014614e6650f00448b18b594013d532043165806280ac04e0e1aab9c9d7d8ad3

Analysis

max time kernel
149s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client/SEBarClt.exe
Size 874KB
Sample240517-ba7q8aab65
SHA256 b01acb4f2dc26be063b4fcc12ee959c6db5871226234c9ef7f3af5a75eb3214d
MD5 b59037d9e8e90a0a29d7570e6afedef5
SHA1 81dd5832eae9b5f5953666e9642517ab8658dd79
SHA512 e2d574e796cb631cfcf159b860c94c1bf4be3f4e39c3e4e44e29a560079b0c6833c762a2344312b49e72657a947ffa5bcaec3d65d251d14c098124935cef7632
SSDEEP 12288:fExzJnjVqy6qetASRTYsapGL6QS8Ds9lTSGT9V1uTW2XbeUFoloLEs3Ks:cxhxJTpGjS8DsrTSAyTWA3FoloLpKs
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SEBarClt.exe
File opened (read-only)	\??\N:	SEBarClt.exe
File opened (read-only)	\??\X:	SEBarClt.exe
File opened (read-only)	\??\H:	SEBarClt.exe
File opened (read-only)	\??\L:	SEBarClt.exe
File opened (read-only)	\??\Q:	SEBarClt.exe
File opened (read-only)	\??\Y:	SEBarClt.exe
File opened (read-only)	\??\Z:	SEBarClt.exe
File opened (read-only)	\??\A:	SEBarClt.exe
File opened (read-only)	\??\S:	SEBarClt.exe
File opened (read-only)	\??\T:	SEBarClt.exe
File opened (read-only)	\??\V:	SEBarClt.exe
File opened (read-only)	\??\K:	SEBarClt.exe
File opened (read-only)	\??\M:	SEBarClt.exe
File opened (read-only)	\??\O:	SEBarClt.exe
File opened (read-only)	\??\P:	SEBarClt.exe
File opened (read-only)	\??\B:	SEBarClt.exe
File opened (read-only)	\??\E:	SEBarClt.exe
File opened (read-only)	\??\G:	SEBarClt.exe
File opened (read-only)	\??\J:	SEBarClt.exe
File opened (read-only)	\??\R:	SEBarClt.exe
File opened (read-only)	\??\U:	SEBarClt.exe
File opened (read-only)	\??\W:	SEBarClt.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	SEBarClt.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SYNCCMD.EXE	SEBarClt.exe
File created	C:\Windows\SysWOW64\SYNCSTAT.EXE	SEBarClt.exe
File created	C:\Windows\SysWOW64\SYNCCMD.EXE	SEBarClt.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3120 set thread context of 1560	3120	nQMailer.exe	87
PID 1852 set thread context of 1568	1852	nQMailer.exe	96
PID 1668 set thread context of 1632	1668	nQMailer.exe	102
PID 4508 set thread context of 232	4508	nQMailer.exe	107
PID 832 set thread context of 4568	832	nQMailer.exe	111
PID 4844 set thread context of 4444	4844	nQMailer.exe	116
PID 3596 set thread context of 4512	3596	nQMailer.exe	121
PID 3576 set thread context of 4348	3576	nQMailer.exe	125
PID 1292 set thread context of 1536	1292	nQMailer.exe	129
PID 5088 set thread context of 3916	5088	nQMailer.exe	133
PID 3612 set thread context of 2308	3612	nQMailer.exe	137
PID 2692 set thread context of 3012	2692	nQMailer.exe	141
PID 2664 set thread context of 2624	2664	nQMailer.exe	145
PID 1560 set thread context of 3604	1560	nQMailer.exe	149
PID 1956 set thread context of 1784	1956	nQMailer.exe	153
PID 4844 set thread context of 4520	4844	nQMailer.exe	158
PID 224 set thread context of 2156	224	nQMailer.exe	162
PID 4412 set thread context of 4052	4412	nQMailer.exe	167
PID 4824 set thread context of 3120	4824	nQMailer.exe	171
PID 3488 set thread context of 2212	3488	nQMailer.exe	175
PID 552 set thread context of 4092	552	nQMailer.exe	179
PID 2468 set thread context of 3908	2468	nQMailer.exe	183
PID 5044 set thread context of 3376	5044	nQMailer.exe	187
PID 2444 set thread context of 3848	2444	nQMailer.exe	191
PID 4620 set thread context of 4584	4620	nQMailer.exe	195
PID 1896 set thread context of 2144	1896	nQMailer.exe	199
PID 1672 set thread context of 2884	1672	nQMailer.exe	203
PID 2844 set thread context of 3812	2844	nQMailer.exe	207
PID 2268 set thread context of 1012	2268	nQMailer.exe	211
PID 4996 set thread context of 4564	4996	nQMailer.exe	215
PID 2424 set thread context of 2520	2424	nQMailer.exe	219
PID 1620 set thread context of 924	1620	nQMailer.exe	223
PID 3488 set thread context of 3640	3488	nQMailer.exe	227
PID 2692 set thread context of 1060	2692	nQMailer.exe	232
PID 3612 set thread context of 4280	3612	nQMailer.exe	236
PID 4408 set thread context of 3908	4408	nQMailer.exe	240
PID 2848 set thread context of 3376	2848	nQMailer.exe	244
PID 4708 set thread context of 3848	4708	nQMailer.exe	248
PID 1076 set thread context of 4204	1076	nQMailer.exe	252
PID 4712 set thread context of 1040	4712	nQMailer.exe	256
PID 4588 set thread context of 3836	4588	nQMailer.exe	260
PID 3596 set thread context of 4044	3596	nQMailer.exe	264
PID 2508 set thread context of 1760	2508	nQMailer.exe	268
PID 4520 set thread context of 1528	4520	nQMailer.exe	272
PID 3568 set thread context of 816	3568	nQMailer.exe	276
PID 5004 set thread context of 4308	5004	nQMailer.exe	280
PID 2212 set thread context of 2592	2212	nQMailer.exe	284
PID 3076 set thread context of 1852	3076	nQMailer.exe	288
PID 1548 set thread context of 2760	1548	nQMailer.exe	292
PID 708 set thread context of 4736	708	nQMailer.exe	296
PID 1868 set thread context of 1424	1868	nQMailer.exe	306
PID 1524 set thread context of 4796	1524	nQMailer.exe	310
PID 3000 set thread context of 3200	3000	nQMailer.exe	314
PID 2360 set thread context of 4520	2360	nQMailer.exe	318
PID 2164 set thread context of 4836	2164	nQMailer.exe	322
PID 3312 set thread context of 4340	3312	nQMailer.exe	326
PID 3264 set thread context of 3260	3264	nQMailer.exe	330
PID 2592 set thread context of 4404	2592	nQMailer.exe	334
PID 2692 set thread context of 1536	2692	nQMailer.exe	338
PID 4808 set thread context of 5112	4808	nQMailer.exe	342
PID 892 set thread context of 400	892	nQMailer.exe	346
PID 2988 set thread context of 2376	2988	nQMailer.exe	350
PID 1312 set thread context of 3920	1312	nQMailer.exe	354
PID 4744 set thread context of 2624	4744	nQMailer.exe	358

