umbral | ffe78ab905d69421ab325f5f6fa0e1448a01245538d1f275abaa645e44fb0cb5

Analysis

max time kernel
270s
max time network
272s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

я хз.exe
Size

60.0MB
MD5

5d6cfc446688ff35118f60f1c0c6d9ec
SHA1

c38cc9315d6212dbf9a2b0121bedf8e19e4489c9
SHA256

ffe78ab905d69421ab325f5f6fa0e1448a01245538d1f275abaa645e44fb0cb5
SHA512

2d48eb58d9d145171efe3e98782bf1a8fbd28b2b7fb3b038172a8b36016bf318a9fb0f8e2729f3023a99ad2e3a05225030e18614792818046705531dcbcad199
SSDEEP

49152:qn5mOaNuKQGr02wVAFJApbVY6e7D5jD9KVSxU03l8U+cweXeFrA1n:q5mlkK1Dqne7D5jD9KVSxU8g9A

Score

10^/10

umbral xworm zgrat evasion persistence rat spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1218255752314097764/pf1l_fyX4Y944q-tMNsmbSq2cfDBpqCBXuTvF0vyF76tkTcn3FOYasjrq_iM6NffJOYF

Extracted

Family

xworm

approved-supports.gl.at.ply.gg:45098

Attributes

Install_directory
%AppData%
install_file
rat.exe

Signatures

Detect Umbral payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001695d-7.dat	family_umbral
behavioral2/memory/1096-23-0x000002CCE2BD0000-0x000002CCE2C10000-memory.dmp	family_umbral
behavioral2/files/0x000c00000002311f-18.dat	family_umbral
behavioral2/files/0x000c00000002311f-24.dat	family_umbral
behavioral2/memory/592-26-0x000001C316900000-0x000001C316940000-memory.dmp	family_umbral

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023128-38.dat	family_xworm
behavioral2/memory/440-53-0x0000000000BB0000-0x0000000000BC8000-memory.dmp	family_xworm
behavioral2/memory/592-60-0x000001C316FB0000-0x000001C316FC0000-memory.dmp	family_xworm
behavioral2/files/0x000800000002321e-244.dat	family_xworm

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000016966-230.dat	family_zgrat_v1
behavioral2/files/0x0009000000023219-265.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Blockperf\\dllhost.exe\", \"C:\\Windows\\Offline Web Pages\\sppsvc.exe\", \"C:\\Blockperf\\sihost.exe\", \"C:\\odt\\KFDZOFJDC5BO4Y0.exe\", \"C:\\Program Files (x86)\\Windows NT\\lsass.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Blockperf\\dllhost.exe\", \"C:\\Windows\\Offline Web Pages\\sppsvc.exe\", \"C:\\Blockperf\\sihost.exe\", \"C:\\odt\\KFDZOFJDC5BO4Y0.exe\", \"C:\\Program Files (x86)\\Windows NT\\lsass.exe\", \"C:\\Blockperf\\BlockDhcp.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Blockperf\\dllhost.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Blockperf\\dllhost.exe\", \"C:\\Windows\\Offline Web Pages\\sppsvc.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Blockperf\\dllhost.exe\", \"C:\\Windows\\Offline Web Pages\\sppsvc.exe\", \"C:\\Blockperf\\sihost.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Blockperf\\dllhost.exe\", \"C:\\Windows\\Offline Web Pages\\sppsvc.exe\", \"C:\\Blockperf\\sihost.exe\", \"C:\\odt\\KFDZOFJDC5BO4Y0.exe\""	BlockDhcp.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	692	schtasks.exe	199
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	692	schtasks.exe	199

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	Etc.exe
File created	C:\Windows\system32\drivers\etc\hosts	rykmnxwyylqw.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2732	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	rat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	я хз.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	pautoenr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	BPPG4I6V4F263M4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	KFDZOFJDC5BO4Y0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	BlockDhcp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	rat.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KFDZOFJDC5BO4Y0.lnk	KFDZOFJDC5BO4Y0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KFDZOFJDC5BO4Y0.lnk	KFDZOFJDC5BO4Y0.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\56b4ba924dd7632c1dcce848fbc8f14a.exe	Njrat.0.7D.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\56b4ba924dd7632c1dcce848fbc8f14a.exe	Njrat.0.7D.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rat.lnk	pautoenr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rat.lnk	pautoenr.exe

Executes dropped EXE 18 IoCs

pid	Process
1096	Saransk.exe
592	PeerDistAD.exe
1860	Etc.exe
440	pautoenr.exe
4152	Njrat.0.7D.exe
2900	rykmnxwyylqw.exe
4816	rat.exe
3824	rat.exe
4896	BPPG4I6V4F263M4.exe
1488	KFDZOFJDC5BO4Y0.exe
4824	BlockDhcp.exe
4540	BlockDhcp.exe
1220	rat.exe
4004	rat.exe.exe
2736	dllhost.exe
5068	rat.exe
3488	rat.exe.exe
3952	dllhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BlockDhcp = "\"C:\\Blockperf\\BlockDhcp.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BlockDhcp = "\"C:\\Blockperf\\BlockDhcp.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Blockperf\\sihost.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows NT\\lsass.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KFDZOFJDC5BO4Y0 = "\"C:\\odt\\KFDZOFJDC5BO4Y0.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rat = "C:\\Users\\Admin\\AppData\\Roaming\\rat.exe"	pautoenr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Blockperf\\sihost.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Blockperf\\dllhost.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Offline Web Pages\\sppsvc.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Offline Web Pages\\sppsvc.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows NT\\lsass.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\56b4ba924dd7632c1dcce848fbc8f14a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Njrat.0.7D.exe\" .."	Njrat.0.7D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Blockperf\\dllhost.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KFDZOFJDC5BO4Y0 = "\"C:\\odt\\KFDZOFJDC5BO4Y0.exe\""	BlockDhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\56b4ba924dd7632c1dcce848fbc8f14a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Njrat.0.7D.exe\" .."	Njrat.0.7D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KFDZOFJDC5BO4Y0 = "C:\\Users\\Admin\\AppData\\Roaming\\KFDZOFJDC5BO4Y0.exe"	KFDZOFJDC5BO4Y0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
46	6.tcp.eu.ngrok.io
74	6.tcp.eu.ngrok.io
106	raw.githubusercontent.com
109	raw.githubusercontent.com
123	6.tcp.eu.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ip-api.com

