dcrat | 5e005ae3ad498f03e3b291b80d0755505381bd7751d1261b04d9b874cd5400d3

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe
Size

233KB
MD5

36c3af072c2fcd97d5815cf8dd15027f
SHA1

36e732bc75dbb1d262c163c9b9561ac42fb0c430
SHA256

a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b
SHA512

16a6d4c39b79e9e8ffc35b5562837141ecf8c05059b626aa8d6e56e295fbcaf6c5f7d2cc4b210b2524c98c64207295b4ad3be9b56fada32a745c6e05ab55733d
SSDEEP

3072:QOwPX0z03zFWn4ZYBmb6H4IU0htFBDDwyIK0Y1aP8AXMsS518anEQwug3JB:E9FW4yH3UGtvUjq7q

Score

10^/10

dcrat djvu redline sectoprat smokeloader vidar 655507914130aa0fe72362726c206a7c exodus pub1 backdoor discovery infostealer persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.ldhy
offline_id
pIGzEr0bxHiTz7xnvNidWeqzKkxMfVdHTyCkzwt1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-hPAqznkJKD Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0849ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.7

Botnet

655507914130aa0fe72362726c206a7c

https://t.me/newagev

https://steamcommunity.com/profiles/76561199631487327

Attributes

profile_id_v2
655507914130aa0fe72362726c206a7c

Extracted

Family

redline

Botnet

Exodus

93.123.39.68:1334

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2044-132-0x00000000001C0000-0x00000000001F1000-memory.dmp	family_vidar_v7
behavioral1/memory/2308-134-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/2308-137-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/2308-138-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/2308-293-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 14 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2548-31-0x0000000001DC0000-0x0000000001EDB000-memory.dmp	family_djvu
behavioral1/memory/2588-33-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2588-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2588-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2588-81-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-91-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-92-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-108-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-109-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-113-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-115-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-116-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-149-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1072-151-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2C3.exe	family_redline
behavioral1/memory/1824-374-0x0000000000060000-0x000000000007E000-memory.dmp	family_redline
behavioral1/memory/1324-497-0x0000000000BF0000-0x0000000000C0E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2C3.exe	family_sectoprat
behavioral1/memory/1824-374-0x0000000000060000-0x000000000007E000-memory.dmp	family_sectoprat
behavioral1/memory/1824-376-0x00000000049E0000-0x0000000004A20000-memory.dmp	family_sectoprat
behavioral1/memory/1324-497-0x0000000000BF0000-0x0000000000C0E000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file
Deletes itself 1 IoCs

Processes:

pid process

1352

pid	process
1352

Executes dropped EXE 16 IoCs

Processes:

5E65.exe6D54.exe6D54.exe6D54.exe6D54.exebuild2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exeF394.exe2C3.exeasdjijjjjj.exemstsca.exemstsca.exe

pid	process
2776	5E65.exe
2548	6D54.exe
2588	6D54.exe
2612	6D54.exe
1072	6D54.exe
2044	build2.exe
2308	build2.exe
1492	build3.exe
840	build3.exe
2752	mstsca.exe
2680	mstsca.exe
2696	F394.exe
1824	2C3.exe
1324	asdjijjjjj.exe
584	mstsca.exe
688	mstsca.exe

Loads dropped DLL 21 IoCs

Processes:

6D54.exe6D54.exe6D54.exe6D54.exeWerFault.exeWerFault.exe2C3.exe

pid	process
2548	6D54.exe
2588	6D54.exe
2588	6D54.exe
2612	6D54.exe
1072	6D54.exe
1072	6D54.exe
1072	6D54.exe
1072	6D54.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2100	WerFault.exe
2176	WerFault.exe
2176	WerFault.exe
2176	WerFault.exe
2176	WerFault.exe
2176	WerFault.exe
1824	2C3.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2768 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2768	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6D54.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e2c887be-e35d-46de-881f-b898c3f411a9\\6D54.exe\" --AutoStart"	6D54.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 api.2ip.ua
24 api.2ip.ua
43 api.2ip.ua

flow	ioc
22	api.2ip.ua
24	api.2ip.ua
43	api.2ip.ua

Suspicious use of SetThreadContext 6 IoCs

Processes:

