zgrat | d0be212a60bf7479492be23497cf0e933b8c6fda4e68b0d9724c7dc18e30fa37

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

10f54a1a68bce057dc9abbc2851a6235.exe
Size

1.9MB
MD5

10f54a1a68bce057dc9abbc2851a6235
SHA1

aa70b6be5f6e35655d0a5e25c450b47f4a23ffd0
SHA256

d0be212a60bf7479492be23497cf0e933b8c6fda4e68b0d9724c7dc18e30fa37
SHA512

27f969892fa902c262bbe0e06406be3590f5d3184a619d7f0d4d09f9850ea3ae2a17df9cd8ed40ddaa7a4eb660e214ff22a65d48796a86fc34f60ec7e402f9a8
SSDEEP

24576:2TbBv5rUyXVJscKze7Cuj+1u6YVz+AOJCxYdSxb5MNi4mJy57SPw3eKS+JE204XB:IBJq6n+0YdQ+iylSI3DE2o7OOW

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 5 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000141a2-9.dat	family_zgrat_v1
behavioral1/memory/2712-13-0x0000000000A60000-0x0000000000C02000-memory.dmp	family_zgrat_v1
behavioral1/memory/344-53-0x0000000001280000-0x0000000001422000-memory.dmp	family_zgrat_v1
behavioral1/memory/2988-82-0x00000000012B0000-0x0000000001452000-memory.dmp	family_zgrat_v1
behavioral1/memory/1460-153-0x00000000000A0000-0x0000000000242000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontrefcrt\\Idle.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\lsass.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\MsintoRefcommonsvc.exe\", \"C:\\Windows\\Web\\Wallpaper\\Landscapes\\winlogon.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontrefcrt\\Idle.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\lsass.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\MsintoRefcommonsvc.exe\", \"C:\\Windows\\Web\\Wallpaper\\Landscapes\\winlogon.exe\", \"C:\\Users\\Default\\Documents\\My Music\\taskhost.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontrefcrt\\Idle.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\lsass.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\MsintoRefcommonsvc.exe\", \"C:\\Windows\\Web\\Wallpaper\\Landscapes\\winlogon.exe\", \"C:\\Users\\Default\\Documents\\My Music\\taskhost.exe\", \"C:\\fontrefcrt\\MsintoRefcommonsvc.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontrefcrt\\Idle.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontrefcrt\\Idle.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\lsass.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\fontrefcrt\\Idle.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\lsass.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\MsintoRefcommonsvc.exe\""	MsintoRefcommonsvc.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2452	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2452	schtasks.exe	32

