dcrat | 66cab13aed3126ab1755e139bf5c2a9c7782dfd36ebeb7078045b5ec107dc4a3

Analysis

max time kernel
57s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74b0cc79808464e9946c8fb16d430173.exe
Size 253KB
Sample240224-23dlyshc4w
SHA256 66cab13aed3126ab1755e139bf5c2a9c7782dfd36ebeb7078045b5ec107dc4a3
MD5 74b0cc79808464e9946c8fb16d430173
SHA1 1de066f1a9196d57221970199e814b6f1bc81465
SHA512 dddd2b0aab694a236beaaa36d34e344c239e8d4e776c0b80b96d26188cc9051fb78dcbb2a20f6fd780601774827b3906621d437d9c457d38a2af338d80bb9c6c
SSDEEP 3072:ylObaRVtZ5HNtWb1eikps2axEZ40kYT6rWwFdyXMnC5zuSzuATz:kO2tZhNtutkp5Z40kG6rWwSLkAT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat glupteba lumma smokeloader stealc systembc pub1 backdoor bootkit discovery dropper evasion infostealer loader persistence rat stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://kamsmad.com/tmp/index.php
http://souzhensil.ru/tmp/index.php
http://teplokub.com.ua/tmp/index.php

rc4.i32

Extracted

Family

systembc

173.44.141.149:4001
153.92.222.162:4001

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

http://185.172.128.145

Attributes

url_path
/3cd2b41cbde8fc9c.php

Extracted

Family

lumma

https://resergvearyinitiani.shop/api
https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 3 IoCs

resource	yara_rule
behavioral2/memory/1312-243-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1312-245-0x0000000002E60000-0x000000000374B000-memory.dmp	family_glupteba
behavioral2/memory/1312-246-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
880	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
3408	Process not Found

Executes dropped EXE 16 IoCs

pid	Process
4892	B120.exe
4404	B120.exe
2396	DF75.exe
3336	E3CC.exe
3676	F561.exe
4940	40.exe
1312	288c47bbc1871b439df19ff4df68f076.exe
3204	7D2.exe
2540	InstallSetup4.exe
4324	BAB.exe
2980	7D2.tmp
388	FourthX.exe
2236	BroomSetup.exe
3784	trafaret.exe
4424	trafaret.exe
3664	nsw220C.tmp

Loads dropped DLL 8 IoCs

pid	Process
4404	B120.exe
4116	regsvr32.exe
3680	regsvr32.exe
2980	7D2.tmp
2980	7D2.tmp
2980	7D2.tmp
2540	InstallSetup4.exe
2540	InstallSetup4.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4404-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-21-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-22-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-23-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-27-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-236-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-238-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/4404-268-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	B120.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
98	pastebin.com
99	pastebin.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	E3CC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4892 set thread context of 4404	4892	B120.exe	91

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3676	sc.exe
312	sc.exe
392	sc.exe
1116	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1788	4324	WerFault.exe	109
3232	1312	WerFault.exe	102
3044	3664	WerFault.exe	112

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	40.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	40.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	40.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	74b0cc79808464e9946c8fb16d430173.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	74b0cc79808464e9946c8fb16d430173.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	74b0cc79808464e9946c8fb16d430173.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4792	74b0cc79808464e9946c8fb16d430173.exe
4792	74b0cc79808464e9946c8fb16d430173.exe
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found
3408	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4792	74b0cc79808464e9946c8fb16d430173.exe
4940	40.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found
Token: SeShutdownPrivilege	3408	Process not Found
Token: SeCreatePagefilePrivilege	3408	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	7D2.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2236	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4892	3408	Process not Found	90
PID 3408 wrote to memory of 4892	3408	Process not Found	90
PID 3408 wrote to memory of 4892	3408	Process not Found	90
PID 4892 wrote to memory of 4404	4892	B120.exe	91
PID 4892 wrote to memory of 4404	4892	B120.exe	91
PID 4892 wrote to memory of 4404	4892	B120.exe	91
PID 4892 wrote to memory of 4404	4892	B120.exe	91
PID 4892 wrote to memory of 4404	4892	B120.exe	91
PID 4892 wrote to memory of 4404	4892	B120.exe	91
PID 4892 wrote to memory of 4404	4892	B120.exe	91
PID 4892 wrote to memory of 4404	4892	B120.exe	91
PID 3408 wrote to memory of 4472	3408	Process not Found	92
PID 3408 wrote to memory of 4472	3408	Process not Found	92
PID 4472 wrote to memory of 4116	4472	regsvr32.exe	93
PID 4472 wrote to memory of 4116	4472	regsvr32.exe	93
PID 4472 wrote to memory of 4116	4472	regsvr32.exe	93
PID 3408 wrote to memory of 2396	3408	Process not Found	96
PID 3408 wrote to memory of 2396	3408	Process not Found	96
PID 3408 wrote to memory of 2396	3408	Process not Found	96
PID 3408 wrote to memory of 2636	3408	Process not Found	97
PID 3408 wrote to memory of 2636	3408	Process not Found	97
PID 2636 wrote to memory of 3680	2636	regsvr32.exe	98
PID 2636 wrote to memory of 3680	2636	regsvr32.exe	98
PID 2636 wrote to memory of 3680	2636	regsvr32.exe	98
PID 3408 wrote to memory of 3336	3408	Process not Found	99
PID 3408 wrote to memory of 3336	3408	Process not Found	99
PID 3408 wrote to memory of 3336	3408	Process not Found	99
PID 3408 wrote to memory of 3676	3408	Process not Found	100
PID 3408 wrote to memory of 3676	3408	Process not Found	100
PID 3408 wrote to memory of 3676	3408	Process not Found	100
PID 3408 wrote to memory of 4940	3408	Process not Found	101
PID 3408 wrote to memory of 4940	3408	Process not Found	101
PID 3408 wrote to memory of 4940	3408	Process not Found	101
PID 3676 wrote to memory of 1312	3676	sc.exe	102
PID 3676 wrote to memory of 1312	3676	sc.exe	102
PID 3676 wrote to memory of 1312	3676	sc.exe	102
PID 3408 wrote to memory of 3204	3408	Process not Found	111
PID 3408 wrote to memory of 3204	3408	Process not Found	111
PID 3408 wrote to memory of 3204	3408	Process not Found	111
PID 3676 wrote to memory of 2540	3676	sc.exe	103
PID 3676 wrote to memory of 2540	3676	sc.exe	103
PID 3676 wrote to memory of 2540	3676	sc.exe	103
PID 3408 wrote to memory of 4324	3408	Process not Found	109
PID 3408 wrote to memory of 4324	3408	Process not Found	109
PID 3408 wrote to memory of 4324	3408	Process not Found	109
PID 3204 wrote to memory of 2980	3204	7D2.exe	104
PID 3204 wrote to memory of 2980	3204	7D2.exe	104
PID 3204 wrote to memory of 2980	3204	7D2.exe	104
PID 3676 wrote to memory of 388	3676	sc.exe	108
PID 3676 wrote to memory of 388	3676	sc.exe	108
PID 2540 wrote to memory of 2236	2540	InstallSetup4.exe	106
PID 2540 wrote to memory of 2236	2540	InstallSetup4.exe	106
PID 2540 wrote to memory of 2236	2540	InstallSetup4.exe	106
PID 2980 wrote to memory of 3784	2980	7D2.tmp	105
PID 2980 wrote to memory of 3784	2980	7D2.tmp	105
PID 2980 wrote to memory of 3784	2980	7D2.tmp	105
PID 2980 wrote to memory of 4424	2980	7D2.tmp	107
PID 2980 wrote to memory of 4424	2980	7D2.tmp	107
PID 2980 wrote to memory of 4424	2980	7D2.tmp	107
PID 2540 wrote to memory of 3664	2540	InstallSetup4.exe	112
PID 2540 wrote to memory of 3664	2540	InstallSetup4.exe	112
PID 2540 wrote to memory of 3664	2540	InstallSetup4.exe	112
PID 2236 wrote to memory of 384	2236	BroomSetup.exe	113
PID 2236 wrote to memory of 384	2236	BroomSetup.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\74b0cc79808464e9946c8fb16d430173.exe
"C:\Users\Admin\AppData\Local\Temp\74b0cc79808464e9946c8fb16d430173.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4792