6D54.exe6D54.exebuild2.exebuild3.exemstsca.exemstsca.exe

description	pid	process	target process
PID 2548 set thread context of 2588	2548	6D54.exe	6D54.exe
PID 2612 set thread context of 1072	2612	6D54.exe	6D54.exe
PID 2044 set thread context of 2308	2044	build2.exe	build2.exe
PID 1492 set thread context of 840	1492	build3.exe	build3.exe
PID 2752 set thread context of 2680	2752	mstsca.exe	mstsca.exe
PID 584 set thread context of 688	584	mstsca.exe	mstsca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2100 2308 WerFault.exe build2.exe
2176 2696 WerFault.exe F394.exe

pid	pid_target	process	target process
2100	2308	WerFault.exe	build2.exe
2176	2696	WerFault.exe	F394.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe5E65.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5E65.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5E65.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5E65.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1740 schtasks.exe
2448 schtasks.exe

pid	process
1740	schtasks.exe
2448	schtasks.exe

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

6D54.exe6D54.exebuild2.exeasdjijjjjj.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	6D54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	6D54.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	6D54.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	asdjijjjjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	6D54.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	asdjijjjjj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	asdjijjjjj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	asdjijjjjj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	6D54.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe

pid	process
3032	a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe
3032	a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352
1352

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe5E65.exe

pid process

3032 a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe
2776 5E65.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

2C3.exeasdjijjjjj.exe

description	pid	process
Token: SeShutdownPrivilege	1352
Token: SeShutdownPrivilege	1352
Token: SeShutdownPrivilege	1352
Token: SeShutdownPrivilege	1352
Token: SeDebugPrivilege	1824	2C3.exe
Token: SeShutdownPrivilege	1352
Token: SeShutdownPrivilege	1352
Token: SeDebugPrivilege	1324	asdjijjjjj.exe
Token: SeShutdownPrivilege	1352

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1352
1352
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1352
1352

pid	process
1352
1352

pid	process
1352
1352

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6D54.exe6D54.exe6D54.exe6D54.exebuild2.exebuild3.exe

description	pid	process	target process
PID 1352 wrote to memory of 2776	1352		5E65.exe
PID 1352 wrote to memory of 2776	1352		5E65.exe
PID 1352 wrote to memory of 2776	1352		5E65.exe
PID 1352 wrote to memory of 2776	1352		5E65.exe
PID 1352 wrote to memory of 2548	1352		6D54.exe
PID 1352 wrote to memory of 2548	1352		6D54.exe
PID 1352 wrote to memory of 2548	1352		6D54.exe
PID 1352 wrote to memory of 2548	1352		6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2548 wrote to memory of 2588	2548	6D54.exe	6D54.exe
PID 2588 wrote to memory of 2768	2588	6D54.exe	icacls.exe
PID 2588 wrote to memory of 2768	2588	6D54.exe	icacls.exe
PID 2588 wrote to memory of 2768	2588	6D54.exe	icacls.exe
PID 2588 wrote to memory of 2768	2588	6D54.exe	icacls.exe
PID 2588 wrote to memory of 2612	2588	6D54.exe	6D54.exe
PID 2588 wrote to memory of 2612	2588	6D54.exe	6D54.exe
PID 2588 wrote to memory of 2612	2588	6D54.exe	6D54.exe
PID 2588 wrote to memory of 2612	2588	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 2612 wrote to memory of 1072	2612	6D54.exe	6D54.exe
PID 1072 wrote to memory of 2044	1072	6D54.exe	build2.exe
PID 1072 wrote to memory of 2044	1072	6D54.exe	build2.exe
PID 1072 wrote to memory of 2044	1072	6D54.exe	build2.exe
PID 1072 wrote to memory of 2044	1072	6D54.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 2044 wrote to memory of 2308	2044	build2.exe	build2.exe
PID 1072 wrote to memory of 1492	1072	6D54.exe	build3.exe
PID 1072 wrote to memory of 1492	1072	6D54.exe	build3.exe
PID 1072 wrote to memory of 1492	1072	6D54.exe	build3.exe
PID 1072 wrote to memory of 1492	1072	6D54.exe	build3.exe
PID 1492 wrote to memory of 840	1492	build3.exe	build3.exe
PID 1492 wrote to memory of 840	1492	build3.exe	build3.exe
PID 1492 wrote to memory of 840	1492	build3.exe	build3.exe
PID 1492 wrote to memory of 840	1492	build3.exe	build3.exe
PID 1492 wrote to memory of 840	1492	build3.exe	build3.exe
PID 1492 wrote to memory of 840	1492	build3.exe	build3.exe
PID 1492 wrote to memory of 840	1492	build3.exe	build3.exe

C:\Users\Admin\AppData\Local\Temp\a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe
"C:\Users\Admin\AppData\Local\Temp\a95bc0eeb6c005214eed09c7a26a9b148bea237838cc3544ea2070076b8e893b.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3032