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	D:\autorun.inf	Njrat.0.7D.exe
File created	F:\autorun.inf	Njrat.0.7D.exe
File opened for modification	F:\autorun.inf	Njrat.0.7D.exe
File created	C:\autorun.inf	Njrat.0.7D.exe
File opened for modification	C:\autorun.inf	Njrat.0.7D.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	Etc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	rykmnxwyylqw.exe
File created	\??\c:\Windows\System32\CSCF50DC43AB51A4F41A9E1F5581D40E827.TMP	csc.exe
File created	\??\c:\Windows\System32\wezuc9.exe	csc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 1860	2900	rykmnxwyylqw.exe	172

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\lsass.exe	BlockDhcp.exe
File opened for modification	C:\Program Files (x86)\Windows NT\lsass.exe	BlockDhcp.exe
File created	C:\Program Files (x86)\Windows NT\6203df4a6bafc7	BlockDhcp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\sppsvc.exe	BlockDhcp.exe
File created	C:\Windows\Offline Web Pages\0a1fd5f707cd16	BlockDhcp.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1476	sc.exe
3444	sc.exe
1604	sc.exe
4476	sc.exe
4476	sc.exe
5068	sc.exe
4644	sc.exe
2024	sc.exe
4388	sc.exe
1604	sc.exe
3220	sc.exe
2504	sc.exe
3644	sc.exe
1764	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4600	schtasks.exe
4832	schtasks.exe
4392	schtasks.exe
2896	schtasks.exe
4688	schtasks.exe
1888	schtasks.exe
3944	schtasks.exe
4508	schtasks.exe
3116	schtasks.exe
60	schtasks.exe
4448	schtasks.exe
3488	schtasks.exe
1336	schtasks.exe
3920	schtasks.exe
3908	schtasks.exe
2800	schtasks.exe
2288	schtasks.exe
2688	schtasks.exe
1528	schtasks.exe
3700	schtasks.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	BPPG4I6V4F263M4.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	BlockDhcp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe
1860	Etc.exe
3152	powershell.exe
3152	powershell.exe
1904	powershell.exe
1904	powershell.exe
3152	powershell.exe
1904	powershell.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1860	Etc.exe
1516	powershell.exe
1516	powershell.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
1860	Etc.exe
1516	powershell.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
1860	Etc.exe
1860	Etc.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
2900	rykmnxwyylqw.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4340	powershell.exe
4340	powershell.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4340	powershell.exe
440	pautoenr.exe
440	pautoenr.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe
4152	Njrat.0.7D.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4152	Njrat.0.7D.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	440	pautoenr.exe
Token: SeDebugPrivilege	1096	Saransk.exe
Token: SeDebugPrivilege	592	PeerDistAD.exe
Token: SeIncreaseQuotaPrivilege	3684	wmic.exe
Token: SeSecurityPrivilege	3684	wmic.exe
Token: SeTakeOwnershipPrivilege	3684	wmic.exe
Token: SeLoadDriverPrivilege	3684	wmic.exe
Token: SeSystemProfilePrivilege	3684	wmic.exe
Token: SeSystemtimePrivilege	3684	wmic.exe
Token: SeProfSingleProcessPrivilege	3684	wmic.exe
Token: SeIncBasePriorityPrivilege	3684	wmic.exe
Token: SeCreatePagefilePrivilege	3684	wmic.exe
Token: SeBackupPrivilege	3684	wmic.exe
Token: SeRestorePrivilege	3684	wmic.exe
Token: SeShutdownPrivilege	3684	wmic.exe
Token: SeDebugPrivilege	3684	wmic.exe
Token: SeSystemEnvironmentPrivilege	3684	wmic.exe
Token: SeRemoteShutdownPrivilege	3684	wmic.exe
Token: SeUndockPrivilege	3684	wmic.exe
Token: SeManageVolumePrivilege	3684	wmic.exe
Token: 33	3684	wmic.exe
Token: 34	3684	wmic.exe
Token: 35	3684	wmic.exe
Token: 36	3684	wmic.exe
Token: SeIncreaseQuotaPrivilege	3856	wmic.exe
Token: SeSecurityPrivilege	3856	wmic.exe
Token: SeTakeOwnershipPrivilege	3856	wmic.exe
Token: SeLoadDriverPrivilege	3856	wmic.exe
Token: SeSystemProfilePrivilege	3856	wmic.exe
Token: SeSystemtimePrivilege	3856	wmic.exe
Token: SeProfSingleProcessPrivilege	3856	wmic.exe
Token: SeIncBasePriorityPrivilege	3856	wmic.exe
Token: SeCreatePagefilePrivilege	3856	wmic.exe
Token: SeBackupPrivilege	3856	wmic.exe
Token: SeRestorePrivilege	3856	wmic.exe
Token: SeShutdownPrivilege	3856	wmic.exe
Token: SeDebugPrivilege	3856	wmic.exe
Token: SeSystemEnvironmentPrivilege	3856	wmic.exe
Token: SeRemoteShutdownPrivilege	3856	wmic.exe
Token: SeUndockPrivilege	3856	wmic.exe
Token: SeManageVolumePrivilege	3856	wmic.exe
Token: 33	3856	wmic.exe
Token: 34	3856	wmic.exe
Token: 35	3856	wmic.exe
Token: 36	3856	wmic.exe
Token: SeIncreaseQuotaPrivilege	3684	wmic.exe
Token: SeSecurityPrivilege	3684	wmic.exe
Token: SeTakeOwnershipPrivilege	3684	wmic.exe
Token: SeLoadDriverPrivilege	3684	wmic.exe
Token: SeSystemProfilePrivilege	3684	wmic.exe
Token: SeSystemtimePrivilege	3684	wmic.exe
Token: SeProfSingleProcessPrivilege	3684	wmic.exe
Token: SeIncBasePriorityPrivilege	3684	wmic.exe
Token: SeCreatePagefilePrivilege	3684	wmic.exe
Token: SeBackupPrivilege	3684	wmic.exe
Token: SeRestorePrivilege	3684	wmic.exe
Token: SeShutdownPrivilege	3684	wmic.exe
Token: SeDebugPrivilege	3684	wmic.exe
Token: SeSystemEnvironmentPrivilege	3684	wmic.exe
Token: SeRemoteShutdownPrivilege	3684	wmic.exe
Token: SeUndockPrivilege	3684	wmic.exe
Token: SeManageVolumePrivilege	3684	wmic.exe
Token: 33	3684	wmic.exe
Token: 34	3684	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
440	pautoenr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1096	936	я хз.exe	95
PID 936 wrote to memory of 1096	936	я хз.exe	95
PID 936 wrote to memory of 592	936	я хз.exe	96
PID 936 wrote to memory of 592	936	я хз.exe	96
PID 936 wrote to memory of 1860	936	я хз.exe	97
PID 936 wrote to memory of 1860	936	я хз.exe	97
PID 936 wrote to memory of 440	936	я хз.exe	98
PID 936 wrote to memory of 440	936	я хз.exe	98
PID 936 wrote to memory of 4152	936	я хз.exe	99
PID 936 wrote to memory of 4152	936	я хз.exe	99
PID 936 wrote to memory of 4152	936	я хз.exe	99
PID 592 wrote to memory of 3684	592	PeerDistAD.exe	101
PID 592 wrote to memory of 3684	592	PeerDistAD.exe	101
PID 1096 wrote to memory of 3856	1096	Saransk.exe	103
PID 1096 wrote to memory of 3856	1096	Saransk.exe	103
PID 440 wrote to memory of 4128	440	pautoenr.exe	106
PID 440 wrote to memory of 4128	440	pautoenr.exe	106
PID 440 wrote to memory of 3832	440	pautoenr.exe	108
PID 440 wrote to memory of 3832	440	pautoenr.exe	108
PID 440 wrote to memory of 1904	440	pautoenr.exe	111
PID 440 wrote to memory of 1904	440	pautoenr.exe	111
PID 4960 wrote to memory of 3168	4960	cmd.exe	120
PID 4960 wrote to memory of 3168	4960	cmd.exe	120
PID 4152 wrote to memory of 2732	4152	Njrat.0.7D.exe	124
PID 4152 wrote to memory of 2732	4152	Njrat.0.7D.exe	124
PID 4152 wrote to memory of 2732	4152	Njrat.0.7D.exe	124
PID 440 wrote to memory of 1516	440	pautoenr.exe	128
PID 440 wrote to memory of 1516	440	pautoenr.exe	128
PID 440 wrote to memory of 2800	440	pautoenr.exe	151
PID 440 wrote to memory of 2800	440	pautoenr.exe	151
PID 4080 wrote to memory of 980	4080	cmd.exe	158
PID 4080 wrote to memory of 980	4080	cmd.exe	158
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 2900 wrote to memory of 1860	2900	rykmnxwyylqw.exe	172
PID 440 wrote to memory of 4896	440	pautoenr.exe	190
PID 440 wrote to memory of 4896	440	pautoenr.exe	190
PID 440 wrote to memory of 4896	440	pautoenr.exe	190
PID 440 wrote to memory of 1488	440	pautoenr.exe	191
PID 440 wrote to memory of 1488	440	pautoenr.exe	191
PID 4896 wrote to memory of 636	4896	BPPG4I6V4F263M4.exe	192
PID 4896 wrote to memory of 636	4896	BPPG4I6V4F263M4.exe	192
PID 4896 wrote to memory of 636	4896	BPPG4I6V4F263M4.exe	192
PID 1488 wrote to memory of 4600	1488	KFDZOFJDC5BO4Y0.exe	193
PID 1488 wrote to memory of 4600	1488	KFDZOFJDC5BO4Y0.exe	193
PID 636 wrote to memory of 3548	636	WScript.exe	196
PID 636 wrote to memory of 3548	636	WScript.exe	196
PID 636 wrote to memory of 3548	636	WScript.exe	196
PID 3548 wrote to memory of 4824	3548	cmd.exe	198
PID 3548 wrote to memory of 4824	3548	cmd.exe	198
PID 4824 wrote to memory of 3036	4824	BlockDhcp.exe	203
PID 4824 wrote to memory of 3036	4824	BlockDhcp.exe	203
PID 3036 wrote to memory of 3388	3036	csc.exe	205
PID 3036 wrote to memory of 3388	3036	csc.exe	205
PID 4824 wrote to memory of 3088	4824	BlockDhcp.exe	206
PID 4824 wrote to memory of 3088	4824	BlockDhcp.exe	206
PID 3088 wrote to memory of 2556	3088	csc.exe	208
PID 3088 wrote to memory of 2556	3088	csc.exe	208

