amadey | 055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe
Size

312KB
MD5

fa404e6e0f5574b90c7ec5e3fa67dffa
SHA1

43edcda3198aea86d473dacf6cdaf084fcace5a1
SHA256

055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a
SHA512

af252b0fd65be9bb0d9687a40759681402c6b41e752a991e0d7cee0bf7e986f582c3c10c1ea4d1695d627e97ad675514edab5e119a0715a94dfedcdd0f030335
SSDEEP

3072:OgCr5Jsw0RZJ/+pYYKEXnLRgowqC2gZd0mzwNrUBqCKp6qXKAG:kszx+Jluh701JU7KpBaJ

Score

10^/10

amadey glupteba lumma smokeloader stealc pub1 backdoor bootkit discovery dropper evasion loader persistence rootkit spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

http://nidoe.org/tmp/index.php

http://sodez.ru/tmp/index.php

http://uama.com.ua/tmp/index.php

http://talesofpirates.net/tmp/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

lumma

https://resergvearyinitiani.shop/api

https://herdbescuitinjurywu.shop/api

https://relevantvoicelesskw.shop/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4452-308-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4452-306-0x0000000002DD0000-0x00000000036BB000-memory.dmp	family_glupteba
behavioral1/memory/4452-428-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4452-530-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4452-607-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

F2D0.exeexplorgu.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ F2D0.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorgu.exe
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

281 4260 rundll32.exe
282 6072 rundll32.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1940 netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	F2D0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe

flow	pid	process
281	4260	rundll32.exe
282	6072	rundll32.exe

pid	process
1940	netsh.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

F2D0.exeexplorgu.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	F2D0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	F2D0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

u1g0.1.exeu1g0.0.exeBKJJJDHDGD.exeexplorgu.exeDA26.exeEasyAppns.exeInstallSetup_four.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	u1g0.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	u1g0.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	BKJJJDHDGD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	explorgu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	DA26.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	EasyAppns.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	InstallSetup_four.exe

Deletes itself 1 IoCs

Processes:

pid process

3420

pid	process
3420

Executes dropped EXE 22 IoCs

Processes:

C63E.exeDA26.exeE1F7.exeInstallSetup_four.exe288c47bbc1871b439df19ff4df68f076.exeEasyAppns.exeapril.exeF2D0.exeapril.tmpEasyApp.exeFE89.exeflashdecompiler32.exeflashdecompiler32.exeu1g0.0.exeu1g0.1.exe288c47bbc1871b439df19ff4df68f076.exeBKJJJDHDGD.execsrss.exeinjector.exeexplorgu.exewindefender.exewindefender.exe

pid	process
1600	C63E.exe
948	DA26.exe
2324	E1F7.exe
1872	InstallSetup_four.exe
4452	288c47bbc1871b439df19ff4df68f076.exe
1320	EasyAppns.exe
4704	april.exe
5584	F2D0.exe
5592	april.tmp
5648	EasyApp.exe
6084	FE89.exe
1484	flashdecompiler32.exe
3456	flashdecompiler32.exe
5196	u1g0.0.exe
5200	u1g0.1.exe
1608	288c47bbc1871b439df19ff4df68f076.exe
5492	BKJJJDHDGD.exe
5964	csrss.exe
5984	injector.exe
5308	explorgu.exe
5228	windefender.exe
6068	windefender.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

F2D0.exeexplorgu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Wine	F2D0.exe
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Wine	explorgu.exe

Loads dropped DLL 7 IoCs

Processes:

regsvr32.exeapril.tmpu1g0.0.exerundll32.exerundll32.exerundll32.exe

pid process

2168 regsvr32.exe
5592 april.tmp
5196 u1g0.0.exe
5196 u1g0.0.exe
4776 rundll32.exe
4260 rundll32.exe
6072 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2168	regsvr32.exe
5592	april.tmp
5196	u1g0.0.exe
5196	u1g0.0.exe
4776	rundll32.exe
4260	rundll32.exe
6072	rundll32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

BKJJJDHDGD.exe288c47bbc1871b439df19ff4df68f076.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ledger-Live Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BKJJJDHDGD.exe"	BKJJJDHDGD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

FE89.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 FE89.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	FE89.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

F2D0.exeexplorgu.exe

pid process

5584 F2D0.exe
5308 explorgu.exe
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

288c47bbc1871b439df19ff4df68f076.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 288c47bbc1871b439df19ff4df68f076.exe

pid	process
5584	F2D0.exe
5308	explorgu.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	288c47bbc1871b439df19ff4df68f076.exe

Drops file in Windows directory 5 IoCs

Processes:

F2D0.exe288c47bbc1871b439df19ff4df68f076.execsrss.exe

description	ioc	process
File created	C:\Windows\Tasks\explorgu.job	F2D0.exe
File opened for modification	C:\Windows\rss	288c47bbc1871b439df19ff4df68f076.exe
File created	C:\Windows\rss\csrss.exe	288c47bbc1871b439df19ff4df68f076.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3900 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3900	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2480	2324	WerFault.exe	E1F7.exe
972	5648	WerFault.exe	EasyApp.exe
5356	1872	WerFault.exe	InstallSetup_four.exe
6028	5196	WerFault.exe	u1g0.0.exe
5984	1608	WerFault.exe	288c47bbc1871b439df19ff4df68f076.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

u1g0.1.exe055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exeC63E.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1g0.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1g0.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C63E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1g0.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C63E.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C63E.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

u1g0.0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u1g0.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u1g0.0.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5556 schtasks.exe
4016 schtasks.exe

pid	process
5556	schtasks.exe
4016	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