C:\Users\Admin\AppData\Local\Temp\B120.exe
C:\Users\Admin\AppData\Local\Temp\B120.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\B120.exe
  C:\Users\Admin\AppData\Local\Temp\B120.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:4404

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\B74B.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\B74B.dll
  2⤵
  - Loads dropped DLL
  PID:4116

C:\Users\Admin\AppData\Local\Temp\DF75.exe
C:\Users\Admin\AppData\Local\Temp\DF75.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E17A.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\E17A.dll
  2⤵
  - Loads dropped DLL
  PID:3680

C:\Users\Admin\AppData\Local\Temp\E3CC.exe
C:\Users\Admin\AppData\Local\Temp\E3CC.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:3336

C:\Users\Admin\AppData\Local\Temp\F561.exe
C:\Users\Admin\AppData\Local\Temp\F561.exe
1⤵
- Executes dropped EXE
PID:3676
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  - Executes dropped EXE
  PID:1312
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    PID:3356
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:1372
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:880
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:772
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 632
    3⤵
    - Program crash
    PID:3232
- C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      PID:384
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:1720
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:3216
- - C:\Users\Admin\AppData\Local\Temp\nsw220C.tmp
    C:\Users\Admin\AppData\Local\Temp\nsw220C.tmp
    3⤵
    - Executes dropped EXE
    PID:3664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 2028
      4⤵
      Program crash
      PID:3044
- C:\Users\Admin\AppData\Local\Temp\FourthX.exe
  "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
  2⤵
  - Executes dropped EXE
  PID:388
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4444
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:2480
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "UTIXDCVF"
    3⤵
    - Launches sc.exe
    PID:392
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1116
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "UTIXDCVF"
    3⤵
    - Launches sc.exe
    - Suspicious use of WriteProcessMemory
    PID:3676
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:312

C:\Users\Admin\AppData\Local\Temp\40.exe
C:\Users\Admin\AppData\Local\Temp\40.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4940

C:\Users\Admin\AppData\Local\Temp\is-4IM6T.tmp\7D2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4IM6T.tmp\7D2.tmp" /SL5="$40212,4323177,54272,C:\Users\Admin\AppData\Local\Temp\7D2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Trafaret\trafaret.exe
  "C:\Users\Admin\AppData\Local\Trafaret\trafaret.exe" -i
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Users\Admin\AppData\Local\Trafaret\trafaret.exe
  "C:\Users\Admin\AppData\Local\Trafaret\trafaret.exe" -s
  2⤵
  - Executes dropped EXE
  PID:4424

C:\Users\Admin\AppData\Local\Temp\BAB.exe
C:\Users\Admin\AppData\Local\Temp\BAB.exe
1⤵
- Executes dropped EXE
PID:4324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 540
  2⤵
  - Program crash
  PID:1788

C:\Users\Admin\AppData\Local\Temp\7D2.exe
C:\Users\Admin\AppData\Local\Temp\7D2.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4324 -ip 4324
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1312 -ip 1312
1⤵
PID:3632

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
1⤵
PID:2448
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:5092
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2668
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4180
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3664 -ip 3664
1⤵
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 1024KB
SHA256 7fd2d86e40a224c67a783dfc6353ce20c559fe4cb6a899b2875c0ec8d97d0f41
MD5 3e0c5d0dfe8abc71d8609b02dba39169
SHA1 038e1207a7dd0c13f64204d9466fbafa8fbc08cb
SHA512 cb58530108a7fd9b0e4db1814c3e1cd775daa3251aa3f6cf4015f3cdcfba09768273b3fae6f64b0ee6719d8fd17122910d3821aa938b161a5954371ecc1c625b
SSDEEP 24576:fEggtwf12gyTkHlnKGxJHxIB+y5GNIvxnnt7rczxISEYak3HFOsWYrVvE4C5mxVi:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3y
MD5 SHA1 SHA512 SSDEEP