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\я хз.exe
"C:\Users\Admin\AppData\Local\Temp\я хз.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:936
- C:\Users\Admin\AppData\Local\Temp\Saransk.exe
  "C:\Users\Admin\AppData\Local\Temp\Saransk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- C:\Users\Admin\AppData\Local\Temp\PeerDistAD.exe
  "C:\Users\Admin\AppData\Local\Temp\PeerDistAD.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\Users\Admin\AppData\Local\Temp\Etc.exe
  "C:\Users\Admin\AppData\Local\Temp\Etc.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3168
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4476
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2504
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2024
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3644
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:4388
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    PID:1084
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:3460
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    PID:2556
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    PID:1192
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "CBABZYWT"
    3⤵
    - Launches sc.exe
    PID:1604
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "CBABZYWT" binpath= "C:\ProgramData\yhdrdrurzmhh\rykmnxwyylqw.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1476
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3220
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "CBABZYWT"
    3⤵
    - Launches sc.exe
    PID:4476
- C:\Users\Admin\AppData\Local\Temp\pautoenr.exe
  "C:\Users\Admin\AppData\Local\Temp\pautoenr.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\pautoenr.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pautoenr.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\rat.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'rat.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1516
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "rat" /tr "C:\Users\Admin\AppData\Roaming\rat.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\BPPG4I6V4F263M4.exe
    "C:\Users\Admin\AppData\Local\Temp\BPPG4I6V4F263M4.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Blockperf\SsxsOgj7UItOyP.vbe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Blockperf\W03a7eRByVe59tEfoEn5p9hfLGE7liRC1WwfhocqTKwXnqoCeIu86OnqQ.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3548
      - C:\Blockperf\BlockDhcp.exe
        