288c47bbc1871b439df19ff4df68f076.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1812 PING.EXE

pid	process
1812	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe

pid	process
2224	055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe
2224	055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exeC63E.exe

pid process

2224 055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe
1600 C63E.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exe288c47bbc1871b439df19ff4df68f076.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepowershell.exeBKJJJDHDGD.exe

description	pid	process
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeDebugPrivilege	4452	288c47bbc1871b439df19ff4df68f076.exe
Token: SeImpersonatePrivilege	4452	288c47bbc1871b439df19ff4df68f076.exe
Token: SeDebugPrivilege	1796	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeDebugPrivilege	5672	powershell.exe
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeDebugPrivilege	5492	BKJJJDHDGD.exe
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420
Token: SeShutdownPrivilege	3420
Token: SeCreatePagefilePrivilege	3420

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

u1g0.1.exe

pid process

5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

u1g0.1.exe

pid process

5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
5200 u1g0.1.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3420

pid	process
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe

pid	process
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe
5200	u1g0.1.exe

pid	process
3420

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exeDA26.exeapril.exeEasyAppns.exeapril.tmpInstallSetup_four.exe288c47bbc1871b439df19ff4df68f076.exeu1g0.1.exe288c47bbc1871b439df19ff4df68f076.exeu1g0.0.execmd.exe

description	pid	process	target process
PID 3420 wrote to memory of 1600	3420		C63E.exe
PID 3420 wrote to memory of 1600	3420		C63E.exe
PID 3420 wrote to memory of 1600	3420		C63E.exe
PID 3420 wrote to memory of 808	3420		regsvr32.exe
PID 3420 wrote to memory of 808	3420		regsvr32.exe
PID 808 wrote to memory of 2168	808	regsvr32.exe	regsvr32.exe
PID 808 wrote to memory of 2168	808	regsvr32.exe	regsvr32.exe
PID 808 wrote to memory of 2168	808	regsvr32.exe	regsvr32.exe
PID 3420 wrote to memory of 948	3420		DA26.exe
PID 3420 wrote to memory of 948	3420		DA26.exe
PID 3420 wrote to memory of 948	3420		DA26.exe
PID 3420 wrote to memory of 2324	3420		E1F7.exe
PID 3420 wrote to memory of 2324	3420		E1F7.exe
PID 3420 wrote to memory of 2324	3420		E1F7.exe
PID 948 wrote to memory of 1872	948	DA26.exe	InstallSetup_four.exe
PID 948 wrote to memory of 1872	948	DA26.exe	InstallSetup_four.exe
PID 948 wrote to memory of 1872	948	DA26.exe	InstallSetup_four.exe
PID 948 wrote to memory of 4452	948	DA26.exe	288c47bbc1871b439df19ff4df68f076.exe
PID 948 wrote to memory of 4452	948	DA26.exe	288c47bbc1871b439df19ff4df68f076.exe
PID 948 wrote to memory of 4452	948	DA26.exe	288c47bbc1871b439df19ff4df68f076.exe
PID 948 wrote to memory of 1320	948	DA26.exe	EasyAppns.exe
PID 948 wrote to memory of 1320	948	DA26.exe	EasyAppns.exe
PID 948 wrote to memory of 1320	948	DA26.exe	EasyAppns.exe
PID 948 wrote to memory of 4704	948	DA26.exe	april.exe
PID 948 wrote to memory of 4704	948	DA26.exe	april.exe
PID 948 wrote to memory of 4704	948	DA26.exe	april.exe
PID 3420 wrote to memory of 5584	3420		F2D0.exe
PID 3420 wrote to memory of 5584	3420		F2D0.exe
PID 3420 wrote to memory of 5584	3420		F2D0.exe
PID 4704 wrote to memory of 5592	4704	april.exe	april.tmp
PID 4704 wrote to memory of 5592	4704	april.exe	april.tmp
PID 4704 wrote to memory of 5592	4704	april.exe	april.tmp
PID 1320 wrote to memory of 5648	1320	EasyAppns.exe	EasyApp.exe
PID 1320 wrote to memory of 5648	1320	EasyAppns.exe	EasyApp.exe
PID 1320 wrote to memory of 5648	1320	EasyAppns.exe	EasyApp.exe
PID 3420 wrote to memory of 6084	3420		FE89.exe
PID 3420 wrote to memory of 6084	3420		FE89.exe
PID 3420 wrote to memory of 6084	3420		FE89.exe
PID 5592 wrote to memory of 1484	5592	april.tmp	flashdecompiler32.exe
PID 5592 wrote to memory of 1484	5592	april.tmp	flashdecompiler32.exe
PID 5592 wrote to memory of 1484	5592	april.tmp	flashdecompiler32.exe
PID 5592 wrote to memory of 3456	5592	april.tmp	flashdecompiler32.exe
PID 5592 wrote to memory of 3456	5592	april.tmp	flashdecompiler32.exe
PID 5592 wrote to memory of 3456	5592	april.tmp	flashdecompiler32.exe
PID 1872 wrote to memory of 5196	1872	InstallSetup_four.exe	u1g0.0.exe
PID 1872 wrote to memory of 5196	1872	InstallSetup_four.exe	u1g0.0.exe
PID 1872 wrote to memory of 5196	1872	InstallSetup_four.exe	u1g0.0.exe
PID 1872 wrote to memory of 5200	1872	InstallSetup_four.exe	u1g0.1.exe
PID 1872 wrote to memory of 5200	1872	InstallSetup_four.exe	u1g0.1.exe
PID 1872 wrote to memory of 5200	1872	InstallSetup_four.exe	u1g0.1.exe
PID 4452 wrote to memory of 1712	4452	288c47bbc1871b439df19ff4df68f076.exe	powershell.exe
PID 4452 wrote to memory of 1712	4452	288c47bbc1871b439df19ff4df68f076.exe	powershell.exe
PID 4452 wrote to memory of 1712	4452	288c47bbc1871b439df19ff4df68f076.exe	powershell.exe
PID 5200 wrote to memory of 1796	5200	u1g0.1.exe	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
PID 5200 wrote to memory of 1796	5200	u1g0.1.exe	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
PID 1608 wrote to memory of 5672	1608	288c47bbc1871b439df19ff4df68f076.exe	powershell.exe
PID 1608 wrote to memory of 5672	1608	288c47bbc1871b439df19ff4df68f076.exe	powershell.exe
PID 1608 wrote to memory of 5672	1608	288c47bbc1871b439df19ff4df68f076.exe	powershell.exe
PID 5196 wrote to memory of 3092	5196	u1g0.0.exe	cmd.exe
PID 5196 wrote to memory of 3092	5196	u1g0.0.exe	cmd.exe
PID 5196 wrote to memory of 3092	5196	u1g0.0.exe	cmd.exe
PID 3092 wrote to memory of 5492	3092	cmd.exe	BKJJJDHDGD.exe
PID 3092 wrote to memory of 5492	3092	cmd.exe	BKJJJDHDGD.exe
PID 3092 wrote to memory of 5492	3092	cmd.exe	BKJJJDHDGD.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe
"C:\Users\Admin\AppData\Local\Temp\055e37bf8546779aada7a3924dd4abc0ae80ebb2877ee4b15aae4c59766ee94a.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2224