C:\Users\Admin\AppData\Local\Temp\5E65.exe
C:\Users\Admin\AppData\Local\Temp\5E65.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2776

C:\Users\Admin\AppData\Local\Temp\6D54.exe
C:\Users\Admin\AppData\Local\Temp\6D54.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Local\Temp\6D54.exe
C:\Users\Admin\AppData\Local\Temp\6D54.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\e2c887be-e35d-46de-881f-b898c3f411a9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2768

C:\Users\Admin\AppData\Local\Temp\6D54.exe
"C:\Users\Admin\AppData\Local\Temp\6D54.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612

C:\Users\Admin\AppData\Local\Temp\6D54.exe
"C:\Users\Admin\AppData\Local\Temp\6D54.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build2.exe
"C:\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build2.exe
"C:\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build2.exe"
6⤵
- Executes dropped EXE
- Modifies system certificate store
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 1436
7⤵
- Loads dropped DLL
- Program crash
PID:2100

C:\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build3.exe
"C:\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build3.exe
"C:\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build3.exe"
6⤵
- Executes dropped EXE
PID:840

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\taskeng.exe
taskeng.exe {C44DF790-30D5-49C2-84C8-A07B0E0DC4BF} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]
1⤵
PID:1844

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2752

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:2680

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
4⤵
- Creates scheduled task(s)
PID:2448

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:584

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:688

C:\Users\Admin\AppData\Local\Temp\F394.exe
C:\Users\Admin\AppData\Local\Temp\F394.exe
1⤵
- Executes dropped EXE
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 96
2⤵
- Loads dropped DLL
- Program crash
PID:2176

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\FCAA.bat" "
1⤵
PID:868

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
2⤵
PID:668

C:\Users\Admin\AppData\Local\Temp\2C3.exe
C:\Users\Admin\AppData\Local\Temp\2C3.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Users\Admin\AppData\Local\Temp\asdjijjjjj.exe
"C:\Users\Admin\AppData\Local\Temp\asdjijjjjj.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1324

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
71ae54e638d90bb900e726c50e673536

SHA1
dd3f0ddc106036845e378f916bffa0837935bd1b

SHA256
469625e4977eeb3bafa8cd4ab692670bd35ea4236b7592941772b3adc915c425

SHA512
12f736e40f2139e85783ac9f2af5f506286217f3605e15a17fc89eb03517aa333f5ba1e799b0dacb31b0a3538815d5a747173f13e684d2446881fe2eabb0bff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
32d1fa54f1bb8dfa606227b30eece3b5

SHA1
5f75893629b80ffe743b9d33a6248f03d3b26f86

SHA256
938b20c4c7aa0715790b71b28dd005bbc58c65f1d7270f0f66d725f62e38974a

SHA512
ca73c30c57f7a9b171864e2ef8379b207385a9f59d80112b79817195d2cb903908069e7a3410dd62818c5ceb75110a15b8e98eba64d667c3d26273a0c116c36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b7b32ab8fb1b2d06ab9c1865240661ba

SHA1
3ff679be6d811512856a0dc1379e242f687b23c9

SHA256
d753d43f67a616549e29d445fd0bd7465206024a5b08d36c89e4d3a3d020c0a4

SHA512
3175896eb8874517b4048a1fb0dea922dc2a746bf473c20e1adf1f4ebb27cff9e6baefff612fb95819dd5b14c802ff9336c5a2189c1a2690b66caceb1cafafaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e7481925d3217439c9ed9b4e1445d947

SHA1
f5f942ed5e693a9524dd8365f1105bff415aae07

SHA256
d5b9b3467e35c286015aee8fb01962ef4782066709813ba1ecd1b75faf9f637e

SHA512
d8f48dcf343ebdc0e841bf0ed1dea248d0855a81c7ded58e28a3b999b0fb95aa33d59e66c28eb37eb9ddbd0408d900669f7ebbefca9ed5bbf95eeefd9336139d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
12f38df223e4b552d9d9f9715bbcc10d

SHA1
7a11215a615cfe1a8321fffcf9fbb7e47e07e1ec

SHA256
6224b3c223cf43768330026b847dd4f6ca0f00dcf38e3d14a35aadc05e80e3bf

SHA512
93fd3d4dffd34b9168f5bb504249aa464f34074fd61ee7c0dd3da40ce4f45a13901e55bb4de229d9e4d5a949a052688260390d4a468a0a1f566528b09a7e7d3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
00e8e525ce5d72198cbbca50cf53a70a