        "C:\Blockperf/BlockDhcp.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\clnjqoes\clnjqoes.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69DC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC39DC6CCC78794CF7A8FE3CDA34DCEC63.TMP"
        8⤵
        
        PID:3388
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\el0ahzaq\el0ahzaq.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A39.tmp" "c:\Users\Admin\AppData\Roaming\CSC5C62D01DCB9C4E188191F6492D6DA4B2.TMP"
        8⤵
        
        PID:2556
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tid5ila2\tid5ila2.cmdline"
        7⤵
        
        PID:2264
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A97.tmp" "c:\Users\Admin\AppData\Roaming\CSC52DEE60B367D4AF1A9D5BD30D06461B7.TMP"
        8⤵
        
        PID:4256
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nlnbekb0\nlnbekb0.cmdline"
        7⤵
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B14.tmp" "c:\Windows\System32\CSCF50DC43AB51A4F41A9E1F5581D40E827.TMP"
        8⤵
        
        PID:2180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Blockperf\dllhost.exe'
        7⤵
        
        PID:2224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\sppsvc.exe'
        7⤵
        
        PID:2584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Blockperf\sihost.exe'
        7⤵
        
        PID:4500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\KFDZOFJDC5BO4Y0.exe'
        7⤵
        
        PID:3632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\lsass.exe'
        7⤵
        
        PID:1904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Blockperf\BlockDhcp.exe'
        7⤵
        
        PID:3684
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TXZADbZF6z.bat"
        7⤵
        
        PID:3812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4000
        
        C:\Blockperf\BlockDhcp.exe
        
        "C:\Blockperf\BlockDhcp.exe"
        8⤵
        Executes dropped EXE
        
        PID:4540
- - C:\Users\Admin\AppData\Local\Temp\KFDZOFJDC5BO4Y0.exe
    "C:\Users\Admin\AppData\Local\Temp\KFDZOFJDC5BO4Y0.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "KFDZOFJDC5BO4Y0" /tr "C:\Users\Admin\AppData\Roaming\KFDZOFJDC5BO4Y0.exe"
      4⤵
      Creates scheduled task(s)
      PID:4600
- C:\Users\Admin\AppData\Local\Temp\Njrat.0.7D.exe
  "C:\Users\Admin\AppData\Local\Temp\Njrat.0.7D.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Njrat.0.7D.exe" "Njrat.0.7D.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2732

C:\ProgramData\yhdrdrurzmhh\rykmnxwyylqw.exe
C:\ProgramData\yhdrdrurzmhh\rykmnxwyylqw.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:980
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1764
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3444
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5068
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4644
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1604
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:1464
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:1476
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:956
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:2180
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1860

C:\Users\Admin\AppData\Roaming\rat.exe
C:\Users\Admin\AppData\Roaming\rat.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Users\Admin\AppData\Roaming\rat.exe
C:\Users\Admin\AppData\Roaming\rat.exe
1⤵
- Executes dropped EXE
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Blockperf\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Blockperf\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Blockperf\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Blockperf\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Blockperf\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Blockperf\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "KFDZOFJDC5BO4Y0K" /sc MINUTE /mo 14 /tr "'C:\odt\KFDZOFJDC5BO4Y0.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "KFDZOFJDC5BO4Y0" /sc ONLOGON /tr "'C:\odt\KFDZOFJDC5BO4Y0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "KFDZOFJDC5BO4Y0K" /sc MINUTE /mo 5 /tr "'C:\odt\KFDZOFJDC5BO4Y0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockDhcpB" /sc MINUTE /mo 8 /tr "'C:\Blockperf\BlockDhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockDhcp" /sc ONLOGON /tr "'C:\Blockperf\BlockDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockDhcpB" /sc MINUTE /mo 8 /tr "'C:\Blockperf\BlockDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Users\Admin\AppData\Roaming\rat.exe
C:\Users\Admin\AppData\Roaming\rat.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1220
- C:\Blockperf\dllhost.exe
  "C:\Blockperf\dllhost.exe"
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Users\Admin\AppData\Roaming\rat.exe.exe
  "C:\Users\Admin\AppData\Roaming\rat.exe.exe"
  2⤵
  - Executes dropped EXE
  PID:4004

C:\Users\Admin\AppData\Roaming\rat.exe
C:\Users\Admin\AppData\Roaming\rat.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5068
- C:\Users\Admin\AppData\Roaming\rat.exe.exe
  "C:\Users\Admin\AppData\Roaming\rat.exe.exe"
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Blockperf\dllhost.exe
  "C:\Blockperf\dllhost.exe"
  2⤵
  - Executes dropped EXE
  PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Blockperf\BlockDhcp.exe

Filesize
1.9MB

MD5
885ad16db4188802c438079fef3e24bf

SHA1
8f941a38471c9ad803a5f79ada6fe88c0bcebe1b

SHA256
581d9667e6d2b6fa9c5630f72a5bfe24622719ab0adce77c5ac3f207af871b5c

SHA512
54e17934a19994b847070705741e3b10c4145b6e9b940a563ab0835b4975cb091afbd783e48a981abd84c1b684ea8c4abfd08a83469b2580058a1f9c1959ec55

Download Submit
C:\Blockperf\SsxsOgj7UItOyP.vbe

Filesize
256B

MD5
7bd4ae5733494fe9888a9fb6cc6212b6

SHA1
155ea81b368875d5015e49b11b7ccdb9458505bd

SHA256
00fafff153878b3bc60ab36aafda3d2fccbab69c728153733fcf857016c93d50

SHA512
c573019171da281cf08d64dfdec1f71ba444819f1f444021543296cdb3fe8225e024895294ca0856e588d20789cd763d65ffbd4a0ba5a5ecc645bda2e0080664

Download Submit
C:\Blockperf\W03a7eRByVe59tEfoEn5p9hfLGE7liRC1WwfhocqTKwXnqoCeIu86OnqQ.bat

Filesize
91B

MD5
1d4c24d719063e18d59f87ad8b86f7f0

SHA1
16e96049b02c4ac6017ea616e9419764da32feb9

SHA256
1fe35093cfbf50d0d702dc90e107c1ba9834e37b6e3be78063261eb8ed7a6051

SHA512
1902dec43b5e9552826d09f018b6edf78c993bc8ae96112918ab516790bc2d9c87f92769e4ebe28384f804036efa0fa7a405713226350638e5e4a6bdcaab46f3