C:\Users\Admin\AppData\Local\Temp\C63E.exe
C:\Users\Admin\AppData\Local\Temp\C63E.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1600

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CC88.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CC88.dll
  2⤵
  - Loads dropped DLL
  PID:2168

C:\Users\Admin\AppData\Local\Temp\DA26.exe
C:\Users\Admin\AppData\Local\Temp\DA26.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\u1g0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u1g0.0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:5196
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BKJJJDHDGD.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\BKJJJDHDGD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BKJJJDHDGD.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:5492
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\BKJJJDHDGD.exe
        6⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:1812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 2616
      4⤵
      Program crash
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\u1g0.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u1g0.1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
      "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 688
    3⤵
    - Program crash
    PID:5356
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:5672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:5452
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1940
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:5240
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      Drops file in Windows directory
      PID:5964
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5056
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:5556
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:5128
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4496
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        
        PID:5984
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:4016
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        Executes dropped EXE
        
        PID:5228
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        Launches sc.exe
        
        PID:3900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 712
      4⤵
      Program crash
      PID:5984
- C:\Users\Admin\AppData\Local\Temp\EasyAppns.exe
  "C:\Users\Admin\AppData\Local\Temp\EasyAppns.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Users\Public\Music\EasyApp.exe
    "C:\Users\Public\Music\EasyApp.exe"
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 1088
      4⤵
      Program crash
      PID:972
- C:\Users\Admin\AppData\Local\Temp\april.exe
  "C:\Users\Admin\AppData\Local\Temp\april.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Users\Admin\AppData\Local\Temp\is-8FIR8.tmp\april.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-8FIR8.tmp\april.tmp" /SL5="$A006C,1485356,54272,C:\Users\Admin\AppData\Local\Temp\april.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\Users\Admin\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe
      "C:\Users\Admin\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe" -i
      4⤵
      Executes dropped EXE
      PID:1484
  - - C:\Users\Admin\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe
      "C:\Users\Admin\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe" -s
      4⤵
      Executes dropped EXE
      PID:3456

C:\Users\Admin\AppData\Local\Temp\E1F7.exe
C:\Users\Admin\AppData\Local\Temp\E1F7.exe
1⤵
- Executes dropped EXE
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 1104
  2⤵
  - Program crash
  PID:2480

C:\Users\Admin\AppData\Local\Temp\F2D0.exe
C:\Users\Admin\AppData\Local\Temp\F2D0.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
PID:5584

C:\Users\Admin\AppData\Local\Temp\FE89.exe
C:\Users\Admin\AppData\Local\Temp\FE89.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5648 -ip 5648
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2324 -ip 2324
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1872 -ip 1872
1⤵
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5196 -ip 5196
1⤵
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1608 -ip 1608
1⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5308
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:4776
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:4260
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:3848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\098131212907_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:6072

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe

Filesize
1.4MB

MD5
a6c0994e8f7e9c62fd0b60ec30da571b

SHA1
a59232ade92bf57f80c6594ac8d6b95dfb6ccaac

SHA256
58db50c6d66818fc189f27d929db52d1a9e263fb69e168bec45caf0102f19c93

SHA512
7dc1b5b9f3fe8824d681a79ab626dce792dd0fcbf60acf123277cb2baba9c67743a06c8d94c19485c2f79cb54f3a11810d197e26439b2b00991063c0a942dd9b

Download Submit
C:\Users\Admin\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe

Filesize
896KB

MD5
1b6be626e595bdf28fc05de25e3a598d

SHA1
e11a4363c382828341429e90756e2488f43c49a6

SHA256
330d9c7292319b3c7a4d654575913bdf3ae11644f887eedd4502d1a88af8927d

SHA512
ac9e22fd1674c83596172a1046623a0748d3ad9ac8d9f9288d58172ec5546d281b9b1d1760037e2469864962d7fabc6e49ea96d7a7f5c9aa22cc4ea3bd9294e0

Download Submit
C:\Users\Admin\AppData\Local\Senior Flash Decompiler\flashdecompiler32.exe