SHA1
3ea4465a13ddf571a78a6a9f9d76b057101c4330

SHA256
03d81dc26dd6058844d7623b78a6d6aaf91e0d46b7c8ff25cdb5ef125a011e47

SHA512
33d2851548f70803cb8b1aac29f6cd00fb5c8f305787d196b6190a15e79483f25a3b73ca5c4f7bcce24d73d659311e083918950bb4321f169a252f945a853acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\2C3.exe
Filesize
95KB

MD5
57935225dcb95b6ed9894d5d5e8b46a8

SHA1
1daf36a8db0b79be94a41d27183e4904a1340990

SHA256
79d7b0f170471f44ed6c07ddb4c4c9bb20c97235aef23ac052e692cb558a156d

SHA512
1b6362bdb7f6b177773357f5fe8e7d7ee44716fd8e63e663e446f4e204af581491d05345c12cd9cca91fd249383817da21ef2241011cdc251b7e299560ea48c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\5E65.exe
Filesize
229KB

MD5
d10ceb31dff3ca0c51709fa32cfa078e

SHA1
6c07a177d886c49d96aa47ae19a6672120592c8c

SHA256
f6ccdda55b0298c9cd9c5dedd9a929bd370e6855edbf6cb0e66b4d9af610d139

SHA512
82118dbb5fdfb5e19e2db72774d5a6e86d5a1a238eac93072ccc9ecdaa6755e6ae51082ffaa9e49aed882f95719bb41c5472149d2beff0cb43902e52c5415f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\6D54.exe
Filesize
728KB

MD5
762ba1aff6bacca1f01a4bd8c6af3258

SHA1
2a0584ca791c25b7c0ef610f4e6a84b7a967cbf5

SHA256
02164a26984198d45d80ec8a7b86b33395fa4305c2431f9320df7af7ed61a631

SHA512
742ad8520f2f7b077139056c1651c62c046805f97c7a82d82e9b0cf8c4445745ca631ee3724ad5272c0cede6818be8293f2b0c3dc1ca13e8d88c8b23a54a2333

Download Submit
C:\Users\Admin\AppData\Local\Temp\6D54.exe
Filesize
64KB

MD5
53a95ce522a5bc4a84d84695cae621dc

SHA1
7a46184f4f29cb5baa54b1aa911638e6f42f5860

SHA256
b2d6afedf57c9d5650cbd8c5e380b16acf92c31ea8c33a47405a672da0423a4a

SHA512
6781cbf17d8f0f90b9559e81bf5c2aed687e36055fe8524f9b0aee83cfb309892ea242e14d869604402b1b0bcad1de18d9852a25edefc9ac53c027a2a46adc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\F394.exe
Filesize
6.3MB

MD5
b1e8d4d7dd26612c17eccbf66b280e7c

SHA1
97dd5e81a4014fb54ef5ac3f1db88519843c85c2

SHA256
e3940372b04a4cb2177ae409c195debccfe004600d73a39d429a577d248d4cb2

SHA512
ff70dd3103128cd36bd1da3a734e635ec76d53a5629fc1f05941d6cadb9e82310da0ea298dcf449ef17c42a70ea7d787a75585ffa37a74f9007ca91a4481ecc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FCAA.bat
Filesize
77B

MD5
55cc761bf3429324e5a0095cab002113

SHA1
2cc1ef4542a4e92d4158ab3978425d517fafd16d

SHA256
d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

SHA512
33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7782.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1C9F.tmp
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1CA5.tmp
Filesize
92KB

MD5
b9858d49711b377343dad7336af34a75

SHA1
807eee110edcaf45772bf902d32adfe72d7aa7e0

SHA256
29796e50a6e69754ef1bb64d0dd9ca2e657c8de2843e06d689c0b5125c9d3ce3

SHA512
9525413e6bf14f24f2dedccac36a153ddee2d88f3ee0ce87d8ac4cd3ea63d33fa439cf28d3e155e9e7be0d0856d0b01e2813dc67e890724c4cd71714490cff5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3ECC.tmp
Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build2.exe
Filesize
332KB

MD5
a0cc1241aa4803dc23ff778af73e3768

SHA1
75d07c8f1784e8e64e7520c2666bc63c2a477ffa

SHA256
c0b12bbdcb41f6941d4356309fd8a43f61cbfd18eee044ff1771cbdbba248466

SHA512
3ccb46eca07827f5c86b31da5f7ab1b4a4b80f0cf3c1f8245c9ea57cf7c2244bc5f867a09696ce1c80cce38c631c7f6a13dca537b8e4b297735324f52cabb755