Download Submit
C:\ProgramData\yhdrdrurzmhh\rykmnxwyylqw.exe

Filesize
2.5MB

MD5
852289107d40fe8e2e1b9e3a49ec75b6

SHA1
d75c992e00f0b98c7cc1603c02b5edaf897c9cf1

SHA256
46c9e110d7f226a58ed6446bc9f1ef22999cbd30009ed7bf25f83c93bcf88b75

SHA512
262c9c1a2dea1cb7d1eeedd5c29dd569b60f51fdf5d8e85ed789a2ccc723aaa323e2384dd2fd61a77f8109dce754459473db71b1047c7c1dc7db6c879a335c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BlockDhcp.exe.log

Filesize
1KB

MD5
af6acd95d59de87c04642509c30e81c1

SHA1
f9549ae93fdb0a5861a79a08f60aa81c4b32377b

SHA256
7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

SHA512
93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rat.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8ac2774493ffb4489983d3f6dc2a3241

SHA1
9a27e9ed279b3494f9964638cb0138f5ed3b7adf

SHA256
5055352f75e942b8cac302cef812b089a7172b7d327edda491c82343abda540f

SHA512
b8caac9024381da085f131652690eac73b469451f310c19c661f5cf11cea11175dd2be4209e6c9d39c82516769c7c5f29389650862f6ab35bd1b07a8f5a68a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eb033be02578f9635ec47bdc1de5c3fb

SHA1
ec356bc87381354a06baa9c30e8c3ac3d30e0f6f

SHA256
bd827af3192bf83c75a32e51ed2de83bd3b90d6b99350721a189a57cec15d063

SHA512
4d8778503646f7016df73ff9d204760f4fe4d2b24157920ac3e5651653373975b2f2d229530143059f11b16c42822ad7963e628ad6066022ee712c17d90595ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef647504cf229a16d02de14a16241b90

SHA1
81480caca469857eb93c75d494828b81e124fda0

SHA256
47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710

SHA512
a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
46b170302a5821687d8c622f10947f27

SHA1
47a91ea3e248bd99dc87211be7e2844dda0687df

SHA256
e3cdd1b49dca63bf255aead7a7535cc6fc085425ff5ac48975d62c37af6a689e

SHA512
e6f9e562876591cb959d5650cf9ef1eb2a87d5a154bd5f8c37f6697c7fd48d959014bcb2aab96b9c41498a465e9d0f114be276514e2be59dcb019334e3dfe7cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
865d30ef81d6f5d8cb94ccd6bd627d1d

SHA1
13fbe1cfd95fecd018929b220078b9b6ae4aeaf1

SHA256
9094c4736c6c3cfe381c2eb7c2b01461ce35dbbb87dd9d16606561a8ba5324dd

SHA512
03906c48756aeec397a71431f0fc7fbe43246f88ce49087c320d97c10203290beb53bf0b80cb8c1bb5eda5c0278dc8459fb5b61cedcea6a98b537ea72fca8766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6f3b96b24f06e2d37a46e43e8b784f56

SHA1
7be6702c5867f359e913eeeecdd5b76698589295

SHA256
8e386afeed28e1d282d9a0294dd2e9402dcb807f7c77aca8426314c20057e720

SHA512
d760999531a77a9adf2b4dc019ce3b43ac3a8cad825398b3a09818afe8deaa177d37219a26dd8a432c00c9cff7858efc43cae2375edc996bb0136c92c39c9dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0026cdd9bbc34b9de2447c0eb04c14b5

SHA1
ab7713fe5fbbb23031937dd1dc7d0fa238884ad4

SHA256
cf5a1c42641a83dd41fe89923591962b7ad189006342c7a67669239688f84a2d

SHA512
62aab723672e2731946f4bbf6a3d92609ff94384e324f3c50e803095529baf848ce2cd37219a059ced4c3f559e598bd9b900b9dd8aa0657adca6d845127797fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4d8567f2d1c8a09bbfe613145bf78577

SHA1
f2af10d629e6d7d2ecec76c34bd755ecf61be931

SHA256
7437b098af4618fbcefe7522942c862aeaf39a0b82ce05b0797185c552f22a3c

SHA512
89130e5c514e33f5108e308f300614dc63989f3e6a4e762a12982af341ab1c5748dd93fd185698dcf6d3a1ea7234228d04ad962e4ee0a15a683e988f115a84ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\BPPG4I6V4F263M4.exe

Filesize
2.2MB

MD5
a61d423019f0f0b040c9fa740eac0b32

SHA1
f17c16cf0b313eb622511ce4dfcee561c8579611

SHA256
c6a3c48defac245c5a5895199196518308be9a1aaa6402ba08389eeb5671f4e1

SHA512
7086e88c7b8c48a66401dc8fb6e05ac5f34365b33f982f9b69af7feef5de75f6a73e507f14d6ab463c84ea385d547ccd17f0d02f109d37b30fc30b3be4f14feb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Etc.exe

Filesize
2.6MB

MD5
7c14d590880406022bc0d8bdd3e2aa2c

SHA1
ffe66d0792a93e977f6366903cb349ac4cc6021c

SHA256
dbff26f5d4d1c5c35a636639161924c8bf6f8750be150fd1670092bd581a42ac

SHA512
c355ae4800a018a5651eb9222db16e7067cd2ec5a09fb619485441f4dd654dbb8d34051afb42622e086be0ad2a3aba46d8f9795a4c56f3e06b8bcd45fc1baf67

Download Submit
C:\Users\Admin\AppData\Local\Temp\KFDZOFJDC5BO4Y0.exe

Filesize
185KB

MD5
e0c8976957ffdc4fe5555adbe8cb0d0c

SHA1
226a764bacfa17b92131993aa85fe63f1dbf347c

SHA256
b8260ac46e03f2a7baa9ae01bee5443d16d9eb96f6ee8588a887d6de72a750d4

SHA512
3a1ea48e81ebfd5586938a72afd68bcc48d4c5d69949cfdacf33aee3371d98f202443f5db12bac876ca7cecc982ddc56827f8d9b1857d22bda71242d5b2cc71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Njrat.0.7D.exe