Filesize
576KB

MD5
27af71172da8736647dbdaeee9d42001

SHA1
0899fd8c46f62f1ea3bd4bf99f3b6888eb5b9564

SHA256
411e42551d70016666a05c01636974ea476e66f3c33f6f0516c4e707dcfdf4b2

SHA512
afe0a34d2275392d4fb85b598a4d9f1d77308939af3ed07da5a330740b0e4eca6c57a81e2d1ed527361f43bfdeda208e68fddcbe4751444b3676901539f9b205

Download Submit
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

Filesize
1.8MB

MD5
dfb04c99ff9c9c5e3680e9f66eed0b42

SHA1
6f1bfffeb5d0df4af3c02969d42c075d6f8e28d8

SHA256
ec056709f6332170c8c92141476541b3730b1e610d6d8e835e1489b608ea892f

SHA512
3f7e6edb722a154094d59e8d92cdacca74e86a2853c567a4158025525780d62f0854a3eaa3007874f0d2a3ee467285313e84336a7550e06de52c86ff361696b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

Filesize
1.8MB

MD5
253f5ed6a125b1f38411a1f390ae9ac9

SHA1
418b6d3fb0b9ef54b85246febea752ec8244c7e0

SHA256
52016a0cb2675cea5efac8fedca3f81d26a0d8626ae0e5886d4c4ef08dda1e19

SHA512
9b3172c53497fe70dd0fdc4f6fc2e4b9abec205af55f865b1409b09019ead7ecf757e08c75df14229625e631d2cdf7cb66f7925c9d962a4168ddb9921044a1c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

Filesize
1.5MB

MD5
8033d19aba0fe805d3060e2d205c4b60

SHA1
e2be2bca8e28988c23d9dd8978fc22929a6003bd

SHA256
a249e197aae4c00e59d32c5da4ecf80c2c1a13cf8187da013c47c057e1ce0804

SHA512
b8e79d4f33ad634325cc43612ba9448cf35f5989d56fe5a2f112339fd859e1b81e73131ddf9b0b4c043bbae6fa79d2a90600538f57783d22c1301df4b00b0770

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
320KB

MD5
9acd857cf4985e8f3d622a9d85cb26ff

SHA1
0346667ca562d15ed5f6775b59591bfcc882a280

SHA256
2f5050c752c7c00d3017bc8699b9422e9b0428b0b44ae45a1dc4f27e52de67b4

SHA512
e9d9964b828606e8912efa1846b0295239c5496a78ffe91989f8d7db8cfe41d9bcba182d3ad428930d04727d424f1da8eb61d5f68818bbf0448401597473b409

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
2.6MB

MD5
52974f91133691fa47dbb9b5bdbcc91c

SHA1
88404a3e0608a12b02d7dd1dde31e2edc90d8aba

SHA256
c55d323dc328a9181bc9d91d29fbd1cc8eef786762b356ae59515dc51a6ff177

SHA512
f43e4701234a8740838abe729026630dd3d041a1173d434b451a0450909e6d311a86caedbb650bae4aa556a24053ca044ba2a976d11e385e3c94a3009b4560de

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
2.4MB

MD5
606439b2a114682a2ee6ebad826fd9af

SHA1
708e3410cc3402d250276ed12cd4351bb4cd7052

SHA256
31ad4287234e99358c23f6c5b52b5e67c343296a072442bcc8e8d2c81d1229a0

SHA512
9cf9d925ed55768baad5f4a6311c5f65e92cef0a43c5cc6e57b9b62cd894c3ed6e28c4312e8ffa0eefca1f610c22f5f5162ed4bdb5a3b15000ff42d69abc4cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
4.1MB

MD5
c8564b4d627953e836d0faab99740a6a

SHA1
74b37a34950bd081d10072b4dae88952a4c52178

SHA256
051b0fe6b1d01ab0cc4dee0e7270b4dd54040a5c1783b78ea612bbf37d0c6f31

SHA512
77af3dd58d16effa1a307c174add6cdd1006b2a08add287388162bb2b7b3245a77e15375da1e508bcce10f024ab0e888b16862f087941e7b165834e8ae406776

Download Submit
C:\Users\Admin\AppData\Local\Temp\BKJJJDHDGD.exe

Filesize
101KB

MD5
42b838cf8bdf67400525e128d917f6e0

SHA1
a578f6faec738912dba8c41e7abe1502c46d0cae

SHA256
0e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d

SHA512
f64b39d885375251ab7db72c57dc5b5095f0c6412169f1035d1f6a25b8415a2a01004d06bfa0267cf683ef7dea7a9f969ad43fde5a4376f1fcb65a57403433c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\C63E.exe

Filesize
313KB

MD5
a4272a7c88cc8308535ee3d009f83343

SHA1
68a121961abcd93c899e7280e897666d0008ff08

SHA256
ecb59c8684d0d10257ba1dc4d38035bfdaf749071c8a867a4c81b661c2c2ce36

SHA512
96041b91df7cfbd80a69f385d076c4a841eb0b130bace83a6a291ef6c87a0cc779bd52c6578ba00baef5f37b9d6931f267e455045346f882b11eb81a00798ae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC88.dll

Filesize
2.2MB

MD5
e69125300a060d1eb870d352de33e4c3

SHA1
60f2c2e6f2a4289a05b5c6212cdaf0d02dad82ea

SHA256
009de0571eb77c7ed594b9e5cda731e2953fd2198e00b25a0e2c4c4ef7414355

SHA512
257d3b61b2c85c1e71d2a80a5fbf44436e9734785fe6b0a643c1939dd01c1d8b98f1c454695296f7137ff035ec6c0118f053e4833e0be91618f2a9066a8cace9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA26.exe