Submit Download

vueqjgslwynd.exe

Path C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
Size 2.5MB
SHA256 5dfaa8987f5d0476b835140d8a24fb1d9402e390bbe92b8565da09581bd895fc
MD5 b03886cb64c04b828b6ec1b2487df4a4
SHA1 a7b9a99950429611931664950932f0e5525294a4
SHA512 21d1a5a4a218411c2ec29c9ca34ce321f6514e7ca3891eded8c3274aeb230051661a86eda373b9a006554e067de89d816aa1fa864acf0934bbb16a6034930659
SSDEEP 49152:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2egUmFbcP9ovzmiPKkv/m63KEll25OcXoZ:iVkYYXc4FUoNeIo2eaZdScKS/mQ/K6
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 2.9MB
SHA256 bfb78f4db4c0cb79d02ab32e5d511f36d13626648106577f1a5f2b6ab885f385
MD5 55f69e2a01fee0155539f9ad5dadd92a
SHA1 a0be37eaa670f61da45825f98a4559de58d963b3
SHA512 24b67d666d0337b00721ba2366dabf47b3ff65676637cf9bada37bf85d60b639293de93b9c2cb66bcd7b49f86c23e3197c7746dd0a8c403841c64a1d58fa1a70
SSDEEP 49152:Ox3YeaCYntkzvlJT+5G4zfKMSLtAcwjZ0wl0ADmLAGFnwWEr6CfJ8ezdHeEhFgxZ:Ox34CiKzvjm7SLtMZTm7LASnwWEuCSes
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 512KB
SHA256 7192a1241a20e08be3b1746bb93b5e2638e1beb748736c4d30c12d6b7d47a287
MD5 92f9cb175991f582b8dfd0c5e3996110
SHA1 062df1e5e55706f4a99ab275a0e5ffc227356296
SHA512 4637a6faba71dd4a2f69c9acb77a64665e748d17d6933b7dd1be3db2eb862adc08a34415651ae0f93c37ad110322c0cb89f304f8310f704ef344b916ceb8b554
SSDEEP 12288:OBug153YaazK+0Hoqilq4t1+VEjCT9yXXZ6ikfmJC33d44vNgg:OBF53YaYKBgtdCZyXXZ6ikuozvh
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 4.1MB
SHA256 b7a6dcfdd64173ecbcef562fd74aee07f3639fa863bd5740c7e72ddc0592b4fc
MD5 d122f827c4fc73f9a06d7f6f2d08cd95
SHA1 cd1d1dc2c79c0ee394b72efc264cfd54d96e1ee5
SHA512 8755979d7383d6cb5e7d63798c9ca8b9c0faeec1fe81907fc75bbbb7be6754ab7b5a09a98492a27f90e3f26951b6891c43d8acd21414fb603cd86a4e10dac986
SSDEEP 98304:Ox34CiKzvjm7SLtMZTm7LASnwWEuCSeZHe31O6Y/qHYq9Pei:OB4yzvjmEtMf+wT3Us6Y/qHYKB
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 384KB
SHA256 98ddd0a4e39f3693a0bdda3844934a3211e119eee2d5155e17778b0af18e6b89
MD5 dd76b1ea2a8bf2f7e800e0a11f01f5e9
SHA1 d31c1ff5b3bfff45af20f5fce0579b80819c5390
SHA512 2b3118524ede04678a6306af55dff202a5dbd1a5443bd815dc6a7e3122518ca3593841b942b46b04c3053e553cf20c8baca39461f27cc7fe5d293e26050b2508
SSDEEP 6144:OBuL01qE3YanazKZcolQqfAzu/c/l0x4t4Cuk+VGvjCT9/KcYXZ6i+/fIMM02BM0:OBug153YaazK+0Hoqilq4t1+VEjCT9y5
MD5 SHA1 SHA512 SSDEEP

Submit Download

40.exe

Path C:\Users\Admin\AppData\Local\Temp\40.exe
Size 253KB
SHA256 ad3a5d32351e9b26a5206751e45f27bf4def2890008e573dce58c4e9791fdcce
MD5 3893d9674f9791363d8f92edae4427a7
SHA1 93603d9de7c259c8437f320f032ba171be67e200
SHA512 9918357b96ea5af2ec3f056c0d7c41a025558fba88d6ada2ade153dc5b944670acdcc0e1abc76e52d9a9186abd15345519802f605473bf4fb59c81f972a3a6d6
SSDEEP 3072:UFKWB5ZLbdI4cene2oHt7Z59hDyF8XMk5Oa8+Tz:snZfmwXoN9W4MP+T
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Size 320KB
SHA256 dc9828329efa21469ed67f1cebb241bc4f673c79a9b129d437f70365358f7e0a
MD5 78c2dd9d76aaadab3c58756b29407cd3
SHA1 6b35ad15cc56439ae725fef243229b76dfe34617
SHA512 3098287ded03662d427cbcd382a48329f5e86bad9562742ac9803348b28feba0ac18563b2d4aaec2cd7e97f53305a1b1550ac6bdad1aba784c176046941de6f5
SSDEEP 6144:8I36JtQaF3voMizeGC5YG6R7WBJfTTsx6JxY4oAyCtB8VyWTNY0Xqkyx8zv0yka4:E2EOVJyB
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Size 1.1MB
SHA256 8c1ce8f4657f6bf76090dfeb806a6cb5d942dfe08fc34199a3955de8650b690e
MD5 e550698fcd6a15fd3b8ae02b55df6527
SHA1 750f70a96bb02623d31e0d195527145bc9a74d20
SHA512 a9d4689b30e0ed5faa165bf548e3eb863a65315116915458d7d1fc9f4549dd339fb0f1641393d4a7c36824a86b83a736e4846b63e9133e37cf35f82e68b7fa6f
SSDEEP 12288:R2dR6Iu0LUXdAfcaXWPx/MBy6eKE8TXffrU9bavC/:R2yIu/bPt2E8TXgoY
MD5 SHA1 SHA512 SSDEEP