Download Submit
\Users\Admin\AppData\Local\4291c3a7-faaf-48fd-b0fb-ec09f937b78b\build3.exe
Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
\Users\Admin\AppData\Local\Temp\F394.exe
Filesize
4.1MB

MD5
97ee4f97cf79398ccc7238c4c341f27c

SHA1
3cf8d45cfadbc837ac7cfe60cee34aa058313a94

SHA256
ac7ae65a9b20bad55b4452a86d85109e118c5e46d7cd07e8b57b4d05b24cc5b3

SHA512
32bce56df6ed67d33f23dab5924e9dc26164b823cca71ab31519741bcba17a2753ef60168085005e13d80921f56daf8ceaf8afa4e1bbe5277badd295237c14ff

Download Submit
\Users\Admin\AppData\Local\Temp\F394.exe
Filesize
6.2MB

MD5
0cc6fa5721a5e1e4e2a0e818684ff1f6

SHA1
d15384ca97915047e0f165ed96b9921a9e45c169

SHA256
6707c289cf7077fc5ee759c9d3e200308c8b8485a8c9f27de0bac423e83a364f

SHA512
9acebfe3de05b7f12956cf2e64242ce6eee8d7f56815030ef1e02f65fa4f46684ca1f7fdadd422cd843e5783d386779efc060e73e2c56251a42664ede5c78497

Download Submit
memory/584-599-0x0000000000312000-0x0000000000322000-memory.dmp

Filesize
64KB

Download
memory/840-161-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/840-156-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/840-163-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1072-92-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1072-149-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1072-91-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1072-151-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1072-113-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1072-115-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1072-116-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1072-108-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1072-109-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1324-497-0x0000000000BF0000-0x0000000000C0E000-memory.dmp

Filesize
120KB

Download
memory/1324-499-0x0000000073130000-0x000000007381E000-memory.dmp

Filesize
6.9MB

Download
memory/1324-500-0x0000000000B70000-0x0000000000BB0000-memory.dmp

Filesize
256KB

Download
memory/1324-579-0x0000000073130000-0x000000007381E000-memory.dmp

Filesize
6.9MB

Download
memory/1352-4-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/1352-51-0x0000000003D30000-0x0000000003D46000-memory.dmp

Filesize
88KB

Download
memory/1492-158-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/1492-160-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download
memory/1824-375-0x0000000073130000-0x000000007381E000-memory.dmp

Filesize
6.9MB

Download
memory/1824-376-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/1824-501-0x0000000073130000-0x000000007381E000-memory.dmp

Filesize
6.9MB

Download
memory/1824-374-0x0000000000060000-0x000000000007E000-memory.dmp

Filesize
120KB

Download
memory/2044-132-0x00000000001C0000-0x00000000001F1000-memory.dmp

Filesize
196KB

Download
memory/2044-130-0x00000000002E0000-0x00000000003E0000-memory.dmp

Filesize
1024KB

Download
memory/2308-138-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2308-137-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2308-134-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2308-131-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2308-293-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2548-36-0x00000000004D0000-0x0000000000562000-memory.dmp

Filesize
584KB

Download
memory/2548-26-0x00000000004D0000-0x0000000000562000-memory.dmp

Filesize
584KB

Download
memory/2548-27-0x00000000004D0000-0x0000000000562000-memory.dmp

Filesize
584KB

Download
memory/2548-31-0x0000000001DC0000-0x0000000001EDB000-memory.dmp

Filesize
1.1MB

Download
memory/2588-81-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2588-38-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2588-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-33-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2588-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2612-83-0x0000000000540000-0x00000000005D2000-memory.dmp

Filesize
584KB

Download
memory/2612-86-0x0000000000540000-0x00000000005D2000-memory.dmp

Filesize
584KB

Download
memory/2696-498-0x0000000000E30000-0x0000000001C5B000-memory.dmp

Filesize
14.2MB

Download
memory/2696-354-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2696-316-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2696-317-0x0000000000E30000-0x0000000001C5B000-memory.dmp

Filesize
14.2MB

Download
memory/2696-314-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2696-327-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2696-320-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2696-322-0x0000000077750000-0x0000000077751000-memory.dmp

Filesize
4KB

Download
memory/2696-321-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2696-326-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2696-324-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2752-304-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/2776-52-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2776-19-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2776-18-0x0000000000540000-0x0000000000640000-memory.dmp

Filesize
1024KB

Download
memory/3032-1-0x00000000005A0000-0x00000000006A0000-memory.dmp

Filesize
1024KB

Download
memory/3032-5-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3032-2-0x0000000000220000-0x000000000022B000-memory.dmp

Filesize
44KB

Download
memory/3032-3-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download