Filesize
4.0MB

MD5
68d69ec657238f2d0aee371af7cc567d

SHA1
d6d823e9bd716f098929624dcae3884a7620c098

SHA256
a75728df98a3a7a602054c71e636c2b3c28a47019627181ae0d1a352c3ca62fd

SHA512
37ef48279527ea0ca893584519d0e3a5f0327a2c562665f38fce8c91481d9049a9d618a00ca5d1dfb656984573d721bf5fc193b39618ed5cbed0df66a4db04a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA26.exe

Filesize
3.7MB

MD5
70e0b39b61ef0821579366b73b042208

SHA1
7da9e4ea2f9a5945e7205b9c246d8324bb12897c

SHA256
ac2e064296fc1b5539e1012b192c90231f14b5fa276cb89aeea1b24f3b2e1a68

SHA512
a83a13f399810a2dfe08b631f8cc50cfe402ec4b7c57c4f5986860d1f0ab97d4f0b9884875080b16ef0c8bbe5afa93f3fc54b782d81078f9a07dd51303512656

Download Submit
C:\Users\Admin\AppData\Local\Temp\E1F7.exe

Filesize
1.2MB

MD5
49cc7f8d72febdd93762e4918dd4b412

SHA1
be6db908dbc676b88ced592d7fdebdcbe6f9da20

SHA256
7e37003fd694d0f5a110c3ecac6d9452696c6c2bcec3c96ba76ddd19b2ab4087

SHA512
172d329a51892694275e3a98470792c6bcac0836c0d67d38b6d2c8e8c6a0c58117d04e795a924668037ce6da52cdd2254f50e7ea6fecf9951e0519e48989d9f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\E1F7.exe

Filesize
512KB

MD5
cd2177adb1d2db047d852265d3ef4d5f

SHA1
5953f535aab3c0ca28a44b2baa293ada2c4d7b30

SHA256
111c3990dc3f11752ffa5fb117b32bcaa033efeb4ae76af7518aa707ae710d0d

SHA512
3a81b91715c57de2524088822b0448a30987290385df7d37495598b55ade5e4bc3386f3b8f626c5a6bc7f61e6df5616a403d1302c5ed4baa45c7b6a2284b1e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\EasyAppns.exe

Filesize
988KB

MD5
065760220981039db19b9701aaeffddf

SHA1
318170b5ca3673cff578d89b7de116f9d6fcd961

SHA256
cac5a59708cebec195aed03baf2c20b32b277ea73738d054ba40a072719160bf

SHA512
81bb505365d1a10dd902f76b24ec111b519d17c0ede500b5c47d6eab9f187f95ac2897b09e7004762455a17cfb068a47c854fd9c29957e13832bb108a6385895

Download Submit
C:\Users\Admin\AppData\Local\Temp\EasyAppns.exe

Filesize
576KB

MD5
f8f2b0590aa6cacf7986e22625aafdeb

SHA1
9a55a92ca6a0041a608134d9fc1cfe7c85fc3f28

SHA256
445f4ed9835d8ac5e2015faff3b5f090f12c7e254cc63898cfe0218b342c3e84

SHA512
b3f1730c17ab24f6fe940541efa6cb3517ffbb48a21547fd50ba2372c251a9e2a1ea2fcec955a945c4960236d1deb5b9c63b09adb7b1887ac185bebee5f426ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2D0.exe

Filesize
1.1MB

MD5
c35e1b75e0c129cf9853ed7b7fd5cab1

SHA1
6aee4c79639abeb46558e4ebd005dcdfa0096020

SHA256
f06b5e2f95ad381398cfd0ecba059ff41d425987aff169f1004e8d1297b404f6

SHA512
2d01cf63cdcafa93509c64bfa3ab8b2245dc8bbd96d91a12d0a7ea4fa4d44c07cf1ba5d8b4ca75c906c990a9c34713de4cffb5e1abc6a94107f340938cce7bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2D0.exe

Filesize
1.1MB

MD5
18a04d971146c757f14a9910a78aee0c

SHA1
dd9c7245de75e881f58e77d7d325390b23c7ab07

SHA256
dd8e6dbdceb01a4a87a6884e58f5ac0cee413213c2690da79d6f56e5171ae5d2

SHA512
23bb841556e71d80c091874337d67496975069ff8b504d6a710de64ba62b8ee6fda0d907368c774be27313de21da93d0b20a770df7052bdb516e4f668a48d875

Download Submit
C:\Users\Admin\AppData\Local\Temp\FE89.exe

Filesize
896KB

MD5
9c66abd4f9686fafda345d33662569de

SHA1
43c9a85ba22c74ff3d24258e41b5a72f39487424

SHA256
3769d12b7ee5655b4a1c0cdfb62639eded2ca03e754daf42a0a67aaa7f2f185b

SHA512
1aed9b2cab97ccbc5a2123739ba90dcccf218228b44703dace01610c115b8c518195bc6585909e6e704d58bdf16237a15bfe1277cdef04324761201f3cc58c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\FE89.exe

Filesize
832KB

MD5
ca9bf6d70e1587054361fe2998e9b3b2

SHA1
79174f3d5d2306de31609864241e8b9394f1f5bc

SHA256
bc733798be14963ad33dc29059c0d6efcb0f82529f42b2b514d40f452c096156

SHA512
18c91006b100731b8a07f3f33c36184e1ac6286e301ceb8e40d4f86db9670c3cb6198250391b3b2ae879c957120de617d2e95577cc3ea85f0f7754036e89293e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