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 12 IoCs

pid	Process
2712	MsintoRefcommonsvc.exe
344	taskhost.exe
1852	taskhost.exe
2988	taskhost.exe
2336	taskhost.exe
1696	taskhost.exe
2220	taskhost.exe
1748	taskhost.exe
1460	taskhost.exe
1836	taskhost.exe
2128	taskhost.exe
2584	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2644	cmd.exe
2644	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MsintoRefcommonsvc = "\"C:\\fontrefcrt\\MsintoRefcommonsvc.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\fontrefcrt\\Idle.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\lsass.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsintoRefcommonsvc = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\MsintoRefcommonsvc.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\Web\\Wallpaper\\Landscapes\\winlogon.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default\\Documents\\My Music\\taskhost.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsintoRefcommonsvc = "\"C:\\fontrefcrt\\MsintoRefcommonsvc.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\fontrefcrt\\Idle.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\lsass.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MsintoRefcommonsvc = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\MsintoRefcommonsvc.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\Web\\Wallpaper\\Landscapes\\winlogon.exe\""	MsintoRefcommonsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default\\Documents\\My Music\\taskhost.exe\""	MsintoRefcommonsvc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\slsogk.exe	csc.exe
File created	\??\c:\Windows\System32\CSC1E3441C0F91D4FE4ACD457829B47F69.TMP	csc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Web\Wallpaper\Landscapes\winlogon.exe	MsintoRefcommonsvc.exe
File created	C:\Windows\Web\Wallpaper\Landscapes\cc11b995f2a76d	MsintoRefcommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1524	schtasks.exe
1652	schtasks.exe
1300	schtasks.exe
1384	schtasks.exe
2576	schtasks.exe
2824	schtasks.exe
1212	schtasks.exe
2056	schtasks.exe
1268	schtasks.exe
2636	schtasks.exe
2272	schtasks.exe
2180	schtasks.exe
2868	schtasks.exe
2696	schtasks.exe
2296	schtasks.exe
3028	schtasks.exe
1764	schtasks.exe
1976	schtasks.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
1620	PING.EXE
1728	PING.EXE
1732	PING.EXE
572	PING.EXE
1116	PING.EXE
2596	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
2712	MsintoRefcommonsvc.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
344	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
1852	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2988	taskhost.exe
2336	taskhost.exe
2336	taskhost.exe
2336	taskhost.exe
2336	taskhost.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	MsintoRefcommonsvc.exe
Token: SeDebugPrivilege	344	taskhost.exe
Token: SeDebugPrivilege	1852	taskhost.exe
Token: SeDebugPrivilege	2988	taskhost.exe
Token: SeDebugPrivilege	2336	taskhost.exe
Token: SeDebugPrivilege	1696	taskhost.exe
Token: SeDebugPrivilege	2220	taskhost.exe
Token: SeDebugPrivilege	1748	taskhost.exe
Token: SeDebugPrivilege	1460	taskhost.exe
Token: SeDebugPrivilege	1836	taskhost.exe
Token: SeDebugPrivilege	2128	taskhost.exe
Token: SeDebugPrivilege	2584	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3008	2392	10f54a1a68bce057dc9abbc2851a6235.exe	28