Submit Download

7D2.exe

Path C:\Users\Admin\AppData\Local\Temp\7D2.exe
Size 1.1MB
SHA256 0e2ef54e60316f6bd07f8b5b6dd76ff6a740da3e6c4f9635bdc197af99fa90f7
MD5 d3f3e2554ddfbfb0226b28aaedfcbe88
SHA1 7c412497815499abab24b1f82bf5df8dabb0efe3
SHA512 755e15521b6ca03b36b77be1bbd92b3893bbed05b37207fc1c66876a5ee3ddcce8e7aff71f111885a56e10d88cc133e0be1adc26702c38a8554b36892d403b93
SSDEEP 24576:1QFf3k1stZibzQ11XAAC11MKcAFPhxnWJkYh:1qvk1stZiyk11jR5xur
MD5 SHA1 SHA512 SSDEEP

Submit Download

7D2.exe

Path C:\Users\Admin\AppData\Local\Temp\7D2.exe
Size 1.3MB
SHA256 bfeff8e7d15530541e645f399bb1671e5fc0f615bf8521fc0da435ca54db6b43
MD5 69a7ac89cbdfc28a4869bc5ecb347270
SHA1 b05d9e1e40dff7e246df58b577014944bee2c92a
SHA512 97d5af5695555c8e1862bcb3e3f1658a718c693f761242eb38fa21d1a1d3195abc3084406042b6426bb31b9f83241c3e894b35f044c35601e668dcbf4bae2f66
SSDEEP 24576:1QFf3k1stZibzQ11XAAC11MKcAFPhxnWJkYOCwQo86:1qvk1stZiyk11jR5xuRFoR
MD5 SHA1 SHA512 SSDEEP

Submit Download

B120.exe

Path C:\Users\Admin\AppData\Local\Temp\B120.exe
Size 1.8MB
SHA256 40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990
MD5 147f5f5bbc80b2ad753993e15f3f32c2
SHA1 16d73b4abeef12cf76414338901eb7bbef46775f
SHA512 9c43aaa68161ef04c60e3f64c3fd54426dfd387f0013f009f3da94d45f19e514cd41de7b95865c47f55e5800222fd74736659138bb96406aa37f9cdc8e5799b6
SSDEEP 49152:L0F7w+ANy7moCOmY9x5VlLdf0w26/biK:IaXsCc9nmwfOK
MD5 SHA1 SHA512 SSDEEP

Submit Download

B74B.dll

Path C:\Users\Admin\AppData\Local\Temp\B74B.dll
Size 2.0MB
SHA256 19a75f92a288042be52f1d38976909a22f81e92d22b69b6ab2f1f4d5856448db
MD5 b66379323022a073f1f7cdefed747401
SHA1 14cfd615676b85960154df8273ca841f4a0e268b
SHA512 94b8dbe483f2f624723b831186bfcabc52eb74b8293f7acc4e3152ccdaef86885e2fb89453b91a78493795c99edc96e47dbbd489f92aec4cb30c21c064eb052b
SSDEEP 49152:NdcYdN7GedN6VbgpscKqgvDPGFeSNxHQaegyUPd5ZZwtL+jzAkmsb:ncYXGyyeeDPueOegyUJOL+/Ak9
MD5 SHA1 SHA512 SSDEEP

Submit Download

B74B.dll

Path C:\Users\Admin\AppData\Local\Temp\B74B.dll
Size 448KB
SHA256 3d16f44dd0fcc70bd3daf84172fa16b0e9e5d14790757ed29cc98aa6ba711ec4
MD5 08c25f269f3c950c0fac841b5b237a71
SHA1 cb9d0e4921237a88b4c4508cd89d0480f5cb4120
SHA512 d37af4bc961ab22255d17d8ac11c3c6f6ff2d4acec61e8e5d43ae7c9dbf740ef6ae009192dee77c542674214b01de5074927308cbede056aefc218a421a25bf2
SSDEEP 12288:vSkdj4Y4Quy70t7qLKSyAv78CsrMh49/0cb+TpTI:vSkdj4YdN70tiKe8CsrMhQ/VbgpTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

B74B.dll

Path C:\Users\Admin\AppData\Local\Temp\B74B.dll
Size 1.2MB
SHA256 fb437d481a86f83aded37283e9fb737590de84575f99ab9f11077ba3efde30fc
MD5 eeb0217ec25c6ce08c958dce0c633bf7
SHA1 2be80d08a85b06b96dc3b639d48f7960039daae1
SHA512 f1cc6e1ad4b95faf1b86366e0338a5e29136588cc79abfb0bb02577a2a436719305b633b69acead5d4e71cd76e5a5adac333ca7f36241da6b8639b68fd9af6f3
SSDEEP 24576:vSkdj4YdN70tiKe8CsrMhQ/VbgpTgjwtikytqk1j5vml8PGuutvEZwNxlBf+laev:NdcYdN7GedN6VbgpscKqgvDPGFeSNxHk
MD5 SHA1 SHA512 SSDEEP

Submit Download

BAB.exe

Path C:\Users\Admin\AppData\Local\Temp\BAB.exe
Size 128KB
SHA256 c8fc9768f9045b6cab7a18ef570d328362dfba04b31dec4c75b169d992215ff6
MD5 a31328e6b465a963c2b205c482aedf25
SHA1 d1013c617f538e22c9013169fee642e98d830700
SHA512 a522fb6091d0bd1b61f9006903b6e355c9a11afbf3d6dfe10c0b417cc17974c9b88fd20b024d60c771a6829597190a4ea519ef8d5afbc5654b10f2fc673029a5
SSDEEP 3072:eZLzofJRattWPAW6cGWkdyD1mDGOPjy/1x8qJfkufk:szofJR5ArcAdyyjy/zrJ8ck
MD5 SHA1 SHA512 SSDEEP