Filesize
404KB

MD5
383c48c7f64a6867db5b8577fa3abfbf

SHA1
926911f9581df56f5ac38fac01f6d45acdfb7dbd

SHA256
9b37a304f33bda4707c0dae60a20ac7c76c75752b0d06ad9fb2d6f07f8edd1b9

SHA512
53b5d42ed93ad6f1163ed00be8cd1b66d367fadf25853c16d8c6fb710f69d9e8a32cb85d0dbf36d95c85da16b214de2a564bc0750c264bb0547dd8910a6f4442

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

Filesize
384KB

MD5
fab2096b8b2b7995d6653b99c71cc419

SHA1
7311e88d04874db5c13749f74939da0ba7e20670

SHA256
484cfec19520e0448de6eed6bc247c3e4c43913d5cee0ac8a9c713c46fd570fb

SHA512
393687cc76e8913792eb50ac1a1fc415276a7cf0ed78cf2fcef7d05205744913d46f4d425261a97d71be503f0644cb2b87e648876d8e432d85a3950189a78167

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfaa31rj.l03.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\april.exe

Filesize
1.6MB

MD5
fc124cbb469fb164c1e2dfea9038aedc

SHA1
281c35cac9f069e1f92835cd7cd9da29bd7c24e9

SHA256
7ca1c9be51ee89e622b573bb773cb75df288d4521574d650237bb3f1ec7f83e1

SHA512
b33c036abcaa5866bb005d57e1784c813bc2623cdbdee9356371986535a4c237fb8232ccad1f0369dea4c8e9aa1af9577650c27e31d7cb761532306b417ea797

Download Submit
C:\Users\Admin\AppData\Local\Temp\april.exe

Filesize
192KB

MD5
5d4ac72967d655e2768084a3d6518990

SHA1
fb958903b70a96219a7e0c2a9fd5cce47884f152

SHA256
07531662fcf7eae82e4fa1ad35eab3333ae0f4f0b56d9db0e90bb80ee0ce21f0

SHA512
ad58d15aadb1d94c1beb64e0755a17b7787cd9fcbdb1d7fc80249344804a78dfbcd7ea5f8f97330417761fc8cfa54c726acb8adca44183be2597ee87cb8dba86

Download Submit
C:\Users\Admin\AppData\Local\Temp\april.exe

Filesize
429KB

MD5
dcb7e0db4aefc90c299741178bb6a13b

SHA1
fda3d1bb163b3f3150ca75485beef4583abdbe73

SHA256
aa405181d498ebb6249c5bbc9880d053ba5ca6a7a3f65bfe739c4b070b9926a1

SHA512
13f4a4101c2eee648cfb946a7478b54cf121e6915e80f29082106f072ac0d6a63781a10b5c7ef485c839086f2762bc9f5a4e4625f28c0addf1124c105f2eedb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
b908f3d9bccce31b608355c6072b341a

SHA1
1e04d7f4addf74660d810498bce1142b95448d6f

SHA256
d35fa2f8407c1fa901b677e6df2cfc6be4a0a3e0a60cb63c7616570f51c11890

SHA512
df7853dda53f4c1e373671c74f6de1e495b87631089a0e2e4297abb9c71ca8418aee87d528b30fda2c9e075c246177defa91d9dfaa97116f9913f5fb2a4aaa89

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
3KB

MD5
77aab38e79c19501fc63993beae474d8

SHA1
1f7e8a332a89508831f0b5f11d7937c0a8e02d9d

SHA256
d6a9d98e2f71f9be7ec061fa7268b34fb07695a2065b521ca85867f544bdcbe2

SHA512
c87deedeee3c3ec9eaca0ed20c81669d4fc7881157e984768d1c856a3b3e5a31d3b54feddf03ce17fb9ba2c980fab4401af65759d21c94571fbbce9f2e9e11a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8FIR8.tmp\april.tmp

Filesize
677KB

MD5
8519bfba2d14dbdca979e73c62ed4b46

SHA1
388030278d4f7e4d88754adc3ff95df54e01eda9

SHA256
6848c671e27c33dd065e1d70c9be0a4205ad69ec9b4b4b356d03eb8dc73ddeb5

SHA512
a1bfd50e48a82f7b100de76674a082eb77ac385b7ccc5ba574f45b97e2e4a992541a992b979b266b9e6bd27eddec02f943b776ed0210d5b788954e15463921aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UNT11.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1g0.0.exe

Filesize
313KB

MD5
af18a4dd8756963f563181c06b9a5f2a

SHA1
0ed6466d2671a581cd4ae90ab8e7a476be48cb95

SHA256
244fc2603ec7810801f663f2e1c944ff51ecaea1bcc3bf5d08fc7012fdf28b71

SHA512
617cc693cb9d521d4d7978f0579a6d47c36e0604238084880de577ef88e23573c34975a4853a1d2e5c4b4704de78b4648f35d7348012803136156b2a6ae5bdef

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1g0.0.exe

Filesize
14KB

MD5
a5caebdfd810b40e670323e1ee0c4a68

SHA1
a4e1a5b3d50e3ceae2dfb7dbb3c19bfbb4efa620

SHA256
b8ccaf18a3b58f62c613621dd6788c31df95cf2af5124a3f4dab2f8cba6078f8

SHA512
36fc1165a10e27628c12f4de21666f26d60d5f26d018682bd91e7e2ff828997d5be733970ded940f2804ae013279e91ee39e5c7a2b2cfbca485b7eb80a0f82b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1g0.1.exe

Filesize
3.3MB

MD5
0a42e4ec1c3c7d120a4d96c00ffa1b16

SHA1
cbcc5ce358350042c8da719161b962278cebe78f

SHA256
1b5d3b882ddaec11e10a1b26726caaeed74289d6429d5e903685da2553d82bab

SHA512
3f8d1af0155020246cba7b01d54f0b2bb1a5b8ce3d08fefecacd071f58bd3180d8a3dfa23c9a630db6f04d23793555e7522e14d51f81be0f74cd02ef8d2572d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1g0.1.exe

