-0x0000000002E50000-0x000000000373B000-memory.dmp

Filesize
8.9MB

Download
memory/2856-44-0x0000000002E50000-0x000000000373B000-memory.dmp

Filesize
8.9MB

Download
memory/2856-39-0x0000000002A50000-0x0000000002E4C000-memory.dmp

Filesize
4.0MB

Download
memory/2856-171-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2856-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2856-48-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2856-270-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2856-144-0x0000000002A50000-0x0000000002E4C000-memory.dmp

Filesize
4.0MB

Download
memory/2856-130-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3252-75-0x0000000000820000-0x0000000000920000-memory.dmp

Filesize
1024KB

Download
memory/3252-162-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/3252-86-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3252-213-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/3252-77-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/3252-76-0x00000000007B0000-0x00000000007E4000-memory.dmp

Filesize
208KB

Download
memory/3496-126-0x0000000002DF0000-0x0000000002E06000-memory.dmp

Filesize
88KB

Download
memory/3496-303-0x0000000003740000-0x0000000003756000-memory.dmp

Filesize
88KB

Download
memory/3956-458-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4216-290-0x0000000007B10000-0x0000000007BB3000-memory.dmp

Filesize
652KB

Download
memory/4216-280-0x00000000749F0000-0x0000000074D44000-memory.dmp

Filesize
3.3MB

Download
memory/4216-253-0x00000000734C0000-0x0000000073C70000-memory.dmp

Filesize
7.7MB

Download
memory/4216-254-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/4216-255-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/4216-261-0x0000000006300000-0x0000000006654000-memory.dmp

Filesize
3.3MB

Download
memory/4216-269-0x0000000006E50000-0x0000000006E9C000-memory.dmp

Filesize
304KB

Download
memory/4216-279-0x000000007FC70000-0x000000007FC80000-memory.dmp

Filesize
64KB

Download
memory/4216-271-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/4216-278-0x0000000074510000-0x000000007455C000-memory.dmp

Filesize
304KB

Download
memory/4292-385-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4292-358-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4292-351-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4292-353-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4396-313-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4448-140-0x0000000000400000-0x00000000008E2000-memory.dmp

Filesize
4.9MB

Download
memory/4448-55-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/4448-208-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/4464-291-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4464-336-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4464-250-0x0000000002A50000-0x0000000002E50000-memory.dmp

Filesize
4.0MB

Download
memory/4464-410-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4464-251-0x0000000002E50000-0x000000000373B000-memory.dmp

Filesize
8.9MB

Download
memory/4464-252-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4704-194-0x0000000006290000-0x00000000062AE000-memory.dmp

Filesize
120KB

Download
memory/4704-164-0x0000000004CB0000-0x0000000004CE6000-memory.dmp

Filesize
216KB

Download
memory/4704-185-0x0000000005DB0000-0x0000000006104000-memory.dmp

Filesize
3.3MB

Download
memory/4704-209-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/4704-174-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/4704-195-0x00000000062E0000-0x000000000632C000-memory.dmp

Filesize
304KB

Download
memory/4704-173-0x00000000052A0000-0x00000000052C2000-memory.dmp

Filesize
136KB

Download
memory/4704-172-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/4704-207-0x00000000067E0000-0x0000000006824000-memory.dmp

Filesize
272KB

Download
memory/4704-243-0x0000000072E70000-0x0000000073620000-memory.dmp

Filesize
7.7MB

Download
memory/4704-460-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/4704-462-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/4704-464-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/4704-465-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/4704-461-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/4704-466-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/4704-170-0x00000000054A0000-0x0000000005AC8000-memory.dmp

Filesize
6.2MB

Download
memory/4704-166-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/4704-165-0x0000000072E70000-0x0000000073620000-memory.dmp

Filesize
7.7MB

Download
memory/4704-175-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Filesize
408KB

Download
memory/4704-240-0x00000000079F0000-0x00000000079F8000-memory.dmp

Filesize
32KB

Download
memory/4704-239-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Filesize
104KB

Download
memory/4704-238-0x00000000079B0000-0x00000000079C4000-memory.dmp

Filesize
80KB

Download
memory/4704-237-0x0000000007990000-0x000000000799E000-memory.dmp

Filesize
56KB

Download
memory/4704-236-0x0000000007950000-0x0000000007961000-memory.dmp

Filesize
68KB

Download
memory/4704-235-0x0000000007A50000-0x0000000007AE6000-memory.dmp

Filesize
600KB

Download
memory/4704-234-0x0000000007940000-0x000000000794A000-memory.dmp

Filesize
40KB

Download
memory/4704-233-0x0000000007860000-0x0000000007903000-memory.dmp

Filesize
652KB

Download
memory/4704-232-0x0000000007800000-0x000000000781E000-memory.dmp

Filesize
120KB

Download
memory/4704-222-0x0000000071790000-0x0000000071AE4000-memory.dmp

Filesize
3.3MB

Download
memory/4704-221-0x0000000073770000-0x00000000737BC000-memory.dmp

Filesize
304KB

Download
memory/4704-220-0x0000000007820000-0x0000000007852000-memory.dmp

Filesize
200KB

Download
memory/4704-219-0x000000007F170000-0x000000007F180000-memory.dmp

Filesize
64KB

Download
memory/4704-210-0x00000000075B0000-0x0000000007626000-memory.dmp

Filesize
472KB

Download
memory/4704-212-0x0000000007650000-0x000000000766A000-memory.dmp

Filesize
104KB

Download
memory/4704-211-0x0000000007CB0000-0x000000000832A000-memory.dmp

Filesize
6.5MB

Download
memory/4816-47-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download
memory/4816-0-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download
memory/4816-1-0x0000000000980000-0x00000000010A6000-memory.dmp

Filesize
7.1MB

Download