PID 2392 wrote to memory of 3008	2392	10f54a1a68bce057dc9abbc2851a6235.exe	28
PID 2392 wrote to memory of 3008	2392	10f54a1a68bce057dc9abbc2851a6235.exe	28
PID 2392 wrote to memory of 3008	2392	10f54a1a68bce057dc9abbc2851a6235.exe	28
PID 3008 wrote to memory of 2644	3008	WScript.exe	29
PID 3008 wrote to memory of 2644	3008	WScript.exe	29
PID 3008 wrote to memory of 2644	3008	WScript.exe	29
PID 3008 wrote to memory of 2644	3008	WScript.exe	29
PID 2644 wrote to memory of 2712	2644	cmd.exe	31
PID 2644 wrote to memory of 2712	2644	cmd.exe	31
PID 2644 wrote to memory of 2712	2644	cmd.exe	31
PID 2644 wrote to memory of 2712	2644	cmd.exe	31
PID 2712 wrote to memory of 1696	2712	MsintoRefcommonsvc.exe	36
PID 2712 wrote to memory of 1696	2712	MsintoRefcommonsvc.exe	36
PID 2712 wrote to memory of 1696	2712	MsintoRefcommonsvc.exe	36
PID 1696 wrote to memory of 2784	1696	csc.exe	38
PID 1696 wrote to memory of 2784	1696	csc.exe	38
PID 1696 wrote to memory of 2784	1696	csc.exe	38
PID 2712 wrote to memory of 1156	2712	MsintoRefcommonsvc.exe	54
PID 2712 wrote to memory of 1156	2712	MsintoRefcommonsvc.exe	54
PID 2712 wrote to memory of 1156	2712	MsintoRefcommonsvc.exe	54
PID 1156 wrote to memory of 1492	1156	cmd.exe	56
PID 1156 wrote to memory of 1492	1156	cmd.exe	56
PID 1156 wrote to memory of 1492	1156	cmd.exe	56
PID 1156 wrote to memory of 572	1156	cmd.exe	57
PID 1156 wrote to memory of 572	1156	cmd.exe	57
PID 1156 wrote to memory of 572	1156	cmd.exe	57
PID 1156 wrote to memory of 344	1156	cmd.exe	58
PID 1156 wrote to memory of 344	1156	cmd.exe	58
PID 1156 wrote to memory of 344	1156	cmd.exe	58
PID 344 wrote to memory of 1800	344	taskhost.exe	59
PID 344 wrote to memory of 1800	344	taskhost.exe	59
PID 344 wrote to memory of 1800	344	taskhost.exe	59
PID 1800 wrote to memory of 1328	1800	cmd.exe	61
PID 1800 wrote to memory of 1328	1800	cmd.exe	61
PID 1800 wrote to memory of 1328	1800	cmd.exe	61
PID 1800 wrote to memory of 1116	1800	cmd.exe	62
PID 1800 wrote to memory of 1116	1800	cmd.exe	62
PID 1800 wrote to memory of 1116	1800	cmd.exe	62
PID 1800 wrote to memory of 1852	1800	cmd.exe	63
PID 1800 wrote to memory of 1852	1800	cmd.exe	63
PID 1800 wrote to memory of 1852	1800	cmd.exe	63
PID 1852 wrote to memory of 1792	1852	taskhost.exe	66
PID 1852 wrote to memory of 1792	1852	taskhost.exe	66
PID 1852 wrote to memory of 1792	1852	taskhost.exe	66
PID 1792 wrote to memory of 2024	1792	cmd.exe	68
PID 1792 wrote to memory of 2024	1792	cmd.exe	68
PID 1792 wrote to memory of 2024	1792	cmd.exe	68
PID 1792 wrote to memory of 2128	1792	cmd.exe	69
PID 1792 wrote to memory of 2128	1792	cmd.exe	69
PID 1792 wrote to memory of 2128	1792	cmd.exe	69
PID 1792 wrote to memory of 2988	1792	cmd.exe	70
PID 1792 wrote to memory of 2988	1792	cmd.exe	70
PID 1792 wrote to memory of 2988	1792	cmd.exe	70
PID 2988 wrote to memory of 2928	2988	taskhost.exe	71
PID 2988 wrote to memory of 2928	2988	taskhost.exe	71
PID 2988 wrote to memory of 2928	2988	taskhost.exe	71
PID 2928 wrote to memory of 3052	2928	cmd.exe	73
PID 2928 wrote to memory of 3052	2928	cmd.exe	73
PID 2928 wrote to memory of 3052	2928	cmd.exe	73
PID 2928 wrote to memory of 2596	2928	cmd.exe	74
PID 2928 wrote to memory of 2596	2928	cmd.exe	74
PID 2928 wrote to memory of 2596	2928	cmd.exe	74
PID 2928 wrote to memory of 2336	2928	cmd.exe	75

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\10f54a1a68bce057dc9abbc2851a6235.exe
"C:\Users\Admin\AppData\Local\Temp\10f54a1a68bce057dc9abbc2851a6235.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\fontrefcrt\JfSdr.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\fontrefcrt\YPm3Ri0zuGSw0d5cA9MOsCVgRsbtCEjXWkwqUVDQU6Ex.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\fontrefcrt\MsintoRefcommonsvc.exe
      "C:\fontrefcrt/MsintoRefcommonsvc.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y11wbjbb\y11wbjbb.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1696
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A6F.tmp" "c:\Windows\System32\CSC1E3441C0F91D4FE4ACD457829B47F69.TMP"
        6⤵
        
        PID:2784
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8JrnJ3bRZ6.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1156
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1492
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:572
      - C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dQkVphdv7k.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:1116
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PLxqGDTluw.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2128
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DHvlNttrQi.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3052
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:2596
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z3scJZvfCA.bat"
        13⤵
        
        PID:2860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2884
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XGPt9CNEzD.bat"
        15⤵
        
        PID:1636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1716
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:1620
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HO9VPMedbR.bat"
        17⤵
        
        PID:1532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2184
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:1728
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0H3zCkvC0l.bat"
        19⤵
        
        PID:2712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2352
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2944
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5L6QW14j7D.bat"
        21⤵
        
        PID:1224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1328
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XX22crJjk3.bat"
        23⤵
        
        PID:860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:908
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:1732
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j5cqYlxHIW.bat"
        25⤵
        
        PID:2356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2400
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2264
        
        C:\Users\Default\Documents\My Music\taskhost.exe
        
        "C:\Users\Default\Documents\My Music\taskhost.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\fontrefcrt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\fontrefcrt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\fontrefcrt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsintoRefcommonsvcM" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\MsintoRefcommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsintoRefcommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\MsintoRefcommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsintoRefcommonsvcM" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\MsintoRefcommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\Web\Wallpaper\Landscapes\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Landscapes\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\Web\Wallpaper\Landscapes\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Documents\My Music\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Music\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Documents\My Music\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsintoRefcommonsvcM" /sc MINUTE /mo 9 /tr "'C:\fontrefcrt\MsintoRefcommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsintoRefcommonsvc" /sc ONLOGON /tr "'C:\fontrefcrt\MsintoRefcommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsintoRefcommonsvcM" /sc MINUTE /mo 8 /tr "'C:\fontrefcrt\MsintoRefcommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0H3zCkvC0l.bat

Filesize
224B

MD5
b7abfe2ed630f595c08c635afeb43a08

SHA1
0b326d02782e7d879acdaca438fd970002eb7bb5

SHA256
ecb5562707b5491dfba4ffc20b888cd43eb6820501b270ce15fb8bbcc956a412

SHA512
9505221614d4fc97bf4f535d8bba62fd5230cde3dc07ef955421292e689167bdd52497db210f8124f3d1e202ce7bfc7a3e1a38458f212ce72bf8045279b701e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5L6QW14j7D.bat

Filesize
224B

MD5
ad1b776655d00d26ab284493785553b2

SHA1
cec7892d6e8f519edf25d5228d405cd329562e97

SHA256
bd734a4cb2deb8673f0c7ead19a31faebc87aa4115a8c599bdb73686cb6c0a7d

SHA512
3fa8e450d5614f2476bb082b5192a8a9a21c488a42055e6c2d9016d04ae752d227030917232d58a6287b8d02dd14f8a8c358d66a102bcb75f46b3ede082a63a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\8JrnJ3bRZ6.bat

Filesize
176B

MD5
3172bdfb9e20e8610a4a73bd7d6e9f34

SHA1
29fd64d0bbb22630cb6c4d3f1c1e18e780a8817e

SHA256
62df5f422bc14188ac110e05b3e0c406de984884410ecc6e4cd70a39634b7b50

SHA512
17d8186d74cb59732dd49cf320177aa769bd021d70935053701c289a09179415bf608fb4131ff5e8852feb799e2d1797cd7cf83b5b1fe41d24762c83c79c5119

Download Submit
C:\Users\Admin\AppData\Local\Temp\DHvlNttrQi.bat

Filesize
176B

MD5
e59f5143bb85761deb76386c4a9365d6

SHA1
b80a6519af0cd0278180385093d86dcaeedaab17

SHA256
b3b402f5a0eee51b77db4b3089af2c29fe224a6e636c55927ab43139da0e8b0b

SHA512
fda28ba66f4a35708fbf1b0f2b9e3de19aab942cb493c978ec646d3930621282328e1cdabc78e2480707f5cee4c288a3d9bbf74acec4eefcd4a5fcff72573986

Download Submit
C:\Users\Admin\AppData\Local\Temp\HO9VPMedbR.bat

Filesize
176B

MD5
91421c050fdc0b21ca26bc13300b7bb8

SHA1
0e114d58dfb81844528594c3557aa926054cf2d0

SHA256
5914320b183d149f1e39c38b080d840d412dce32c832811bab902930927a5da7

SHA512
b4987348a35d688a422d85a981000024e7377efa76929b93a6c57f485fd668c2d69c7db8f4728dccb1f756483ea506942cae7b42d0439dbe71507197fcd92cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\PLxqGDTluw.bat