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\BootSys.log	SEBarClt.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3128	1560	WerFault.exe	87
1896	1568	WerFault.exe	96
1816	1632	WerFault.exe	102
2096	232	WerFault.exe	107
1628	4568	WerFault.exe	111
2364	4444	WerFault.exe	116
4532	4512	WerFault.exe	121
2792	4348	WerFault.exe	125
1604	1536	WerFault.exe	129
876	3916	WerFault.exe	133
1888	2308	WerFault.exe	137
4020	3012	WerFault.exe	141
2796	2624	WerFault.exe	145
3828	3604	WerFault.exe	149
1568	1784	WerFault.exe	153
2096	4520	WerFault.exe	158
4888	2156	WerFault.exe	162
1728	4052	WerFault.exe	167
1204	3120	WerFault.exe	171
1280	2212	WerFault.exe	175
3384	4092	WerFault.exe	179
3960	3908	WerFault.exe	183
3916	3376	WerFault.exe	187
3468	3848	WerFault.exe	191
1160	4584	WerFault.exe	195
2624	2144	WerFault.exe	199
2012	2884	WerFault.exe	203
3512	3812	WerFault.exe	207
2472	1012	WerFault.exe	211
3660	4564	WerFault.exe	215
392	2520	WerFault.exe	219
400	924	WerFault.exe	223
1728	3640	WerFault.exe	227
5044	1060	WerFault.exe	232
1312	4280	WerFault.exe	236
1180	3908	WerFault.exe	240
60	3376	WerFault.exe	244
1048	3848	WerFault.exe	248
1136	4204	WerFault.exe	252
2268	1040	WerFault.exe	256
700	3836	WerFault.exe	260
4228	4044	WerFault.exe	264
2896	1760	WerFault.exe	268
1208	1528	WerFault.exe	272
1944	816	WerFault.exe	276
244	4308	WerFault.exe	280
2944	2592	WerFault.exe	284
4512	1852	WerFault.exe	288
3436	2760	WerFault.exe	292
3356	4736	WerFault.exe	296
1488	1424	WerFault.exe	306
2700	4796	WerFault.exe	310
4992	3200	WerFault.exe	314
3280	4520	WerFault.exe	318
1784	4836	WerFault.exe	322
4788	4340	WerFault.exe	326
1384	3260	WerFault.exe	330
2644	4404	WerFault.exe	334
3832	1536	WerFault.exe	338
2460	5112	WerFault.exe	342
5032	400	WerFault.exe	346
1592	2376	WerFault.exe	350
3604	3920	WerFault.exe	354
1136	2624	WerFault.exe	358