Submit Download

BroomSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
Size 512KB
SHA256 43c38487ff04337871c72bad167ab8c68c826653e393f17c08f02cea2d0c97fb
MD5 049799b5d329a8d716c6dfc79971a946
SHA1 ec26cd66f8cea16c363f54982b53cad9faf3c9c4
SHA512 b5ba4e952389d4fc88cf988174cc7da2a390d34236b540e0463fed4f3b7478ca4aff254cd43094c981e8070b00640cd2c7287d0e9b6bff05bdb3ec7e5d988286
SSDEEP 6144:PRzUaw/edhb3p/uL5kMhrYAg4yQmbEouf0k1z0K36czmYsLjbVpKigUo:PFTw/eTb3pq5kMx129uf1gVt5eUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DF75.exe

Path C:\Users\Admin\AppData\Local\Temp\DF75.exe
Size 1.5MB
SHA256 d76d2453adcc20616345d80520e4cbd27b3f2a25787f09c18d2a2723e3602d6e
MD5 fc60b4d7d4925c9ac91c70e04f6872c4
SHA1 f837befd4be93c2473f72e9d9dc029ec21c64575
SHA512 ec17de36eaa5c82e69f8a58a374bdabc93d35cb005c7392282badf72d1535c9fb07ee7f1b838e5131111b2e887dd4996cafabb5da15051fea3a3cd65d49d6c96
SSDEEP 24576:YvVHCm9Rp28clpwvjkiwB9xQRdGOFb7yTbQwPlNy7ZzU6lReKcSlumAy:YNnE8+eNqKzGMXwPlOzrcmumAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

DF75.exe

Path C:\Users\Admin\AppData\Local\Temp\DF75.exe
Size 551KB
SHA256 4f71ff56501d019d2a383e5eebede67e02a4ab8bb87bea3959376c197576b35c
MD5 ad1b34de6041bef57f14f4fa65aeb45d
SHA1 3570feac80aa0fa41ccf05a971106d04a1f9ed87
SHA512 23e902c0b95587b12057439faf6426d6ffd3da9b410af078fca26e0c2a80e10b1022a758c0b0c957cc76e71d037afb0a3492d9b8e99802bfe199f70fda832fd5
SSDEEP 12288:3ovVZQGCm9CKpBD28c8wBt1BI39vC7AOJQxgXMlwB9n0nb1IQCT:YvVHCm9Rp28clpwvjkiwB9xQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

E17A.dll

Path C:\Users\Admin\AppData\Local\Temp\E17A.dll
Size 16KB
SHA256 7eb6fefdb0399a3418a6c375f436e1a4ce52f5c783baa7c5dc92b3921e3fd91e
MD5 3db26170aa5c06b54c8d60374f59251f
SHA1 648204dc24082ffa498f5627e917f6f64f306730
SHA512 4cc44e8bae2b6e8a85ab04e5b0aa5a2d214233dbcc327994b609b87457659aaa0d2534851508541b4658bd887b2947d15e7e0f9832cdd9460331f821f653e0bb
SSDEEP 192:RniGhkfGBpFH+Z0hZ1WW8B52daFX4/PqfZSCG0GGGdWoBrSKja1cnHs:Y/fAeZ0hZwW42doxR3gWoBrtW1c
MD5 SHA1 SHA512 SSDEEP

Submit Download

E3CC.exe

Path C:\Users\Admin\AppData\Local\Temp\E3CC.exe
Size 560KB
SHA256 11243641663323721ba21494a394de70ae70d4ea23c23f2e2a397fcc3cfea1a7
MD5 e6dd149f484e5dd78f545b026f4a1691
SHA1 3ea5d0fb2de5bfad3dc6dc1744708ccd31102df6
SHA512 0defb358d59221c56731745a25250dfea49ecbb411f11f31a92ec20fa2123646f4aaf9fd4999898c39e4674f616bc1bed7ef2368b61a29d595dc7b9340dd058b
SSDEEP 12288:wr7T2LrJ8czIXmTukXuiZflcPSAJNoeKj:wr7T2LF86TbuAlcqAJJKj
MD5 SHA1 SHA512 SSDEEP

Submit Download

F561.exe

Path C:\Users\Admin\AppData\Local\Temp\F561.exe
Size 448KB
SHA256 e1f71b18c757b1156bf5dbd38350e5ce2e2b88e8c9eefa205272636648ecc0e3
MD5 9c9a5b75c76f56fd0bc79d628b17309a
SHA1 cc342c2aaa7e8a2915b27607e6ee4316d0f6d9f0
SHA512 dd6e9cedf1a0ba8312d1918bda9af0b9501414970a943b66a1562b843d5e6cc0a8e2abad8090e918e8f1b146018d49364cc4588c0866e500c4edf30be19509b8
SSDEEP 12288:zjCBYON4iZHAiruYu4vMmTrn0gwoktaJU7hmenXY+cFOeyIu:wlLWiruYu4vMmTr0paJU9xnzzeyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