Filesize
2.8MB

MD5
2a0ffe1da593f1a4b7bb348f5c3c56e2

SHA1
942f33925d18f6d5874fffd550472d7904b5e18a

SHA256
a77f9dd1f5a74bf92f7946c8bd8fae41409e341834529deb0e6d254336d9f1ce

SHA512
bf5182259fe412db2264cbe94ea081963e845d1244297e34f1e24879942697ec2d1b11d3868f30c25ae85a6bf417d07a22b0f85c06bd1803429743970815d01f

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1g0.1.exe

Filesize
3.2MB

MD5
b911d13a16edc205a8e56e0a6c9436c0

SHA1
29fb10bac40b87aff8349235d6e85b13041858c5

SHA256
bc8381badda264919ffc77550188bb94cde353a678202cc962f52691709eeea3

SHA512
f752781257c58fdde6f131f4940f5c0d6bebdeed174edfbebef11615371837058844ec5c055af5d33dc6dd7fdd39d6a66deadfabbf4a48f773b2e2767b2fee58

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
109KB

MD5
2afdbe3b99a4736083066a13e4b5d11a

SHA1
4d4856cf02b3123ac16e63d4a448cdbcb1633546

SHA256
8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

SHA512
d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
1.2MB

MD5
92fbdfccf6a63acef2743631d16652a7

SHA1
971968b1378dd89d59d7f84bf92f16fc68664506

SHA256
b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

SHA512
b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

Download Submit
C:\Users\Admin\AppData\Roaming\wiajgta

Filesize
128KB

MD5
9a257316ba3f8d6339102e0af7ebd871

SHA1
cccb834e6dfdb0aad6e445d6b7187aed5736f913

SHA256
beb8e8b4ee588853efcf488323087ad6862ce09cb01694a26c76ac59835f40c3

SHA512
f380348b55af71d0d5ccf267c0609234ae1b798c45d92da3c31ea0047bc73d0f9b64c09cc13691ccde180bcb2c0f0f630f3718167f584cfc2c9f85907578c2a4

Download Submit
C:\Users\Public\Music\EasyApp.exe

Filesize
341KB

MD5
0e49e66fd0e90ac46ad9f027df419048

SHA1
357559abc784e69245db2e4302c838913df618b2

SHA256
599fbee1c0335d5f8efae7ed35eed9700001841005158a1c8c6648b53a6e4bda

SHA512
38aa37d633795de8ad65749a11da261e9f3aa2e1f285cd95e89a895c76e28a7d1fb72e87776013e8b508b9201d1b7ce92462c85cb4e3d55d5cf9b5a802479fed

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
1143244100077c73a983ef49e2dcf1b1

SHA1
5c6beb32e0d3c306dda32d38cc3007201c62d1ef

SHA256
b2e86d8f30adea0cd7c512601d1b9d944f8ebeb7cdbfff51b744cadcb41a40a1

SHA512
9b6bab03e379f8d34d250913ff554be4437eaf78c4f3580cb739e2cd088ea45262ed0b23960ae011ee6e866b1e3f37fb2c38ec6ae642994225fc34fd35375cca

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
57d36966897dfc79c35868af74a9e7ce

SHA1
095a50de19039810ae366d4bcaf30396bfba6e0a

SHA256
b92701e161b85942968cbdbe432284cf93ef58d32ace61c4177578b9e74b9f4f

SHA512
5ed78d60d5437cb4306d0987d6bc0d6bc52dcc796a2d20bee146005f1ed036d21b087274fad291988ed7454bad6289476ea1be08487103d7c9cae0a1fd0df029

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
5efb44007cb16d06142de35a238ba5a9

SHA1
1da525886067207e37d62fe4677ef483b404ab59

SHA256
03708819040fc74af38ecc297a108a776c37cf713a570889f7ef5c2b4cbb5634

SHA512
9dc36f060c9e38bdd23b5bf10a1cc9c79176cb6230030bbc76fd4bda14d06f4dfb0b952b60dc3218a11b208eb8412f8548d4824a13c4c430b9469fb4771a6aa4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
6531bbb39fbe74352c1c5e8676abd01a

SHA1
6992b3a78f46c57cc5f49cf022d221a9fb7609c0

SHA256
765303f3bdc70155fc197b8777e3ffdffe25a8b905de25a8453026290658e3d4

SHA512
cdec4addb63fe5f45d59ab5a0669de654083e1be999618b5f6eefa8273d5f565598ef3bfd5a6aeb800dc4302838b453c5aa994fcb1adbd381cf0a317379a85ac

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
17a0a4222172063f187298f7d5068b21

SHA1
c93eb339de6f9ac7612e62e8cbb9e62d54dfed0c

SHA256
82e68413f04c1fb207b5a9950a5f65bf4d9c4ff6772ea4a5e16d346355885b08

SHA512
b04497a01e6c1fffd4997434d797fbada5252e778c04cb010f1c78fb4896ce8197e1bcdd6abbda51f254e415688397a7476dab69ea9a6a51a4ce7b9861d44e8e

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/948-34-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/948-302-0x0000000074420000-0x0000000074BD0000-memory.dmp

Filesize
7.7MB

Download
memory/948-33-0x0000000000EE0000-0x0000000001620000-memory.dmp

Filesize
7.2MB

Download
memory/1484-378-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1484-384-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1600-32-0x0000000000400000-0x0000000002D4C000-memory.dmp