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	SEBarClt.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	SEBarClt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SEBarClt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SEBarClt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1152	SEBarClt.exe
Token: SeIncBasePriorityPrivilege	1152	SEBarClt.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1152	SEBarClt.exe
1152	SEBarClt.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1152	SEBarClt.exe
1152	SEBarClt.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1152	SEBarClt.exe
1152	SEBarClt.exe
1152	SEBarClt.exe

Suspicious use of UnmapMainImage 10 IoCs

pid	Process
4568	svchost.exe
4348	svchost.exe
3604	svchost.exe
1784	svchost.exe
4584	svchost.exe
3848	svchost.exe
4796	svchost.exe
3200	svchost.exe
1676	svchost.exe
2488	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3120	1152	SEBarClt.exe	86
PID 1152 wrote to memory of 3120	1152	SEBarClt.exe	86
PID 1152 wrote to memory of 3120	1152	SEBarClt.exe	86
PID 3120 wrote to memory of 1560	3120	nQMailer.exe	87
PID 3120 wrote to memory of 1560	3120	nQMailer.exe	87
PID 3120 wrote to memory of 1560	3120	nQMailer.exe	87
PID 3120 wrote to memory of 1560	3120	nQMailer.exe	87
PID 3120 wrote to memory of 1560	3120	nQMailer.exe	87
PID 1152 wrote to memory of 1852	1152	SEBarClt.exe	95
PID 1152 wrote to memory of 1852	1152	SEBarClt.exe	95
PID 1152 wrote to memory of 1852	1152	SEBarClt.exe	95
PID 1852 wrote to memory of 1568	1852	nQMailer.exe	96
PID 1852 wrote to memory of 1568	1852	nQMailer.exe	96
PID 1852 wrote to memory of 1568	1852	nQMailer.exe	96
PID 1852 wrote to memory of 1568	1852	nQMailer.exe	96
PID 1852 wrote to memory of 1568	1852	nQMailer.exe	96
PID 1152 wrote to memory of 1668	1152	SEBarClt.exe	101
PID 1152 wrote to memory of 1668	1152	SEBarClt.exe	101
PID 1152 wrote to memory of 1668	1152	SEBarClt.exe	101
PID 1668 wrote to memory of 1632	1668	nQMailer.exe	102
PID 1668 wrote to memory of 1632	1668	nQMailer.exe	102
PID 1668 wrote to memory of 1632	1668	nQMailer.exe	102
PID 1668 wrote to memory of 1632	1668	nQMailer.exe	102
PID 1668 wrote to memory of 1632	1668	nQMailer.exe	102
PID 1152 wrote to memory of 4508	1152	SEBarClt.exe	106
PID 1152 wrote to memory of 4508	1152	SEBarClt.exe	106
PID 1152 wrote to memory of 4508	1152	SEBarClt.exe	106
PID 4508 wrote to memory of 232	4508	nQMailer.exe	107
PID 4508 wrote to memory of 232	4508	nQMailer.exe	107
PID 4508 wrote to memory of 232	4508	nQMailer.exe	107
PID 4508 wrote to memory of 232	4508	nQMailer.exe	107
PID 4508 wrote to memory of 232	4508	nQMailer.exe	107
PID 1152 wrote to memory of 832	1152	SEBarClt.exe	110
PID 1152 wrote to memory of 832	1152	SEBarClt.exe	110
PID 1152 wrote to memory of 832	1152	SEBarClt.exe	110
PID 832 wrote to memory of 4568	832	nQMailer.exe	111
PID 832 wrote to memory of 4568	832	nQMailer.exe	111
PID 832 wrote to memory of 4568	832	nQMailer.exe	111
PID 832 wrote to memory of 4568	832	nQMailer.exe	111
PID 832 wrote to memory of 4568	832	nQMailer.exe	111
PID 1152 wrote to memory of 4844	1152	SEBarClt.exe	115
PID 1152 wrote to memory of 4844	1152	SEBarClt.exe	115
PID 1152 wrote to memory of 4844	1152	SEBarClt.exe	115
PID 4844 wrote to memory of 4444	4844	nQMailer.exe	116
PID 4844 wrote to memory of 4444	4844	nQMailer.exe	116
PID 4844 wrote to memory of 4444	4844	nQMailer.exe	116
PID 4844 wrote to memory of 4444	4844	nQMailer.exe	116
PID 4844 wrote to memory of 4444	4844	nQMailer.exe	116
PID 1152 wrote to memory of 3596	1152	SEBarClt.exe	120
PID 1152 wrote to memory of 3596	1152	SEBarClt.exe	120
PID 1152 wrote to memory of 3596	1152	SEBarClt.exe	120
PID 3596 wrote to memory of 4512	3596	nQMailer.exe	121
PID 3596 wrote to memory of 4512	3596	nQMailer.exe	121
PID 3596 wrote to memory of 4512	3596	nQMailer.exe	121
PID 3596 wrote to memory of 4512	3596	nQMailer.exe	121
PID 3596 wrote to memory of 4512	3596	nQMailer.exe	121
PID 1152 wrote to memory of 3576	1152	SEBarClt.exe	124
PID 1152 wrote to memory of 3576	1152	SEBarClt.exe	124
PID 1152 wrote to memory of 3576	1152	SEBarClt.exe	124
PID 3576 wrote to memory of 4348	3576	nQMailer.exe	125
PID 3576 wrote to memory of 4348	3576	nQMailer.exe	125
PID 3576 wrote to memory of 4348	3576	nQMailer.exe	125
PID 3576 wrote to memory of 4348	3576	nQMailer.exe	125
PID 3576 wrote to memory of 4348	3576	nQMailer.exe	125