F561.exe

Path C:\Users\Admin\AppData\Local\Temp\F561.exe
Size 768KB
SHA256 cde4d1fb53812f82a6ae30d9fe315b2a27fd77900f27c9ed3a6b49c21e51b330
MD5 891b0ecba023c942258e77f219e08e47
SHA1 b6902ef9eef4c4822532c059656e67606090d1f9
SHA512 90867d45c751c0c0c685b980cc772a8cbe4a88378bc5cfe5187ce23e38005c102d5dfb95ec8fb63557caf9c0b2ac8c07320baf39159cde85f2f20c273ae1c0df
SSDEEP 12288:zjCBYON4iZHAiruYu4vMmTrn0gwoktaJU7hmenXY+cFOeyI2Wrf3iYyGAUDAeqvz:wlLWiruYu4vMmTr0paJU9xnzzeySr9Jo
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 768KB
SHA256 170a9e9bf03a35b9d62cc43bcd485ca87482e0dab5ce1a6eaa1a38c0f73425da
MD5 e57b67d14aa175312da3f5a69294668e
SHA1 01618135f1a7177023c59fd8d1fed58e03c59945
SHA512 0fdcc9b5a2018c67c2cb7019e8684f9f44d5af83d36cde827d38c1fc35def799af6a056d0bf023a6f164f7b87a281cb7816c433221e3068357e7d65e96b4f299
SSDEEP 12288:iTiyWCTPivNQjI45+wPlKxQPQKxZ0bA4kb0vkUowAhUxCyPg8BCFOFbTdd2tX85C:iT6UqvN4F5+wKxkQiKAlb0SCCWgYXL5C
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 1.9MB
SHA256 4cfc04acddae5f5f2867e218cef35f327361af9c157267abbf9ef431af361f4d
MD5 d7e4b9b1c47a1c5e43e40c56157a147f
SHA1 3d1afa4a1377bd808054add241e150c375a539a3
SHA512 f07d7d22b92e61ea196f2c913ba4c6501b7f2acf1570baa7c748717325f67dc219d7a3f92405c06f8f157f0cff5cddcfa39e6a6e828fab565d57356cb567582d
SSDEEP 49152:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2egUmFbcP9ovzmiPKkv/mD:iVkYYXc4FUoNeIo2eaZdScKS/mD
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 1.8MB
SHA256 107f6e6bf02253e4453b28539faa31bbcdd8c7048373fd3678aeec3e4faf2e5c
MD5 93df53829d7ff15b36cca0997bdf9523
SHA1 85961b7b321c9492e276ada800debaa55c9c1d59
SHA512 37edf278c32461498cf9fb723806553f8f99f00eda1e8fd3b314733759f249cc9db11db400b0a2e8985b1bdbb31749f80e4608f03c783e95fe5a144437337f16
SSDEEP 49152:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2egUmFbcP9ovzmiPW:iVkYYXc4FUoNeIo2eaZdScW
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 384KB
SHA256 7d5ba777ef0835d0a7f38587ac7f6ba1a96a1288114f6157b55ede2d35658ff0
MD5 6e1c3da5e773acb3dfd13e38cd9c1898
SHA1 b9fb4c0bef05310d6528a1fb47dd702970302c56
SHA512 814bfcac9800d5956fe2cd5dcf23f26fb6572386f829c58fd2a3eea3061a37d312e1766568595bf2e3bd33c3fababe220c8eac4d79712d2170cb3c6711e70ad5
SSDEEP 6144:IfL+oq97clx/p1rJWoNny0hd+Mj2ma6Qp5slHiNq3oiHPjTZIAxB4yE2lN//MVnw:IfLo7clx/rJTysd72z1AlH3xHPuUWyZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 640KB
SHA256 45c0c53b6d1c5d7694e381ae14a6cd19e44d54dddb7c4aac00fe5fba9483b9ea
MD5 b17be9c9cd31a7c69c5dccc4222f3241
SHA1 0c4f24a70c3f555d8ebee3397a850a08f68051d1
SHA512 ff0884a00096e018008b5b50876ef6345959eaea8f5a0945a748070df87824ffb47566c50fc1474bf7f988801ffbc8a5c04e273483ee93615de027890efc3787
SSDEEP 12288:IfLo7clx/rJTysd72z1AlH3xHPuUWyZDyguw4aeVi1GE8r7P91z:IfLq8xtTysF2z1yX1W3ViqP91z
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 448KB
SHA256 2f0d802802e13e5208a8adf47fb03f66e2ba0625396220a2f6af920bd0fc6674
MD5 7c09db9c2dacb9e2f18b225f9f204f7a
SHA1 8b2e2227f02371994fb1a5d3839568a713fa7600
SHA512 ee6eb0cc2ccc30ebcb3a7b70e2bdbbbbaf17d8745576cc1eb5d80744118ac484e42eb202ff4b8c8a59aa380e95b2d5b09d1754d26c3d72bfb0c6f8ef4f85830b
SSDEEP 12288:IfLo7clx/rJTysd72z1AlH3xHPuUWyZDyguw4Z:IfLq8xtTysF2z1yX1W5
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xybbjmrs.usi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xybbjmrs.usi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

7D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4IM6T.tmp\7D2.tmp
Size 689KB
SHA256 c28497147101366a323a5c0040823d9fdd7905b7d190bc645d31b6e2b3d741c5
MD5 17a8697f12a3c6196f9af529950bda6a
SHA1 95ffe3ac2e052da21827e107ce49d5a09b9f7b34
SHA512 0befe7903b827a78eb7297d560db27c6cad0324203e8a29fc91cd1cb7ead2f903ccb00caa21a8c28abf820f21334f9f56cb439bcb9dc247c08cea6119a3d1b74
SSDEEP 12288:qTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuYVwRxyF:iPcYn5c/rPx37/zHBA6pDp2mIEiYCRx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-V245N.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-V245N.tmp\_isetup\_isdecmp.dll
Size 13KB
SHA256 e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
MD5 a813d18268affd4763dde940246dc7e5
SHA1 c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA512 b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
SSDEEP 384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp11DE.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsw220C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsw220C.tmp
Size 192KB
SHA256 9aac823f73449450dfae6b03b72cb58376bdaf5eef0a0a9413e61ab55719d368
MD5 df385e54936a530465f91986fc2a010e
SHA1 a4034cefb7da41ac03e0b752ce39d031a7ca7f8e
SHA512 68d8670db6a8b0ad7338c4e1d9d8557ee54f0acf03ae11abf8f8f84bf3d3685f6ba852dbfc93e25e726f465e25e8c9f7a4be828f8419bb0817b5ca10a1f4e0bd
SSDEEP 3072:v/MGLW+mLTYKqmV7YaZWVKKgOhQ0Z0hfTpfAwkal5YfvXMu5:Xc+mHZqmR39KW0Z0hfdvO
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsw220C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsw220C.tmp
Size 256KB
SHA256 f910b7e8832dde437c7556a4c61c1eee980261ab474753c149987aa7bc03306e
MD5 97ef014b840482b8f70f7b5c4c1d2fae
SHA1 cea6ff48552f7ec509160179ffda28ab4f26da0f
SHA512 e434df5878ed44d9ca445b0b82f7c45531349426e5251ab6a75e34fe6c01181eddb2ec857c250f0bb946bad974043e6ab1e6b50bf7fc67fc3d818cb9e4ef185c
SSDEEP 3072:v/MGLW+mLTYKqmV7YaZWVKKgOhQ0Z0hfTpfAwkal5YfvXMu5LHlz:Xc+mHZqmR39KW0Z0hfdvOTR
MD5 SHA1 SHA512 SSDEEP