Filesize
224B

MD5
e4d5c86ac0ab4d9b4e1a10a0ec106af6

SHA1
ef703563b34518d22cac4258577a37fb1daa710f

SHA256
43c66b00aa7a6dda544c0478d54884c014e155b1d1c0bf50fc1155ead3483b74

SHA512
ccbad1343dbd059c9ad71e2614995160be9463945170703e1285150eb7c83b7fc773b5b4c062b5cef0faa6330fa620e9f077aa6fd42a7fc79a05a630d5b6f061

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5A6F.tmp

Filesize
1KB

MD5
d8acf94e3cb7fc0e0a03d88cbf52d702

SHA1
7d93bc11eeec47accaa28276ef2a88dab8d370d2

SHA256
fa734d31997064f70834ed4dfebedd1b20ebc5ed007b39c972340da81955b6d7

SHA512
8bf4e25b722d74d2d0616af3b530cf0a1b0a16cead115d807267d7e5ec1e96dddd59b845c179539db796a7603b468bf613780ed455defe406a9242fa8d6978b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XGPt9CNEzD.bat

Filesize
176B

MD5
5092eb22806305946839e38f59ff5589

SHA1
c769d9f5200ec5c18c5e2e63f3159ebc221e49a0

SHA256
d8daab404d0f0e9d8ba792ed1b7c681b30d5596c7f9e4538cd4fde63b036c955

SHA512
b505fda80c99dffb6bb2828faee21741d4766d425105b8a46da08b62899dfa1c9d69418fdd4195834b5269fac5a2863adfdc1a50fe78c8d37e6086021a2525f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX22crJjk3.bat

Filesize
176B

MD5
a39670462878477ea8fdf2972ed4c986

SHA1
5b8ea48dbb3b8c54ccb3319700f67f58569091f4

SHA256
64bc3147b9f17d646985435f9aece68e1282252c699aed61e599826b4c11ac36

SHA512
7cc4b0561d3c040ac7e8a7b4d423bd35215ea2db7afc74352347c3c0a2e866713ce41ed320d27421dce65486c179e12fca7f5ebae3c01b390a63e122188864c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z3scJZvfCA.bat

Filesize
224B

MD5
2467a3dc21a13a0ff1f1b76f4f0bf92b

SHA1
b3b1339e4a02736b748171615af79456403b5ec3

SHA256
72599d827ed2e5ddcc9e237f699ee71ee288595adcb71a759471d25b6e966353

SHA512
eb5fd9d1d9d36cf9d3ca7073d57d0f8038d3df3a388f86d377c3cecf2620860023574f8690341f6e0837fa3a9f2b711f47a3a5062ad8f98c370b7444ab6d9c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\dQkVphdv7k.bat

Filesize
176B

MD5
df024450fa0cccd3d772d1ae624ef906

SHA1
8c47ecb3713998534511d3591cffbe962d8ef47b

SHA256
4c3808f50c837d0beba702c7f43c717122dbcd3c92a5c35420617ed3dd8b0a4a

SHA512
57433d0273e8bc6851e299aefd6cda26ea90fea2aab8a03000bc901e7b2af9ace1e06b512748ffda6739cc4af538a5c9af4a98ef955b9cd1ee0b9065193c63f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\j5cqYlxHIW.bat

Filesize
224B

MD5
670515851b491e930aa21ec63834b868

SHA1
56d581fee6424837c8f1fdf9bc8b421b83043106

SHA256
eccc3253dea67a986ffbbc72416d82dde455a9f2cf0ed2fb974a9d4ef119e0d8

SHA512
d9a5bcdaa0ca9f988099d6e6b1c0380f35a5ebe1f37b50e56a3fac485898d916ee5eb31e876ce8a642f8f3192062975c6d5c3ea8f9c952dbc23f981424180bad

Download Submit
C:\fontrefcrt\JfSdr.vbe

Filesize
233B

MD5
51dd9e9dc66c159a08e01eebfa40550c

SHA1
fa1b5efb7fd8ce172207b10b535f81c9464adbd0

SHA256
8b07b84bcc35be88ae179f7d255958b23cd18cc22793b224ab41b1001597539c

SHA512
dda3a17bfdfbece5312b7d515d1de4bec2dbd62305e4cbbbc1aee27a948bb957218d556b908aad6d971569d66db1b11ebdbd2321239b7bba0e3008bd0d7345df

Download Submit
C:\fontrefcrt\YPm3Ri0zuGSw0d5cA9MOsCVgRsbtCEjXWkwqUVDQU6Ex.bat

Filesize
85B

MD5
e2bb5d299a1f5e700aff351e4d6bdc87

SHA1
f82ee16a655fbe451b0abf7d498ee6e9633b79f5

SHA256
70993080af47510bdc510f02419c9bdbc5fb9d68fa7eedefa084aefe65d4309d

SHA512
9fa28db03850079f5e19b5c20bece20f3b9ad7c6e3df884ae8ce22a7d09f5172793d1cacd83683990cb381f581676684f7b85c75e44e2a7a9e7cecef26ba3b83

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y11wbjbb\y11wbjbb.0.cs

Filesize
354B

MD5
34b8c167464d0114d4a5a8295612fc57

SHA1
4e301addeade3d5d5a8469d4469489b8b3e7d599

SHA256
0be654fac7d7e023794fb248f931bb713d32d9fe38ff22a73fa3d76dde6e47ba

SHA512
c05bafcc5daba2a94c0908b0a9011b2efe95988337ee711eefdcfedfeb7962e83aba99fa39b283a6268443a76aa4737f1e3b57ed67b7b81cd3912c01792e5513

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\y11wbjbb\y11wbjbb.cmdline

Filesize
235B

MD5
cb5cda5ec0deb1674ce26bb9611841ea

SHA1
be515d6169b3676783aa3bb2185266e1dbd4a40f

SHA256
fd97909d3978032dd6b9898b54bd05127ce2f9d728a760f9fd5ff403cd49bcf7

SHA512
a7cda39b03ce5cbb47a6698d976e8f98ebe829ccacf18a7cf6d8779be2477b26f531e37e0051c56559231fb1671179ebbf7821124312ac50716ec9f4ba0a7dc5

Download Submit
\??\c:\Windows\System32\CSC1E3441C0F91D4FE4ACD457829B47F69.TMP

Filesize
1KB

MD5
3fcb2bd8a227751c0367dff5940613bb

SHA1
bcca174ab4499de5713d836fbc368966aa1f5b2c

SHA256
aca1f364ec354097cdecc50336698c1180b10ae84fc6051eab154482e0965e8c

SHA512
c7357bb6ee27df96ba39066e893ce8521cb1d5c550be24ced7f860e11cc36ecc04fbec14f61da920bca04e0ae150df8dbc53de0c4a6880afa6067bccfe767672

Download Submit
\fontrefcrt\MsintoRefcommonsvc.exe

Filesize
1.6MB

MD5
65f6b916c8bd52ddad601807f96bc373

SHA1
f02dc96fdcfa8f9f15a6da9f333516e17429693c

SHA256
a63b87ed58bed0ec8eacd16f57045a25a05d03bfc6a0b4957f45c76997bec0d8

SHA512
0dd14259265f466576fb8df29e9abb4f5db97ea8a48a8f6aee5f2c75ae7a0eebb96ec828c755b901b5dab79a9b3adc1f5151d0c7dd407f36ecb6c7aa8d2868a7