C:\Users\Admin\AppData\Local\Temp\Client\SEBarClt.exe
"C:\Users\Admin\AppData\Local\Temp\Client\SEBarClt.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 12
      4⤵
      Program crash
      PID:3128
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 12
      4⤵
      Program crash
      PID:1896
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 12
      4⤵
      Program crash
      PID:1816
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 12
      4⤵
      Program crash
      PID:2096
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:4568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 12
      4⤵
      Program crash
      PID:1628
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 12
      4⤵
      Program crash
      PID:2364
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 12
      4⤵
      Program crash
      PID:4532
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:4348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 12
      4⤵
      Program crash
      PID:2792
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1292
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 16
      4⤵
      Program crash
      PID:1604
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:5088
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 12
      4⤵
      Program crash
      PID:876
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3612
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 12
      4⤵
      Program crash
      PID:1888
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2692
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 12
      4⤵
      Program crash
      PID:4020
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2664
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 12
      4⤵
      Program crash
      PID:2796
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1560
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:3604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 12
      4⤵
      Program crash
      PID:3828
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1956
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:1784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 12
      4⤵
      Program crash
      PID:1568
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4844
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 12
      4⤵
      Program crash
      PID:2096
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:224
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 12
      4⤵
      Program crash
      PID:4888
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4412
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 12
      4⤵
      Program crash
      PID:1728
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4824
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 12
      4⤵
      Program crash
      PID:1204
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3488
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 12
      4⤵
      Program crash
      PID:1280
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:552
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 12
      4⤵
      Program crash
      PID:3384
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2468
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12
      4⤵
      Program crash
      PID:3960
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:5044
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 12
      4⤵
      Program crash
      PID:3916
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2444
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 12
      4⤵
      Program crash
      PID:3468
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4620
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:4584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 12
      4⤵
      Program crash
      PID:1160
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1896
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 12
      4⤵
      Program crash
      PID:2624
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1672
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 12
      4⤵
      Program crash
      PID:2012
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2844
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 12
      4⤵
      Program crash
      PID:3512
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2268
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 12
      4⤵
      Program crash
      PID:2472
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4996
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 12
      4⤵
      Program crash
      PID:3660
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2424
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 12
      4⤵
      Program crash
      PID:392
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1620
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 12
      4⤵
      Program crash
      PID:400
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3488
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 12
      4⤵
      Program crash
      PID:1728
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2692
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 12
      4⤵
      Program crash
      PID:5044
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3612
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 12
      4⤵
      Program crash
      PID:1312
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4408
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 12
      4⤵
      Program crash
      PID:1180
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2848
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 12
      4⤵
      Program crash
      PID:60
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4708
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:3848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 12
      4⤵
      Program crash
      PID:1048
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1076
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 12
      4⤵
      Program crash
      PID:1136
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4712
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 12
      4⤵
      Program crash
      PID:2268
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4588
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 12
      4⤵
      Program crash
      PID:700
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3596
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 12
      4⤵
      Program crash
      PID:4228
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2508
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 12
      4⤵
      Program crash
      PID:2896
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4520
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 12
      4⤵
      Program crash
      PID:1208
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3568
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 12
      4⤵
      Program crash
      PID:1944
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:5004
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 12
      4⤵
      Program crash
      PID:244
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2212
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 12
      4⤵
      Program crash
      PID:2944
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3076
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 12
      4⤵
      Program crash
      PID:4512
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1548
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 12
      4⤵
      Program crash
      PID:3436
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:708
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 12
      4⤵
      Program crash
      PID:3356
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1868
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 12
      4⤵
      Program crash
      PID:1488
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1524
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:4796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 12
      4⤵
      Program crash
      PID:2700
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3000
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:3200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 12
      4⤵