Submit Download

trafaret.exe

Path C:\Users\Admin\AppData\Local\Trafaret\trafaret.exe
Size 256KB
SHA256 8713d3762d82c035fdb896d61e518c0c91c075c58ba0aa6d5c86406adc5a499e
MD5 1c2c8323bdb4610149a919a25646f840
SHA1 8e2b6b7d8d2a441ab41571e312e5c274387fde37
SHA512 cc07df17e7e929008183b268b5bde3e9ae07ec626c774de4a0e1161a0dcbaa0fa5ab339c9b88778ea65c1b065fa555df39f16233f12d298992d8301ecd10291f
SSDEEP 6144:KHHfzFMPxMxkWHHfzKn9dLBKZ2GVK2kCHHfzAVanH:KHHiskWHH+TLg2Go+HH8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

trafaret.exe

Path C:\Users\Admin\AppData\Local\Trafaret\trafaret.exe
Size 382KB
SHA256 6908832d8718e1c9e903288d6244ed681bc8b86e063219209256f4df3a7d8751
MD5 8ee1c5e695caff575f95098c2545d913
SHA1 08173643291d07a366a347e98d92dc2963987b77
SHA512 fee3ca007311ca856c271f8cf089aeb59527801a33e78cddc45aaf660b7572f828b6e2ba87af14a8e5f9549a8d5f2ad3b4541d812369755530921c8ba9b5273f
SSDEEP 6144:KHHfzFMPxMxkWHHfzKn9dLBKZ2GVK2kCHHfzAVanLM1sQ73HHfzujtGtm94v:KHHiskWHH+TLg2Go+HH81NHHyCv
MD5 SHA1 SHA512 SSDEEP

Submit Download

trafaret.exe

Path C:\Users\Admin\AppData\Local\Trafaret\trafaret.exe
Size 768KB
SHA256 105dab60c83bd7bb949e90658ea9ddf16a027bf83726ef6a70532cce0d61bf3f
MD5 99b96ae0aec209576255c2e8ab4729af
SHA1 562a518d000670e1b9bfd5b66327b7f02b4d60a1
SHA512 d2710fec7fcd914cbacc2eca413082a0e565b3c2dbda9c2546735e3a0931a4dd21f236385154acb7476f34f091319b68db82dff090b078e9ac93582cd73c913b
SSDEEP 12288:KHHiskWHH+TLg2Go+HH81NHHyCrHHDtnq7PHCHH7hHHHB+b4nHHZCDqnCm:uHHkKH+w2GoCH6HyqHDJQH2HhHHB+bIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Task.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
Size 128B
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c1987ab54eca62a3da84be83ec51ff46cc99f964c5deb862344f53512108c9f2
MD5 2e629516000bfa073d548b9d1f8779a4
SHA1 5986823fbfe33fe37fa236ebb09803608e773e64
SHA512 2d887ec573c6395583094cc706513db1ea680c7b3e36d9da12547de5907f1f2c8a1a22558dc1f4e3e8d66a467f4d9e8cf90974e3760b6a132a8d66d7be9840e1
SSDEEP 384:7sf+Bx9m+lWLBcBZPBE+cxd4TVK6seYbneS8v/ZRwMHlOiEIjaLMZbObTUSu2:gf6WFADQd4TVN+nIvtOiEI/qMh2
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2db1a82da11a0054688c3623e0f9707fc670abed03544e8ca8bdd7d1a47e18b4
MD5 7ad76f85906ac0c6050c563b71973e6c
SHA1 84c900997dba89b832413ded0f526158ea7c7a74
SHA512 fa0967aa41282d04b6c1e728806e89e71053fb303844cf475052a351836bba0b8eb167d95cb0704594520eb62a8b6661b368eb388ef5a7200ec2a8bb78b5e15e
SSDEEP 384:e6+BHm+0RSqztsq3pqWJk+o9o/ATVLOFNpfNaUOMck+1Ytoky1RGx+nFbOuj3lus:7zRNzR3Cjo/ATVLOFNpfYxVUk1RZ4ubx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1312-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1312-245-0x0000000002E60000-0x000000000374B000-memory.dmp

Download

memory/1312-243-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1312-272-0x0000000002A50000-0x0000000002E57000-memory.dmp