Download Submit
memory/344-53-0x0000000001280000-0x0000000001422000-memory.dmp

Filesize
1.6MB

Download
memory/344-54-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

Filesize
9.9MB

Download
memory/344-55-0x000000001B460000-0x000000001B4E0000-memory.dmp

Filesize
512KB

Download
memory/344-56-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/344-57-0x000000001B460000-0x000000001B4E0000-memory.dmp

Filesize
512KB

Download
memory/344-59-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download
memory/344-60-0x000000001B460000-0x000000001B4E0000-memory.dmp

Filesize
512KB

Download
memory/344-65-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

Filesize
9.9MB

Download
memory/1460-154-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/1460-153-0x00000000000A0000-0x0000000000242000-memory.dmp

Filesize
1.6MB

Download
memory/1460-156-0x000000001B500000-0x000000001B580000-memory.dmp

Filesize
512KB

Download
memory/1460-155-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1460-157-0x000000001B500000-0x000000001B580000-memory.dmp

Filesize
512KB

Download
memory/1696-114-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1696-111-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

Filesize
9.9MB

Download
memory/1696-115-0x000000001B500000-0x000000001B580000-memory.dmp

Filesize
512KB

Download
memory/1696-117-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download
memory/1696-118-0x000000001B500000-0x000000001B580000-memory.dmp

Filesize
512KB

Download
memory/1696-123-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

Filesize
9.9MB

Download
memory/1696-112-0x000000001B500000-0x000000001B580000-memory.dmp

Filesize
512KB

Download
memory/1748-141-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1748-140-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

Filesize
9.9MB

Download
memory/1748-142-0x000000001B340000-0x000000001B3C0000-memory.dmp

Filesize
512KB

Download
memory/1748-144-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download
memory/1748-145-0x000000001B340000-0x000000001B3C0000-memory.dmp

Filesize
512KB

Download
memory/1748-151-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

Filesize
9.9MB

Download
memory/1852-80-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/1852-74-0x00000000011A0000-0x0000000001220000-memory.dmp

Filesize
512KB

Download
memory/1852-73-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download
memory/1852-71-0x00000000011A0000-0x0000000001220000-memory.dmp

Filesize
512KB

Download
memory/1852-70-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1852-69-0x00000000011A0000-0x0000000001220000-memory.dmp

Filesize
512KB

Download
memory/1852-68-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-126-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-127-0x000000001B2C0000-0x000000001B340000-memory.dmp

Filesize
512KB

Download
memory/2220-132-0x000000001B2C0000-0x000000001B340000-memory.dmp

Filesize
512KB

Download
memory/2220-131-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download
memory/2220-138-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-129-0x000000001B2C0000-0x000000001B340000-memory.dmp

Filesize
512KB

Download
memory/2220-128-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2336-100-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/2336-109-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-97-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-98-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/2336-99-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2336-102-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download
memory/2336-103-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/2712-50-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2712-16-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2712-13-0x0000000000A60000-0x0000000000C02000-memory.dmp

Filesize
1.6MB

Download
memory/2712-14-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2712-15-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download
memory/2712-17-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download
memory/2712-19-0x00000000004A0000-0x00000000004AE000-memory.dmp

Filesize
56KB

Download
memory/2712-20-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download
memory/2712-21-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download
memory/2988-94-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

Filesize
9.9MB

Download
memory/2988-82-0x00000000012B0000-0x0000000001452000-memory.dmp

Filesize
1.6MB

Download
memory/2988-83-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

Filesize
9.9MB

Download
memory/2988-84-0x000000001AE30000-0x000000001AEB0000-memory.dmp

Filesize
512KB

Download
memory/2988-88-0x000000001AE30000-0x000000001AEB0000-memory.dmp

Filesize
512KB

Download
memory/2988-85-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2988-86-0x000000001AE30000-0x000000001AEB0000-memory.dmp

Filesize
512KB

Download
memory/2988-87-0x00000000773E0000-0x00000000773E1000-memory.dmp

Filesize
4KB

Download