      Program crash
      PID:4992
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2360
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 12
      4⤵
      Program crash
      PID:3280
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2164
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 12
      4⤵
      Program crash
      PID:1784
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3312
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 12
      4⤵
      Program crash
      PID:4788
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3264
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 12
      4⤵
      Program crash
      PID:1384
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2592
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 32
      4⤵
      Program crash
      PID:2644
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2692
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 12
      4⤵
      Program crash
      PID:3832
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4808
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:5112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 12
      4⤵
      Program crash
      PID:2460
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:892
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 12
      4⤵
      Program crash
      PID:5032
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:2988
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 32
      4⤵
      Program crash
      PID:1592
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1312
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 12
      4⤵
      Program crash
      PID:3604
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:4744
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 12
      4⤵
      Program crash
      PID:1136
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:3812
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 12
      4⤵
      PID:4360
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:1676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 12
      4⤵
      PID:396
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 12
      4⤵
      PID:3520
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of UnmapMainImage
    PID:2488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 12
      4⤵
      PID:3544
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2960
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 12
      4⤵
      PID:1620
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 12
      4⤵
      PID:4564
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:3660
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 12
      4⤵
      PID:1944
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 12
      4⤵
      PID:2176
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:4052
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 12
      4⤵
      PID:3960
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:924
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 12
      4⤵
      PID:3832
- C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  C:\Users\Admin\AppData\Local\Temp\Client\nQMailer.exe
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 12
      4⤵
      PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1560 -ip 1560
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1568 -ip 1568
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1632 -ip 1632
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 232 -ip 232
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4568 -ip 4568
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4444 -ip 4444
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4512 -ip 4512
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4348 -ip 4348
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1536 -ip 1536
1⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3916 -ip 3916
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2308 -ip 2308
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3012 -ip 3012
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2624 -ip 2624
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3604 -ip 3604
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1784 -ip 1784
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4520 -ip 4520
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2156 -ip 2156
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4052 -ip 4052
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3120 -ip 3120
1⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2212 -ip 2212
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4092 -ip 4092
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3908 -ip 3908
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3376 -ip 3376
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3848 -ip 3848
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4584 -ip 4584
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2144 -ip 2144
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2884 -ip 2884
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3812 -ip 3812
1⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1012 -ip 1012
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4564 -ip 4564
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2520 -ip 2520
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 924 -ip 924
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3640 -ip 3640
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1060 -ip 1060
1⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4280 -ip 4280
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3908 -ip 3908
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3376 -ip 3376
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 3848 -ip 3848
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4204 -ip 4204
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1040 -ip 1040
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3836 -ip 3836
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4044 -ip 4044
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1760 -ip 1760
1⤵
PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1528 -ip 1528
1⤵
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 816 -ip 816
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4308 -ip 4308
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2592 -ip 2592
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1852 -ip 1852
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2760 -ip 2760
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4736 -ip 4736
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1424 -ip 1424
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4796 -ip 4796
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3200 -ip 3200
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4520 -ip 4520
1⤵
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4836 -ip 4836
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4340 -ip 4340
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3260 -ip 3260
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4404 -ip 4404
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1536 -ip 1536
1⤵
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5112 -ip 5112
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 400 -ip 400
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 2376 -ip 2376
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3920 -ip 3920
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2624 -ip 2624
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 1444 -ip 1444
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 1676 -ip 1676
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4856 -ip 4856
1⤵
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 2488 -ip 2488
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3504 -ip 3504
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4796 -ip 4796
1⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 436 -ip 436
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 1332 -ip 1332
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 816 -ip 816
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4244 -ip 4244
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 1560 -ip 1560
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-47-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/232-14-0x0000000000510000-0x0000000000562000-memory.dmp