Filesize
41.3MB

Download
memory/1600-18-0x0000000000400000-0x0000000002D4C000-memory.dmp

Filesize
41.3MB

Download
memory/1600-17-0x0000000002EB0000-0x0000000002EBB000-memory.dmp

Filesize
44KB

Download
memory/1600-16-0x0000000002F10000-0x0000000003010000-memory.dmp

Filesize
1024KB

Download
memory/1712-440-0x0000000004ED0000-0x0000000004EF2000-memory.dmp

Filesize
136KB

Download
memory/1712-471-0x0000000005EB0000-0x0000000005ECE000-memory.dmp

Filesize
120KB

Download
memory/1712-427-0x0000000002550000-0x0000000002586000-memory.dmp

Filesize
216KB

Download
memory/1712-431-0x0000000005270000-0x0000000005898000-memory.dmp

Filesize
6.2MB

Download
memory/1712-432-0x0000000072A80000-0x0000000073230000-memory.dmp

Filesize
7.7MB

Download
memory/1712-434-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/1712-433-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/1712-450-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/1712-455-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/1712-457-0x0000000005A10000-0x0000000005D64000-memory.dmp

Filesize
3.3MB

Download
memory/1872-63-0x0000000000840000-0x0000000000940000-memory.dmp

Filesize
1024KB

Download
memory/1872-407-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1872-405-0x0000000000840000-0x0000000000940000-memory.dmp

Filesize
1024KB

Download
memory/1872-456-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1872-65-0x00000000021E0000-0x000000000224F000-memory.dmp

Filesize
444KB

Download
memory/1872-67-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1872-397-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2168-23-0x0000000010000000-0x0000000010239000-memory.dmp

Filesize
2.2MB

Download
memory/2168-214-0x00000000028C0000-0x00000000029E3000-memory.dmp

Filesize
1.1MB

Download
memory/2168-22-0x0000000002430000-0x0000000002436000-memory.dmp

Filesize
24KB

Download
memory/2168-327-0x00000000029F0000-0x0000000002AF8000-memory.dmp

Filesize
1.0MB

Download
memory/2168-322-0x00000000029F0000-0x0000000002AF8000-memory.dmp

Filesize
1.0MB

Download
memory/2168-326-0x00000000029F0000-0x0000000002AF8000-memory.dmp

Filesize
1.0MB

Download
memory/2168-317-0x0000000010000000-0x0000000010239000-memory.dmp

Filesize
2.2MB

Download
memory/2224-1-0x0000000002D80000-0x0000000002E80000-memory.dmp

Filesize
1024KB

Download
memory/2224-5-0x0000000000400000-0x0000000002D4C000-memory.dmp

Filesize
41.3MB

Download
memory/2224-3-0x0000000000400000-0x0000000002D4C000-memory.dmp

Filesize
41.3MB

Download
memory/2224-2-0x0000000002D60000-0x0000000002D6B000-memory.dmp

Filesize
44KB

Download
memory/2324-70-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-102-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-409-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-55-0x0000000000A90000-0x0000000000E36000-memory.dmp

Filesize
3.6MB

Download
memory/2324-435-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-78-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-185-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-406-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-80-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-399-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-255-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-408-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/2324-398-0x0000000000670000-0x00000000006A2000-memory.dmp

Filesize
200KB

Download
memory/3420-26-0x0000000002070000-0x0000000002086000-memory.dmp

Filesize
88KB

Download
memory/3420-4-0x0000000001ED0000-0x0000000001EE6000-memory.dmp

Filesize
88KB

Download
memory/3456-521-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3456-589-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/3456-400-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/4452-304-0x00000000029D0000-0x0000000002DCA000-memory.dmp

Filesize
4.0MB

Download
memory/4452-308-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4452-306-0x0000000002DD0000-0x00000000036BB000-memory.dmp

Filesize
8.9MB

Download
memory/4452-530-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4452-410-0x00000000029D0000-0x0000000002DCA000-memory.dmp

Filesize
4.0MB

Download
memory/4452-428-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4452-607-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4704-429-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4704-218-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5196-424-0x0000000000400000-0x0000000002D4C000-memory.dmp

Filesize
41.3MB

Download
memory/5196-459-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/5196-591-0x0000000000400000-0x0000000002D4C000-memory.dmp

Filesize
41.3MB

Download
memory/5196-523-0x0000000000400000-0x0000000002D4C000-memory.dmp

Filesize
41.3MB

Download
memory/5196-412-0x0000000004950000-0x0000000004977000-memory.dmp

Filesize
156KB

Download
memory/5196-411-0x0000000002EB0000-0x0000000002FB0000-memory.dmp

Filesize
1024KB

Download
memory/5200-438-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/5200-588-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/5200-528-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/5584-385-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/5584-390-0x00000000002A0000-0x0000000000769000-memory.dmp

Filesize
4.8MB

Download
memory/5584-321-0x00000000002A0000-0x0000000000769000-memory.dmp

Filesize
4.8MB

Download
memory/5584-370-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/5584-338-0x0000000077634000-0x0000000077636000-memory.dmp

Filesize
8KB

Download
memory/5584-359-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/5584-372-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/5584-380-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/5584-357-0x00000000002A0000-0x0000000000769000-memory.dmp

Filesize
4.8MB

Download
memory/5584-375-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/5584-369-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/5584-368-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/5584-364-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/5592-437-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/5592-323-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/5648-377-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/5648-379-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/5648-376-0x0000000002060000-0x00000000020A8000-memory.dmp

Filesize
288KB

Download
memory/5648-439-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/5648-381-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/6084-386-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/6084-519-0x0000000000400000-0x0000000000512000-memory.dmp

Filesize
1.1MB

Download