Download

memory/2236-228-0x00000000025A0000-0x00000000025A1000-memory.dmp

Download

memory/2236-262-0x0000000000400000-0x00000000008E2000-memory.dmp

Download

memory/2396-49-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Download

memory/2396-171-0x00000000001A0000-0x0000000000A4F000-memory.dmp

Download

memory/2396-51-0x00000000001A0000-0x0000000000A4F000-memory.dmp

Download

memory/2396-57-0x0000000002DD0000-0x0000000002E02000-memory.dmp

Download

memory/2396-58-0x0000000002DD0000-0x0000000002E02000-memory.dmp

Download

memory/2396-59-0x0000000002DD0000-0x0000000002E02000-memory.dmp

Download

memory/2396-61-0x0000000002DD0000-0x0000000002E02000-memory.dmp

Download

memory/2396-60-0x0000000002DD0000-0x0000000002E02000-memory.dmp

Download

memory/2396-62-0x0000000002DD0000-0x0000000002E02000-memory.dmp

Download

memory/2880-399-0x0000000070AD0000-0x0000000070E24000-memory.dmp

Download

memory/2880-335-0x0000000073690000-0x0000000073E40000-memory.dmp

Download

memory/2880-389-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Download

memory/2880-344-0x0000000004EE0000-0x0000000004F02000-memory.dmp

Download

memory/2880-394-0x0000000007070000-0x000000000708A000-memory.dmp

Download

memory/2880-396-0x0000000007440000-0x0000000007472000-memory.dmp

Download

memory/2880-388-0x0000000006FB0000-0x0000000007026000-memory.dmp

Download

memory/2880-387-0x0000000002860000-0x0000000002870000-memory.dmp

Download

memory/2880-380-0x0000000006450000-0x0000000006494000-memory.dmp

Download

memory/2880-340-0x0000000002860000-0x0000000002870000-memory.dmp

Download

memory/2880-363-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

Download

memory/2880-362-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

Download

memory/2880-357-0x0000000005AD0000-0x0000000005E24000-memory.dmp

Download

memory/2880-338-0x0000000002860000-0x0000000002870000-memory.dmp

Download

memory/2880-416-0x0000000007580000-0x0000000007591000-memory.dmp

Download

memory/2880-414-0x0000000007620000-0x00000000076B6000-memory.dmp

Download

memory/2880-413-0x0000000007560000-0x000000000756A000-memory.dmp

Download

memory/2880-346-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/2880-333-0x0000000005090000-0x00000000056B8000-memory.dmp

Download

memory/2880-410-0x0000000007480000-0x0000000007523000-memory.dmp

Download

memory/2880-409-0x0000000007420000-0x000000000743E000-memory.dmp

Download

memory/2880-328-0x00000000028D0000-0x0000000002906000-memory.dmp

Download

memory/2880-352-0x0000000005820000-0x0000000005886000-memory.dmp

Download

memory/2880-398-0x00000000713C0000-0x000000007140C000-memory.dmp

Download

memory/2980-221-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Download

memory/2980-261-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/3204-112-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3204-229-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3336-55-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Download

memory/3336-56-0x0000000004890000-0x00000000048FB000-memory.dmp

Download

memory/3336-412-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Download

memory/3336-208-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/3336-247-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/3336-53-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/3408-211-0x0000000003280000-0x0000000003296000-memory.dmp

Download

memory/3408-4-0x0000000002D30000-0x0000000002D46000-memory.dmp

Download

memory/3664-265-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3664-241-0x0000000004970000-0x00000000049A4000-memory.dmp

Download

memory/3664-237-0x0000000003120000-0x0000000003220000-memory.dmp

Download

memory/3664-242-0x0000000000400000-0x0000000002D41000-memory.dmp

Download

memory/3676-194-0x0000000073E20000-0x00000000745D0000-memory.dmp

Download

memory/3676-73-0x0000000073E20000-0x00000000745D0000-memory.dmp

Download

memory/3676-74-0x0000000000D40000-0x00000000015F6000-memory.dmp

Download

memory/3784-217-0x0000000000400000-0x0000000000790000-memory.dmp

Download

memory/3784-210-0x0000000000400000-0x0000000000790000-memory.dmp

Download

memory/4116-79-0x0000000003050000-0x000000000316B000-memory.dmp

Download

memory/4116-101-0x0000000010000000-0x000000001020C000-memory.dmp

Download

memory/4116-75-0x0000000003050000-0x000000000316B000-memory.dmp

Download

memory/4116-66-0x0000000002F10000-0x000000000304C000-memory.dmp

Download

memory/4116-127-0x0000000003050000-0x000000000316B000-memory.dmp

Download

memory/4116-33-0x0000000000FD0000-0x0000000000FD6000-memory.dmp

Download

memory/4324-222-0x00000000030B0000-0x00000000031B0000-memory.dmp

Download

memory/4324-220-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/4324-325-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/4324-198-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/4324-259-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/4404-86-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-22-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-18-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-21-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-85-0x0000000002E00000-0x0000000002F1B000-memory.dmp

Download

memory/4404-23-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-268-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-26-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-27-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-72-0x0000000002E00000-0x0000000002F1B000-memory.dmp

Download

memory/4404-69-0x0000000002E00000-0x0000000002F1B000-memory.dmp

Download

memory/4404-236-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-63-0x0000000002CC0000-0x0000000002DFC000-memory.dmp

Download

memory/4404-238-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/4404-31-0x0000000010000000-0x000000001020C000-memory.dmp

Download

memory/4404-30-0x0000000000A00000-0x0000000000A06000-memory.dmp

Download

memory/4424-225-0x0000000000400000-0x0000000000790000-memory.dmp

Download

memory/4792-1-0x0000000002E70000-0x0000000002F70000-memory.dmp

Download

memory/4792-5-0x0000000000400000-0x0000000002D3F000-memory.dmp

Download

memory/4792-3-0x0000000004A80000-0x0000000004A8B000-memory.dmp

Download

memory/4792-2-0x0000000000400000-0x0000000002D3F000-memory.dmp

Download

memory/4892-17-0x0000000004EF0000-0x00000000050A7000-memory.dmp

Download

memory/4892-16-0x0000000004D20000-0x0000000004EE6000-memory.dmp

Download

memory/4940-214-0x0000000000400000-0x0000000002D3E000-memory.dmp

Download

memory/4940-102-0x0000000002D50000-0x0000000002E50000-memory.dmp

Download

memory/4940-166-0x0000000000400000-0x0000000002D3E000-memory.dmp

Download

memory/4940-103-0x0000000004840000-0x000000000484B000-memory.dmp

Download