Filesize
79KB

MD5
41f3e2245bf0cfecb81fa3742765e924

SHA1
080addf3f44cf3fd73225a83d50038b53c34b476

SHA256
dcc9822b30f238d5e5428cb0ddf31095790f411eaf5cd41e6b7c05e8b366f9ca

SHA512
89fcb991be7ad5628799a3cafd46bf993d6b52ca13b9dfa23597466fa855c53b018f0a7bd3e3fe46e9129b128591477577b338ef772c02dcd2e57fdde2d378c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\PeerDistAD.exe

Filesize
64KB

MD5
0e6252baff9d9046f8c1377f629ecf5f

SHA1
7c381a5c87bdd185068d96e213192721eb689d8b

SHA256
c5377d7d8082163decb704fbcb956899a89620923c30ad7ea164f8649b659306

SHA512
033d624509a432ccfa2eea7778379131cdab8485ccff9410f94d089a0157f3cd09e52e22c0e146fef3876caf30b7142215b4fa245f161564d7ea6ced98211e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\PeerDistAD.exe

Filesize
229KB

MD5
afa8bb7e6708d4b5c056079f642b65f9

SHA1
3cadcd7a2da0bc26fd7912f46bdc692e51752913

SHA256
9041042642f5c0b67443490fc595aaaa1858c3a8582602969f1af568cad398e9

SHA512
46392d04c3827a9f1602685bae2b10a69306839ce3af5b51889a70925e48654e0b8793ae4f68a4ce94f7c7dc71d0d69f0437583417b32cef9619024294351ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES69DC.tmp

Filesize
1KB

MD5
b91b7817422116e453ff6337c0194dce

SHA1
6e0e158f6c73078017a35813e98906d61758a0ef

SHA256
288c54696a2c3f447c6888c75886e65391ce9d8a5d1cbc0e2f5090bdac6bbfd1

SHA512
8e0dcc9910a60b3e487b071baac41cea84f355fb8e388c0905a7c67c010522ae3f0700e49489aff43b7857de4cc8f798c49818c1358ca257e192191a8e50999c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6A39.tmp

Filesize
1KB

MD5
1ed9fa01523bf443842f1dabf94b1f44

SHA1
f6f4f62ad724fa122215f5e6d7713055e8674051

SHA256
7e7794d943f4e87ca52c2b40296db70c4860ee5c73346988d119de8b2009b421

SHA512
121501f8227fda8909bf5720ca0f268bc10a147c9273aa179f4ab55671942acf62f708d20b8ce9ccc48d6d9180d7fede73a5248fa3f9c082c769ebc27899b7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6A97.tmp

Filesize
1KB

MD5
cbf4becbce90bc41e66baf17622458ff

SHA1
3f1d2f86dd26b90de8bea3f89646392613c4d9f9

SHA256
499392b24cee03188b811a12bed155b70d3e3e4bc257ea08c76838ee4310690a

SHA512
686ef82f6b83bfeb0e1eb73269be13dd258fce87c37afc616fca2d9973ce1984dfd81dd1860c2337eebd33f1eb0b2894abe864a1c463ebfddd23fa4d568c4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6B14.tmp

Filesize
1KB

MD5
1270494fb8113d81bc14fa5409b94790

SHA1
9495075fdd83f5ed259199e3c8cc1a076c24c68e

SHA256
f015cfae2ffbf27356d6e3f78622da85a71720faf86911a5117ff1aca81e2642

SHA512
79e0b772faa1787aa4f628e8f7a2a4fb9034073c6343f661ecf9dcfc53b6aa1e387479aa10a03b589c00151a9fec32355e9b1e36410088ef5686ba0b93ff7eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Saransk.exe

Filesize
231KB

MD5
37faaeec369bffbc6fdcdb1f26d82a30

SHA1
467a67ff26cc99f9377c8b0bfb58e68af817ef10

SHA256
5c81746a7b7baf2d7ba7350a8bf40ad19c57ca1fd3ae8296d8a51e5de69d5c61

SHA512
59ffa575b9ba69a79b6063b63a9d70786b655f8a5c9509ecbaecc58a276f06e7cb647fe5696c1d260a3028ac3e2eafeadf9d19aa4863bbd107cad2159fe952a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TXZADbZF6z.bat

Filesize
202B

MD5
aebd09c98b5a7f106a1a54eb4bde50f7

SHA1
6373ad9092b5fd2cc73b74badc07a5847ef896f8

SHA256
096361d3d50f3ff6823fa0673242918a7a20b5d2eb808aa855dbf8a740858242

SHA512
6d2a068643ecd4a5d451a01de6fd3d63f24ec564ed57a0b6519b5687ad1bd56cb9d2b6072014cc9d9f6bf3c179a4c3d23aa17933ad97284e25ab9ac5b561346e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vhktaaor.fcj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pautoenr.exe

Filesize
71KB

MD5
5adb580a8a93b829aefd180ab1773e19

SHA1
66f11192207b97a0e1d7df0d3a7080a555801d9a

SHA256
bf52359d6a85fd4df2d11603dfa1ccd90e432cdd19c64928791246cdb46ec03c

SHA512
1afabcc8b2963bd44eb9523e3d6f0957ed477a25292d1bcd4cd1188a62381fedf4d2d0d68b06b2f73b84d0b493ace4f9ee7f52b30ea264577e0e4c07f3927a04

Download Submit
C:\Users\Admin\AppData\Roaming\rat.exe

Filesize
4KB

MD5
a492f6ef8c209e5c771d572404e196dd

SHA1
9dd4b574ef14639b732999eeb47d47682c022b9c

SHA256
341727f43379ee4150899c7b546e3ecbfb770f6f257fff2c8c7ae9728c225681

SHA512
71a4444d3648f7d234a1aa002e70092894c5707f75db042e44510d41c842feacde276f77e0662897f15e994e83291735da413709c5ae0a0b4f5b89f32a8c4856

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
b75ab2f570face3815db2e6d05351979

SHA1
61ae8f09bf3496ab1dfd5fb2993ca4af2a70994f

SHA256
59499ef13855667376f42becc9a1e6023b835887ff7f5f7fd05b0dbebe8b1b4d

SHA512
eb16ef330548ac8dbfb77dd1f2ba873c37325463cb6eafffc6a0a7293dc51d657ff0951546d450945cecb1d5b6774acab527cc97dcb6c977a2d7454798b0fa86

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC39DC6CCC78794CF7A8FE3CDA34DCEC63.TMP

Filesize
1KB

MD5
8ef5c9a4e833f26757a5b8621217ff35

SHA1
8f901aa2654f72a294131a83931e2d5181522c5a

SHA256
da71be5feea7337c95758b3c22d8efd5b33f149160fd0c339e3539c79bb74f01

SHA512
3be88bb7f2dc506e5d12537b5d568e6969d88ea3e49582d1571b9b7c6901673513e40c9a97bb8fae0dd7b93610438bb4cd61d75948df3a9c465efa6379372180

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\clnjqoes\clnjqoes.0.cs

Filesize
374B

MD5
e111c8515c3802c1888b87d923ae88e5

SHA1
214bfdbf8ebe1ecd22b5aa63a7f5a41a185c9300

SHA256
6e225d200bb7f59e886e7ea8b76bd3641a3864c826b92f5c4da306fe7f959619

SHA512
683978b55571123dbeed84f42a40e93739505c126ee3493f975fbb47f75d7f0dee247da113c4528345e976f588eca43cf5594508426012a99f5fa540252bd753

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\clnjqoes\clnjqoes.cmdline

Filesize
253B

MD5
eb62b0e949e480ea15a20fbc59e8b928

SHA1
0e2eb6833000917c7f67f58c624438492aef127f

SHA256
d76e1b4f00df0044c9a46bffbf8d82c4fbc5b2e755927ab03d14f2ef4ff6dacd

SHA512
0ed9374b2d29dda2cefd6347548217d09fd9136c593cd5b58d123ae2c1d8053650973ddb9f9db5078581ed5bbccc61c5d89c5fdab3fc8ded5d800d6497c4a1bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\el0ahzaq\el0ahzaq.0.cs

Filesize
364B

MD5
68bb016620b5f4efb9f2f34bb78782c3

SHA1
9ad7229e5e7bbfc6f47e28711ddaaca4ba7e9989

SHA256
b77a8da235cc895f57d622eb62bddc88c589bd5354ced378d160ce957a8aa6de

SHA512
3daf23f7972535b37a878d7245b39fec155511772f5230fdc50d84ccaf128c9432a002af0adc5bff9969387458547bd9fdb7905f266f4ff06ab65fadca7842ad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\el0ahzaq\el0ahzaq.cmdline

Filesize
243B

MD5
64abddc56ae252a12a4c520195051ada

SHA1
dcec500dbcb1277bb12bf8849281f3b7210eae2c

SHA256
2ebf1dc1665c1b6b1554174480b04eb9423be8d9d1dc1c4fae7dfe7797d8499c

SHA512
123e8eadb080b2605f0d8b8b18e3a1dd80171024f87850c43bf99e28d0e886aa8c3cd1aed17adefa0090a3381cba93760183b1ec99f20e450ba96054510e7629

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nlnbekb0\nlnbekb0.0.cs

Filesize
356B

MD5
4b4269ac5cef865169d4c6ae74ad6e02

SHA1
2ab1d66109f45eebabb9e196c3cd706e75d9db86

SHA256
88c842e3d67dd939098f024293890a7672285c35025f2aa1bc0af23996042019

SHA512
53b941cabd835a4509139ed67ca5d89d2a1206a6001724dabe88baf5104a62383c30f651cb3d8c2c98be091a4d389fd21f4ff50593fb5efd05013bfe1f7916f3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nlnbekb0\nlnbekb0.cmdline

Filesize
235B

MD5
8348b33b196a3e2bffbdd606efb01fc0

SHA1
0c49f38b2cb429a0510a7afb40e13d56e1263f09

SHA256
c4d103183e669196aa0aa89a44a26f8c358acee1823dc770b8aa5eb62e3338aa

SHA512
e7c0ee5bf39ae7c392dfd2ffca14023fca5a8b5ed6cb1cd7f3afc6a64de068a1ff7fbe7f7bacfa7ddb3fb180522b9c435e349b910067b43d9af44ea4287fc9eb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tid5ila2\tid5ila2.0.cs

Filesize
376B

MD5
72102e0a2d6135ffc353f882b532cab4

SHA1
fc85e297adbec14b8ab2efce776a83b7d99e2b55

SHA256
c88442d400f5db3bb85b83c487cfcaece5d907b3fe8608b1047e4d7ae84f4b51

SHA512
6f68d4fd35023bca041dac00e80b2be8362b9a4b2bef1e337cfc9fee13ceb270be1ac59b8a986b0b0ea6d1b9a7e4835bc8e06d5b85f690fc01ab116fb8bb650d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tid5ila2\tid5ila2.cmdline

Filesize
255B

MD5
3af275226ce65baa68507fcdc0b89cb5

SHA1
33967d6bf72e0677efb213bc8c92cf2c37a642bc

SHA256
0ecd804ee4dcb9cc668d76bb19a1b33b96dfda4b8a6b02cbb93ba624959df9e3

SHA512
b1a200ce6f1d10dd9195bc8bdc1d29e64c021bd425af52347a04c032c748a71f054610d78d08cc0abee46dd9329b505836ec4d39b967ccb2dc9003856f18e5bf

Download Submit
\??\c:\Users\Admin\AppData\Roaming\CSC52DEE60B367D4AF1A9D5BD30D06461B7.TMP

Filesize
1KB

MD5
6ef0814c10e01a95c912ca40141509c5

SHA1
0c3e3f1bfd6a24baec740d6c700588b98486cd85

SHA256
7fe38d3b17e03f45d093fbbba5b9b922267065a2c7531c08ab886552b10e5892

SHA512
a9701b81bf70563eabc9b985e338ca43cad79cb99ddd26db0f607c1021d9c624e6ae974518e2bb2cfad989b3234ae8bc13e2cfb6752d5e3f6aa8061056233e24

Download Submit
\??\c:\Users\Admin\AppData\Roaming\CSC5C62D01DCB9C4E188191F6492D6DA4B2.TMP

Filesize
1KB

MD5
ba1dd2055e24bfbcb6ce5ba295e12ded

SHA1
70b3721965d577d55c1b71aaab9266cfa5b65709

SHA256
c67577458b1fed5104a88e79f559531fd93e3e41bcea82d6cbd750fa57009c76

SHA512
c16f4d3ad01b5f92f4f4494bc9f3855471e2848888ee317e8a9336b031e434122dbba647277b001f3aea557efea811d637af5421e90dfeadc183faee5f9c3b27

Download Submit
\??\c:\Windows\System32\CSCF50DC43AB51A4F41A9E1F5581D40E827.TMP

Filesize
1KB

MD5
25b0924c6fa0a93e5a796fc9523602f1

SHA1
2491e1b75bd4f12ff9b2e202abf37282898df725

SHA256
52d3d04552662aaa188ceb209548cc034e47949a5a790a1f5d6b442694a144ae

SHA512
abaaaa6754e451f730cd6c52ba6a74bae56c15fd98fdf371425afab58bae4c027c7b230f00ddef1239e1f777051c57aa3a11e71511b6e6f155d24b32c87981d8

Download Submit
memory/440-155-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/440-53-0x0000000000BB0000-0x0000000000BC8000-memory.dmp

Filesize
96KB

Download
memory/440-68-0x000000001B820000-0x000000001B830000-memory.dmp

Filesize
64KB

Download
memory/440-61-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/440-192-0x000000001B820000-0x000000001B830000-memory.dmp

Filesize
64KB

Download
memory/592-57-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/592-60-0x000001C316FB0000-0x000001C316FC0000-memory.dmp

Filesize
64KB

Download
memory/592-26-0x000001C316900000-0x000001C316940000-memory.dmp

Filesize
256KB

Download
memory/592-67-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/936-1-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/936-58-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/936-3-0x000000001B7F0000-0x000000001B800000-memory.dmp

Filesize
64KB

Download
memory/936-0-0x00000000006C0000-0x0000000000904000-memory.dmp

Filesize
2.3MB

Download
memory/1096-44-0x000002CCFD230000-0x000002CCFD240000-memory.dmp

Filesize
64KB

Download
memory/1096-32-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/1096-66-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/1096-23-0x000002CCE2BD0000-0x000002CCE2C10000-memory.dmp

Filesize
256KB

Download
memory/1516-156-0x000001DE00130000-0x000001DE00140000-memory.dmp

Filesize
64KB

Download
memory/1516-141-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/1516-160-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/1516-143-0x000001DE00130000-0x000001DE00140000-memory.dmp

Filesize
64KB

Download
memory/1516-142-0x000001DE00130000-0x000001DE00140000-memory.dmp

Filesize
64KB

Download
memory/1860-212-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1860-209-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1860-206-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1860-207-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1860-208-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1860-210-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1904-135-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/1904-123-0x000001CAA25B0000-0x000001CAA25C0000-memory.dmp

Filesize
64KB

Download
memory/1904-125-0x000001CAA25B0000-0x000001CAA25C0000-memory.dmp

Filesize
64KB

Download
memory/1904-121-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/3152-127-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/3152-122-0x000001D97DFC0000-0x000001D97DFD0000-memory.dmp

Filesize
64KB

Download
memory/3152-101-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/3152-124-0x000001D97DFC0000-0x000001D97DFD0000-memory.dmp

Filesize
64KB

Download
memory/3824-223-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/3832-91-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/3832-92-0x000001EAC8880000-0x000001EAC8890000-memory.dmp

Filesize
64KB

Download
memory/3832-98-0x000001EAC8880000-0x000001EAC8890000-memory.dmp

Filesize
64KB

Download
memory/3832-100-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/4128-84-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/4128-70-0x0000020AF4B10000-0x0000020AF4B20000-memory.dmp

Filesize
64KB

Download
memory/4128-77-0x0000020AF4AE0000-0x0000020AF4B02000-memory.dmp

Filesize
136KB

Download
memory/4128-71-0x0000020AF4B10000-0x0000020AF4B20000-memory.dmp

Filesize
64KB

Download
memory/4128-69-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/4152-62-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4152-213-0x0000000001470000-0x0000000001480000-memory.dmp

Filesize
64KB

Download
memory/4152-214-0x0000000001470000-0x0000000001480000-memory.dmp

Filesize
64KB

Download
memory/4152-63-0x0000000001470000-0x0000000001480000-memory.dmp

Filesize
64KB

Download
memory/4152-164-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4152-178-0x0000000001470000-0x0000000001480000-memory.dmp

Filesize
64KB

Download
memory/4152-189-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4340-195-0x000001C1D3C00000-0x000001C1D3C0A000-memory.dmp

Filesize
40KB

Download
memory/4340-193-0x000001C1D3BF0000-0x000001C1D3BFA000-memory.dmp

Filesize
40KB

Download
memory/4340-196-0x000001C1D40E0000-0x000001C1D40FA000-memory.dmp

Filesize
104KB

Download
memory/4340-198-0x000001C1D40B0000-0x000001C1D40B6000-memory.dmp

Filesize
24KB

Download
memory/4340-188-0x000001C1D3E80000-0x000001C1D3E9C000-memory.dmp

Filesize
112KB

Download
memory/4340-163-0x000001C1D3860000-0x000001C1D3870000-memory.dmp

Filesize
64KB

Download
memory/4340-194-0x000001C1D40C0000-0x000001C1D40DC000-memory.dmp

Filesize
112KB

Download
memory/4340-199-0x000001C1D4100000-0x000001C1D410A000-memory.dmp

Filesize
40KB

Download
memory/4340-191-0x000001C1D3EA0000-0x000001C1D3F55000-memory.dmp

Filesize
724KB

Download
memory/4340-197-0x000001C1D40A0000-0x000001C1D40A8000-memory.dmp

Filesize
32KB

Download
memory/4340-190-0x00007FF4943B0000-0x00007FF4943C0000-memory.dmp

Filesize
64KB

Download
memory/4340-203-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/4340-162-0x000001C1D3860000-0x000001C1D3870000-memory.dmp

Filesize
64KB

Download
memory/4340-200-0x000001C1D3860000-0x000001C1D3870000-memory.dmp

Filesize
64KB

Download
memory/4340-161-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/4816-218-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download
memory/4816-220-0x00007FFA2B560000-0x00007FFA2C021000-memory.dmp

Filesize
10.8MB

Download