Download

memory/552-55-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/832-17-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1152-0-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/1152-67-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/1152-20-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/1152-43-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/1152-56-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/1152-32-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/1152-27-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/1152-3-0x0000000002B60000-0x0000000002B88000-memory.dmp

Download

memory/1292-26-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1536-25-0x0000000000300000-0x0000000000352000-memory.dmp

Download

memory/1560-40-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1560-5-0x0000000000680000-0x00000000006D2000-memory.dmp

Download

memory/1568-8-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1668-12-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1668-11-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/1672-69-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1852-7-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1852-9-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1896-66-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/1956-42-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2444-62-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2468-58-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2664-38-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2692-36-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2844-71-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/2884-68-0x00000000001C0000-0x0000000000212000-memory.dmp

Download

memory/3120-50-0x00000000001E0000-0x0000000000232000-memory.dmp

Download

memory/3120-6-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3120-4-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/3488-53-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3576-24-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3596-22-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/3612-31-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4348-23-0x0000000000610000-0x0000000000662000-memory.dmp

Download

memory/4412-49-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4444-18-0x0000000000670000-0x00000000006C2000-memory.dmp

Download

memory/4508-15-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4508-13-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/4520-44-0x00000000002A0000-0x00000000002F2000-memory.dmp

Download

memory/4568-16-0x0000000000600000-0x0000000000652000-memory.dmp

Download

memory/4620-64-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4824-51-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4844-45-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4844-19-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/5044-60-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/5088-29-0x0000000000400000-0x000000000047E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads