gh0strat | 2c12e2073d0b50369b0b10ebbdb8bf8357fbf7cdca3f97b0b84192339b846c25

Resubmissions

19-07-2024 08:22

240719-j929savcmd 6

19-07-2024 08:14

240719-j5fj8a1clk 10

19-07-2024 08:08

240719-j1lknstgpb 6

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gooleo.msi
Size

87.8MB
MD5

e651816dd9240300cf9bd9c565e3b869
SHA1

a4bc6e8f6516f3d549195887d7095b9496ae52f9
SHA256

2c12e2073d0b50369b0b10ebbdb8bf8357fbf7cdca3f97b0b84192339b846c25
SHA512

90646a020b0ea67c912f999690382a44f5649c5f3c2a4a7c060aced6a9a71533b92c04d948db8bafd717dd295ad19bb85a71d73ef86a62613e65053323b108b8
SSDEEP

1572864:MKSA0Q9ilL4UxQUoim6casSZrcBsCWpuFg9O/jAaWFFDp+chVF1luEbtYio0z8+U:MbVQ92TQUooc3Uw2F9HHluEbtpoOKd3

Score

10^/10

gh0strat execution persistence privilege_escalation rat upx

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/2552-473-0x0000000005580000-0x0000000005DEF000-memory.dmp	family_gh0strat
behavioral2/memory/444-590-0x0000000005EE0000-0x000000000674F000-memory.dmp	family_gh0strat
behavioral2/memory/444-617-0x0000000006BC0000-0x000000000742F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1864-346-0x0000000000230000-0x00000000002BA000-memory.dmp	upx
behavioral2/memory/2552-358-0x00000000006E0000-0x000000000076A000-memory.dmp	upx
behavioral2/memory/2552-360-0x00000000006E0000-0x000000000076A000-memory.dmp	upx
behavioral2/memory/2552-361-0x0000000000160000-0x0000000000193000-memory.dmp	upx
behavioral2/memory/2552-424-0x0000000004AA0000-0x000000000530F000-memory.dmp	upx
behavioral2/memory/2552-434-0x0000000005580000-0x0000000005DEF000-memory.dmp	upx
behavioral2/memory/2552-473-0x0000000005580000-0x0000000005DEF000-memory.dmp	upx
behavioral2/memory/2552-492-0x00000000006E0000-0x000000000076A000-memory.dmp	upx
behavioral2/memory/444-499-0x0000000000320000-0x0000000000359000-memory.dmp	upx
behavioral2/memory/444-496-0x0000000000320000-0x0000000000359000-memory.dmp	upx
behavioral2/memory/2312-508-0x0000000000630000-0x0000000000669000-memory.dmp	upx
behavioral2/memory/2312-511-0x0000000000630000-0x0000000000669000-memory.dmp	upx
behavioral2/memory/444-590-0x0000000005EE0000-0x000000000674F000-memory.dmp	upx
behavioral2/memory/444-565-0x0000000005EE0000-0x000000000674F000-memory.dmp	upx
behavioral2/memory/444-591-0x0000000006BC0000-0x000000000742F000-memory.dmp	upx
behavioral2/memory/444-557-0x0000000000320000-0x0000000000359000-memory.dmp	upx
behavioral2/memory/444-617-0x0000000006BC0000-0x000000000742F000-memory.dmp	upx
behavioral2/memory/1360-634-0x0000000000410000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/1360-637-0x0000000000410000-0x000000000049A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	TaskLoad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	_QQMusicKA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	_QQMusicKA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	_QQMusicKA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	TaskLoad.exe
File opened (read-only)	\??\R:	TaskLoad.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	TaskLoad.exe
File opened (read-only)	\??\O:	TaskLoad.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	TaskLoad.exe
File opened (read-only)	\??\W:	TaskLoad.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	TaskLoad.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	TaskLoad.exe
File opened (read-only)	\??\X:	TaskLoad.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	TaskLoad.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	TaskLoad.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	TaskLoad.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	TaskLoad.exe
File opened (read-only)	\??\I:	TaskLoad.exe
File opened (read-only)	\??\N:	TaskLoad.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	TaskLoad.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	TaskLoad.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	TaskLoad.exe
File opened (read-only)	\??\T:	TaskLoad.exe
File opened (read-only)	\??\Z:	TaskLoad.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defenderr\xfPSEcwMB3\WS_Log.dll	MsiExec.exe
File opened for modification	C:\Program Files\Windows Defenderr\xfPSEcwMB3\WS_Log.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfPSEcwMB3\FourierTransformLib8.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfPSEcwMB3\ImageRestoreLib8.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfPSEcwMB3\wavelet_3_8.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfPSEcwMB3\dll1.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfPSEcwMB3\libcef.dll	MsiExec.exe
File created	C:\Program Files\Windows Defenderr\xfPSEcwMB3\xfPSEcwMB3.exe	MsiExec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f771e99.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20BB.tmp	msiexec.exe
File created	C:\Windows\Installer\f771e98.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\{13A5BCD1-56BB-4290-90FC-9B59AC6F1C74}\PublicDocumentsFolderappR_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f771e99.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f771e98.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\{13A5BCD1-56BB-4290-90FC-9B59AC6F1C74}\PublicDocumentsFolderappR_1.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1F15.tmp	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
1864	xfPSEcwMB3.exe
2552	TaskLoad.exe
444	_QQMusicKA.exe
1360	TaskLoad.exe
2312	_QQMusicKA.exe

Loads dropped DLL 22 IoCs

pid	Process
2964	MsiExec.exe
2964	MsiExec.exe
2964	MsiExec.exe
2964	MsiExec.exe
2964	MsiExec.exe
1944	MsiExec.exe
2164	MsiExec.exe
1864	xfPSEcwMB3.exe
1864	xfPSEcwMB3.exe
1864	xfPSEcwMB3.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
1868	WerFault.exe
1868	WerFault.exe
1868	WerFault.exe
2552	TaskLoad.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
1360	TaskLoad.exe
1360	TaskLoad.exe
2312	_QQMusicKA.exe
2312	_QQMusicKA.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1816	Powershell.exe
2956	Powershell.exe
2796	Powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
2168	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	1864	WerFault.exe	39

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TaskLoad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TaskLoad.exe

Kills process with taskkill 22 IoCs

evasion

pid	Process
2572	taskkill.exe
984	taskkill.exe
2824	taskkill.exe
1988	taskkill.exe
2920	taskkill.exe
668	taskkill.exe
1640	taskkill.exe
1972	taskkill.exe
2740	taskkill.exe
880	taskkill.exe
1592	taskkill.exe
2400	taskkill.exe
1444	taskkill.exe
1832	taskkill.exe
2944	taskkill.exe
2980	taskkill.exe
2592	taskkill.exe
2236	taskkill.exe
1876	taskkill.exe
1340	taskkill.exe
1976	taskkill.exe
2952	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{596AB062-B4D2-4215-9F74-E9109B0A8153} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c0b3267db4d9da01	_QQMusicKA.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e048367cb4d9da01	Powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\S\ver = "C:\\Testoutput\\TestWord"	TaskLoad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"	_QQMusicKA.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000202b4f7db4d9da01	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\KeyName = "KeyValue"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\S	_QQMusicKA.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\V\sion = "Main"	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\V\ver = "C:\\Testoutput\\TestMove"	TaskLoad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1D27F844-3A1F-4410-85AC-14651078412D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e0ed537db4d9da01	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	rundll32.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002015297db4d9da01	_QQMusicKA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	_QQMusicKA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\KeyName = "KeyValue"	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{85BBD920-42A0-1069-A2E4-08002B30309D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000808c517db4d9da01	_QQMusicKA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\KeyNamereg = "KeyValue"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\V\ver = "C:\\Testoutput\\TestMove"	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\V\sion = "Main"	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\S\ver = "C:\\Testoutput\\TestWord"	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	Powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	TaskLoad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe"	_QQMusicKA.exe
Key created	\REGISTRY\USER\.DEFAULT\S	TaskLoad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	TaskLoad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	msiexec.exe
2880	msiexec.exe
1864	xfPSEcwMB3.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
2552	TaskLoad.exe
1816	Powershell.exe
2552	TaskLoad.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
2312	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe
444	_QQMusicKA.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2168	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2880	msiexec.exe
Token: SeTakeOwnershipPrivilege	2880	msiexec.exe
Token: SeSecurityPrivilege	2880	msiexec.exe
Token: SeCreateTokenPrivilege	2168	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2168	msiexec.exe
Token: SeLockMemoryPrivilege	2168	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2168	msiexec.exe
Token: SeMachineAccountPrivilege	2168	msiexec.exe
Token: SeTcbPrivilege	2168	msiexec.exe
Token: SeSecurityPrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeLoadDriverPrivilege	2168	msiexec.exe
Token: SeSystemProfilePrivilege	2168	msiexec.exe
Token: SeSystemtimePrivilege	2168	msiexec.exe
Token: SeProfSingleProcessPrivilege	2168	msiexec.exe
Token: SeIncBasePriorityPrivilege	2168	msiexec.exe
Token: SeCreatePagefilePrivilege	2168	msiexec.exe
Token: SeCreatePermanentPrivilege	2168	msiexec.exe
Token: SeBackupPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeShutdownPrivilege	2168	msiexec.exe
Token: SeDebugPrivilege	2168	msiexec.exe
Token: SeAuditPrivilege	2168	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2168	msiexec.exe
Token: SeChangeNotifyPrivilege	2168	msiexec.exe
Token: SeRemoteShutdownPrivilege	2168	msiexec.exe
Token: SeUndockPrivilege	2168	msiexec.exe
Token: SeSyncAgentPrivilege	2168	msiexec.exe
Token: SeEnableDelegationPrivilege	2168	msiexec.exe
Token: SeManageVolumePrivilege	2168	msiexec.exe
Token: SeImpersonatePrivilege	2168	msiexec.exe
Token: SeCreateGlobalPrivilege	2168	msiexec.exe
Token: SeCreateTokenPrivilege	2168	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2168	msiexec.exe
Token: SeLockMemoryPrivilege	2168	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2168	msiexec.exe
Token: SeMachineAccountPrivilege	2168	msiexec.exe
Token: SeTcbPrivilege	2168	msiexec.exe
Token: SeSecurityPrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeLoadDriverPrivilege	2168	msiexec.exe
Token: SeSystemProfilePrivilege	2168	msiexec.exe
Token: SeSystemtimePrivilege	2168	msiexec.exe
Token: SeProfSingleProcessPrivilege	2168	msiexec.exe
Token: SeIncBasePriorityPrivilege	2168	msiexec.exe
Token: SeCreatePagefilePrivilege	2168	msiexec.exe
Token: SeCreatePermanentPrivilege	2168	msiexec.exe
Token: SeBackupPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeShutdownPrivilege	2168	msiexec.exe
Token: SeDebugPrivilege	2168	msiexec.exe
Token: SeAuditPrivilege	2168	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2168	msiexec.exe
Token: SeChangeNotifyPrivilege	2168	msiexec.exe
Token: SeRemoteShutdownPrivilege	2168	msiexec.exe
Token: SeUndockPrivilege	2168	msiexec.exe
Token: SeSyncAgentPrivilege	2168	msiexec.exe
Token: SeEnableDelegationPrivilege	2168	msiexec.exe
Token: SeManageVolumePrivilege	2168	msiexec.exe
Token: SeImpersonatePrivilege	2168	msiexec.exe
Token: SeCreateGlobalPrivilege	2168	msiexec.exe
Token: SeCreateTokenPrivilege	2168	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2168	msiexec.exe
2168	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2964	2880	msiexec.exe	29
PID 2880 wrote to memory of 2964	2880	msiexec.exe	29
PID 2880 wrote to memory of 2964	2880	msiexec.exe	29
PID 2880 wrote to memory of 2964	2880	msiexec.exe	29
PID 2880 wrote to memory of 2964	2880	msiexec.exe	29
PID 2880 wrote to memory of 2964	2880	msiexec.exe	29
PID 2880 wrote to memory of 2964	2880	msiexec.exe	29
PID 2880 wrote to memory of 1944	2880	msiexec.exe	35
PID 2880 wrote to memory of 1944	2880	msiexec.exe	35
PID 2880 wrote to memory of 1944	2880	msiexec.exe	35
PID 2880 wrote to memory of 1944	2880	msiexec.exe	35
PID 2880 wrote to memory of 1944	2880	msiexec.exe	35
PID 2880 wrote to memory of 1944	2880	msiexec.exe	35
PID 2880 wrote to memory of 1944	2880	msiexec.exe	35
PID 2880 wrote to memory of 2164	2880	msiexec.exe	36
PID 2880 wrote to memory of 2164	2880	msiexec.exe	36
PID 2880 wrote to memory of 2164	2880	msiexec.exe	36
PID 2880 wrote to memory of 2164	2880	msiexec.exe	36
PID 2880 wrote to memory of 2164	2880	msiexec.exe	36
PID 2880 wrote to memory of 2164	2880	msiexec.exe	36
PID 2880 wrote to memory of 2164	2880	msiexec.exe	36
PID 2164 wrote to memory of 1864	2164	MsiExec.exe	39
PID 2164 wrote to memory of 1864	2164	MsiExec.exe	39
PID 2164 wrote to memory of 1864	2164	MsiExec.exe	39
PID 2164 wrote to memory of 1864	2164	MsiExec.exe	39
PID 1864 wrote to memory of 2552	1864	xfPSEcwMB3.exe	40
PID 1864 wrote to memory of 2552	1864	xfPSEcwMB3.exe	40
PID 1864 wrote to memory of 2552	1864	xfPSEcwMB3.exe	40
PID 1864 wrote to memory of 2552	1864	xfPSEcwMB3.exe	40
PID 1864 wrote to memory of 1868	1864	xfPSEcwMB3.exe	41
PID 1864 wrote to memory of 1868	1864	xfPSEcwMB3.exe	41
PID 1864 wrote to memory of 1868	1864	xfPSEcwMB3.exe	41
PID 1864 wrote to memory of 1868	1864	xfPSEcwMB3.exe	41
PID 2552 wrote to memory of 1816	2552	TaskLoad.exe	42
PID 2552 wrote to memory of 1816	2552	TaskLoad.exe	42
PID 2552 wrote to memory of 1816	2552	TaskLoad.exe	42
PID 2552 wrote to memory of 1816	2552	TaskLoad.exe	42
PID 2552 wrote to memory of 444	2552	TaskLoad.exe	44
PID 2552 wrote to memory of 444	2552	TaskLoad.exe	44
PID 2552 wrote to memory of 444	2552	TaskLoad.exe	44
PID 2552 wrote to memory of 444	2552	TaskLoad.exe	44
PID 2552 wrote to memory of 1360	2552	TaskLoad.exe	45
PID 2552 wrote to memory of 1360	2552	TaskLoad.exe	45
PID 2552 wrote to memory of 1360	2552	TaskLoad.exe	45
PID 2552 wrote to memory of 1360	2552	TaskLoad.exe	45
PID 444 wrote to memory of 2312	444	_QQMusicKA.exe	46
PID 444 wrote to memory of 2312	444	_QQMusicKA.exe	46
PID 444 wrote to memory of 2312	444	_QQMusicKA.exe	46
PID 444 wrote to memory of 2312	444	_QQMusicKA.exe	46
PID 444 wrote to memory of 1968	444	_QQMusicKA.exe	47
PID 444 wrote to memory of 1968	444	_QQMusicKA.exe	47
PID 444 wrote to memory of 1968	444	_QQMusicKA.exe	47
PID 444 wrote to memory of 1968	444	_QQMusicKA.exe	47
PID 444 wrote to memory of 1968	444	_QQMusicKA.exe	47
PID 444 wrote to memory of 1968	444	_QQMusicKA.exe	47
PID 444 wrote to memory of 1968	444	_QQMusicKA.exe	47
PID 444 wrote to memory of 272	444	_QQMusicKA.exe	48
PID 444 wrote to memory of 272	444	_QQMusicKA.exe	48
PID 444 wrote to memory of 272	444	_QQMusicKA.exe	48
PID 444 wrote to memory of 272	444	_QQMusicKA.exe	48
PID 444 wrote to memory of 272	444	_QQMusicKA.exe	48
PID 444 wrote to memory of 272	444	_QQMusicKA.exe	48
PID 444 wrote to memory of 272	444	_QQMusicKA.exe	48
PID 444 wrote to memory of 1920	444	_QQMusicKA.exe	49

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\gooleo.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2168

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ADC0DFCF6EA4A7B617DFC1E146F4468E C
  2⤵
  - Loads dropped DLL
  PID:2964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 99B6243C1CB2F827A18E52DB9F035E33
  2⤵
  - Loads dropped DLL
  PID:1944
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C1D7A6223F86910B48A88551A4D756C5 M Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files\Windows Defenderr\xfPSEcwMB3\xfPSEcwMB3.exe
    "C:\Program Files\Windows Defenderr\xfPSEcwMB3\xfPSEcwMB3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Users\Public\Documents\TaskLoad.exe
      C:\Users\Public\Documents\TaskLoad.exe
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        5⤵
        Drops file in System32 directory
        Command and Scripting Interpreter: PowerShell
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:1816
    - - C:\ProgramData\{23M67G23Q87G-3W7S3E7Y-2I6E3W8W-3G7K2K7E}\_QQMusicKA.exe
        
        "C:\ProgramData\{23M67G23Q87G-3W7S3E7Y-2I6E3W8W-3G7K2K7E}\_QQMusicKA.exe"
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:444
      - C:\ProgramData\{23M67G23Q87G-3W7S3E7Y-2I6E3W8W-3G7K2K7E}\_QQMusicKA.exe
        
        "C:\ProgramData\{23M67G23Q87G-3W7S3E7Y-2I6E3W8W-3G7K2K7E}\_QQMusicKA.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2312
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:1968
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:272
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:1920
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,32
        6⤵
        Adds Run key to start application
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        
        PID:2732
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:984
      - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        6⤵
        Drops file in System32 directory
        Command and Scripting Interpreter: PowerShell
        
        PID:2956
      - C:\Windows\SysWOW64\WindowsPowershell\v1.0\Powershell.exe
        
        "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Command "Set-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming","C:\Users\Admin\AppData\Local","C:\ProgramData","C:\Users\Public\Documents""
        6⤵
        Drops file in System32 directory
        Command and Scripting Interpreter: PowerShell
        
        PID:2796
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2824
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:880
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1592
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1340
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2400
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2920
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2592
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:668
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1988
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1640
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2236
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1972
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2740
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1976
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1444
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1832
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2572
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2952
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2944
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:1876
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im QQPCTray.exe
        6⤵
        Kills process with taskkill
        
        PID:2980
    - - C:\Users\Public\Documents\TaskLoad.exe
        
        "C:\Users\Public\Documents\TaskLoad.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 224
      4⤵
      Loads dropped DLL
      Program crash
      PID:1868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2728

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D4" "00000000000004D0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f771e9a.rbs

Filesize
52KB

MD5
1f7e29dfa35adc8d87ec73a79526f614

SHA1
5681c9cd303e2e0870d9c73d711655c6e6593035

SHA256
4b9fca94a61078545d11a42647193dac53802b0fad6de46d588ffbd128e9601b

SHA512
409fef3b45b3cee42a2e4d24d2b58039c8a29046d713720da902e8c3d8e4ae96ac63971666b7b9aaae1b7f878f2f2027c8fbad495fe707dcd00bde874da7dafe

Download Submit
C:\Program Files\Windows Defenderr\xfPSEcwMB3\dll1.dll

Filesize
92KB

MD5
e61e00f904f561ec9e6574ddec3bb65a

SHA1
6458b901d065848b44988bff89b8e7933a43d7fc

SHA256
25bff93e68ed9086a8effd7c79e01fca7d3ab228b158acd57ebf583d0054e364

SHA512
06ee9b0b36de98cceafa938cab3f6523be42a869d4e28ffbb1dcbdcee363eeedbf320923653cc90450d0fb8d14cbaf74768acbe78c7177747f2a637103d043ac

Download Submit
C:\Program Files\Windows Defenderr\xfPSEcwMB3\libcef.dll

Filesize
84KB

MD5
97a2b445c8eac7f3b1edd94d67d2e768

SHA1
6c1ec795b0abf5fc8b9e4189f87a425624a28dc5

SHA256
452b3537cc4fc77acd5821ecdd33ae372e460a7b571f708fd91a6258d69c0149

SHA512
3d1eb3d8b1c56ae5b8d5c82380af4544457bc40c9fc6d6fbbdafc8b4f3d53fda2cbddad5aa983a207a708c596da2f00c1c7305093d3b575f6405d8dd064600a5

Download Submit
C:\ProgramData\1

Filesize
2.0MB

MD5
faf4a129b091a57c3ff694dc721d4f3b

SHA1
7430935f501164b46b99766ed9ab68da0db50c24

SHA256
b1d13ed7409ca47f47d200f6b26d8da6a07e645ef49ddc9a28486f46bb8c41e7

SHA512
0103d9bfa27c809f978a2ac805e5eb59e07f0f0eef8aecf2713d8af1bff0d54fbc24043435cb67f550d5afdd6f0a2bc5c0026b6e920efe2ad21b619bbfbb0583

Download Submit
C:\ProgramData\11

Filesize
84KB

MD5
581e04ca52969a8a5eb97b46f7b85927

SHA1
1bc9f5dcf62a2ee361b3c45cfe008622f9353cbd

SHA256
14b8b4e4cdfd1e6e33aa7d28187ce9fb3507405e75edf1e97fc97a7bc4c4d5cd

SHA512
7185b0dea0fa52f0321e5608af6257e6caa3284a89065377501cbf7f59e5ece328f544922486f792a58f9d0efb09119900c3404469dcef56a3a53f0d484d55b3

Download Submit
C:\ProgramData\12

Filesize
92KB

MD5
14f6c81cc6c2c225ca6b44ccb3343d70

SHA1
263108bc9f60251e094a7d4d216637d6c1f97f79

SHA256
f272d65dd3b608bb6a3d16f96a6cc5de00cd8f653c76ee422a6d452e55c67d9c

SHA512
7cacbdafb90cbcbb24365b50734de55432dfae8565d89a126453012a1688b4499ca0979b7ba27e89a116610c168a22219109253d4809195c7c6772cc892e6235

Download Submit
C:\ProgramData\15

Filesize
978KB

MD5
8e945aaf7128bb3db83e51f3c2356637

SHA1
bcc64335efc63cb46e14cc330e105520391e2b00

SHA256
4fcf6394b14e24d830b04209a0ede1dcc911d199740a55d12c8ab8aeabb84073

SHA512
150636eea0cab3e738f5e94ae910d189622fa3221aca1cecc05bf0f5a80f2fab055adeafd99eab7a2a1d3911ff2784cf521a2681e5ddf7737f4363b915b8c2a8

Download Submit
C:\ProgramData\2

Filesize
80KB

MD5
b874ff17621f408640d95b411e573e55

SHA1
9abd7ec752fabc0b2266ca8b80ba8750a235e910

SHA256
3aee565192cd07dde0f38bcde06bad6de492049bcfd2c99e0fcb8cc3fc9b23ac

SHA512
62f81ebd60e134c95612d9dfa5e222a1bdd258d21a33f6ab3e02d7de7bba82b8b5b0177e44592748a3b0e262a18b8c74f50e5e8e6f3772e858843456d9d1469b

Download Submit
C:\ProgramData\4

Filesize
340KB

MD5
7daf9edc6f8f2b2b69bb9367cb99abbd

SHA1
ad05e73f713758350db5f7d6a283f0132a7fd47c

SHA256
2f3c6b44e994efb2f4e8edf5801580df5c74c7984287b62e0602af3c6818e81b

SHA512
dd48bd1a2578239b3820e32cf64fe50181b0e3ac75d8aa881d44424104c1ea251d1f996299f5a651bc58caed40f54c91d318a926e37c17655f592315ac56f16b

Download Submit
C:\ProgramData\a10

Filesize
36KB

MD5
f0284892937a97caa61afcd3b6ddb6d4

SHA1
f3c308e7e4aaa96919882994cdd21cc9f939cabd

SHA256
2514913f8a6f4671a058304651289b0babe47d81c044212b3140ed1c1b643b09

SHA512
058845e0a9a5892a69f24f3a77086e3f9546493ad40a0e5359aed05cf8882a9f3d7aee0449648d5cb76e51530af3e46af59a9b196cc92318334116c92dde4171

Download Submit
C:\ProgramData\a3

Filesize
14B

MD5
0d59c87827537cdd7727d1f0e4d6cce4

SHA1
6067300c20740cf2899d519382f36c453d9b7fca

SHA256
270a9ca2cc8d07c58e43466e95a8aedc7bde468b7b5c0c37845cad5f0d2ab6d2

SHA512
324aca54d36574f1a3d7ade872bc5d4bca8b6ae78817cefcf6fe74af51e90f67a808757eb3c84d65c2a8c8e0322cad8b30c83f29e0011c374fd114122ae92d7a

Download Submit
C:\ProgramData\a5

Filesize
56B

MD5
6f10d76e583b39191028ab57f8edbed9

SHA1
fbaa6e99f3a88d1e4cd606ca45debed661135c1d

SHA256
847f6e3577892365fadc94648eabdde48b9660590ba109e8387a9cb984aee476

SHA512
17a2f133b321fb9ac992e03da4ada3b3e5f1e507c7656d287ea00efddc50885c9ea9f337dd6b8cd52015060b4f0f4fc7832a7a3603ed5a3b498d8da47916743c

Download Submit
C:\ProgramData\a6

Filesize
200KB

MD5
078c21b8c91b86999427aa349cf5decf

SHA1
b939376eaebcf6994890db24ddcb2380c1925188

SHA256
ed2c6bc3e77a404b8cf61176844ad19c1fdcae19881206631e3f0831a4bd919a

SHA512
a006a36fdcaf4c2403238475163553ba2fe7783fea200f28df46ea980a3907d2b24c854153b45b730195a133fcb28f60c157f33c865ea286ad8c354981cf5885

Download Submit
C:\ProgramData\a7

Filesize
497KB

MD5
c8cf4eb512fadb813f69c3184e4bf44d

SHA1
492576912c7c0a224881ea45035a4a9270cd44f2

SHA256
678b89a2ca82b0b7803e36601bd6216c7687c4102de7071676390f2c252cb1fb

SHA512
006665dcf7cd8ad83f8b5c06c2ec9367ee8caa01c3c1cb9502bd540ac9940d103b84f6620ef8b5aa8e78fbe268994c0d8da5fa7ba550e1c8bd038fd1e43d39dc

Download Submit
C:\ProgramData\a8

Filesize
21KB

MD5
da08e194f9a7045dbb19f6e5d5d7f609

SHA1
7884062382bf1e7911f7e74198ca9fecec159c61

SHA256
9bd52ec7e7750500de33df995fcc7e68ed1da70d125579cf76ae8f787577ef75

SHA512
46720cd0677064b00a9e253953b8b6cd5141a99d0090ff0d7c4a24b830ca621878bcdfec3c56880f940662bd78f408782231bdd3cb370e06dadfee71e3e2b2b0

Download Submit
C:\ProgramData\a9

Filesize
13KB

MD5
37aa892a6f35bcbe9b01f0a424f5d4f6

SHA1
e5d60e43a8e0a4b7371bd736e21b1a59546774af

SHA256
6feeb95115d7d8a51403996fee1ad219a52151662d3a01a2d17cfb77dbd51f3b

SHA512
a5d5ac494cba18bb5b2582310416dc2e146732ba4f2eddab6611393d61ac0ae839bacae0da1e85f0965575e6d6284b1180e2e3adb924f1e19d2d7586d2abbd83

Download Submit
C:\ProgramData\{23M67G23Q87G-3W7S3E7Y-2I6E3W8W-3G7K2K7E}\QQMusic.dll

Filesize
92KB

MD5
3c99d99f288e5a9268f433993d17b235

SHA1
4e35aa2f729d1d1d82a75793a8d68e0ff5f2b180

SHA256
87772b03954d1d77c2667646a7a77d83719b714479df4e436b454192015eddb1

SHA512
239b4d0657c0fc631200a2a27f0f63e15af3823b39c3f14c2ca45e4e92c32ba998b334eee557466a1122e982fa104ce449ae946c4c1734b685c3c671473e6283

Download Submit
C:\ProgramData\{23M67G23Q87G-3W7S3E7Y-2I6E3W8W-3G7K2K7E}\vcruntime140.dll

Filesize
78KB

MD5
1b171f9a428c44acf85f89989007c328

SHA1
6f25a874d6cbf8158cb7c491dcedaa81ceaebbae

SHA256
9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c

SHA512
99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1

Download Submit
C:\Users\Admin\AppData\Local\Finkit\ManicTime.xml

Filesize
3KB

MD5
dfe8def4e493eae4ce53296cb2e035ba

SHA1
a68ed8826e8641b2913b2f5af9d0cf4ec0d9f1b1

SHA256
af0b40b517b1fd802f9e19cd6c15fd15be4e9ea259f747a8456253c7329f3792

SHA512
cf8e8176bc9e5f7b5ad7f6b0479e9b1722a5a0463277b134f873bc27fccd01f3f5d8888053ece1118e207c92b622dee1519c25549c82b2624853e44b9d4ed4c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB7F9.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\_2

Filesize
362KB

MD5
1b6bc40c6c5fbd9032ee3779057efe86

SHA1
9fa7737b2c1d792ee76b587cece5b7831e684b11

SHA256
b163b5e667bcaac3c682940889abd56280983ee2c5936924e1182aa80f867f87

SHA512
295603b80684fee2b646048392398fc3a4f4f58f6fbbcbc1dbe76819bd5a4cc5cdc0f2ed9374334babf23928448fc38b154c115a07646fe278481cb921028703

Download Submit
C:\Users\Admin\AppData\Roaming\Consys21.png

Filesize
319KB

MD5
059afc1c343329409574a6e7a2952246

SHA1
9a5c2c1e8ef822907a58732d674194e2ae89d52c

SHA256
6cb8d7f52b605312920ef6dd7cc17e72a291d924a967b924ccf81dd118d7f8e4

SHA512
bc847cf20d009a5e7560f040978447817b3c6ca4a94e255c824b0820ab4fbcc1edca818b19d754a5b062236a25966fabb5d52f11abf5cbe5bc5936d9abe8fd06

Download Submit
C:\Users\Admin\AppData\Roaming\ConsysFun.png

Filesize
2.4MB

MD5
6f0cdccc034f7492efb231a93897311b

SHA1
cd3566e68b44be48f33e6b012eb480bb6237958e

SHA256
b68f97ff677751e0a1e0c4f607cc206b9e5fd1b95bb658245d634f88f038561c

SHA512
b67da58b0d49a937e80ab01402b4aeecfc6898cee8cc31343172d6c43934a24e060982f61fb11e08bbd674505c1f564d8d25759f495c245bb17f8ce8cf5adde9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BEYVABDLRLD6IISV0YD8.temp

Filesize
7KB

MD5
1414e27210eda9fda514d0c05aa8399c

SHA1
86c27a05f9bb437386833198b6cf21faaa3f840d

SHA256
706cb56935668063fb37d22312939831c2ed5825b3865e235cee376e3f3e4743

SHA512
af02e6d6fd9e40ac8b82da63c48ddec175d6180618858aadd8553c285c3d43fe7c840c9bcfa1e2604d7298a2bf3462ada6ace6ac6c70df443491eda176d824f7

Download Submit
C:\Users\Admin\AppData\Roaming\apple\Runinf.inf

Filesize
826B

MD5
62bb69ff89b339b279b69d1a13e9294e

SHA1
6a4daa541fea6807fd50bb2cc47e4e75be40a593

SHA256
cd1ed1c4d9194b87b10e0869af03bcecf01c084a1ba3b933bbb7468db89c0bad

SHA512
a45fd7b3b7d387e31285a20cc8c6aaa2a4630b08d9cedcd663e13659d56049d75017fdeca171c997d5e02857c945f56917776d4fd80a0c8f7966942116d5b8e6

Download Submit
C:\Users\Admin\AppData\Roaming\apple\Runlnk.lnk

Filesize
842B

MD5
423d2cbf8eb4a9a83b12b601cd625846

SHA1
2c58e8db0f550e2e80235f9fbfc2f56a06f718b5

SHA256
8ba5aa14c2838b60951ba0afa15efdde26fc74fc176207e00d439c8f52af8fad

SHA512
1c69b9c9c5d24a916346e006ce9b8591070ce286bb9c0c6e6a7d24a606882d6ea03c703d296ee26a310bd8ab30b0f5b48fc0f88d418421ca5f48976602ce41c9

Download Submit
C:\Users\Admin\AppData\Roaming\chormeui\chomeui.exe

Filesize
1.3MB

MD5
84ba3c0d3d383c2676810494a7b5d4d4

SHA1
51dc4edee8e6d061dddf557861655079bb568308

SHA256
1dce1e3cef651f20cad4f096997407db5b5837b60a52b0abb8ad4c087b6a02e0

SHA512
6246e29c25c45258a2f244cb31991202d1b57e9309521296787b90d1662b3e9dd14d27cdd5557fbab39b66e18bbb63c9bf346091d0bf2dcfc798745ce030d079

Download Submit
C:\Users\Admin\AppData\Roaming\install.ini

Filesize
47B

MD5
c6b92dd6631be4719db3e258fc834151

SHA1
17e2de7b48bb373705e44c50c0e70f435743860e

SHA256
1e170289b158d70bff755b7d4f842833dd139afce297ae581b11a93cc2c52681

SHA512
841d7aae253d7efa8db7e1ce210aa1a4cfc55e251b5905ef08f0a64a68f643558e69f10a7a95bdb0124483056a676d7a2536a32c491169e78f32f7e8819be227

Download Submit
C:\Users\Public\Desktop\chomeui.lnk

Filesize
2KB

MD5
3a46fca931440b077b359950b2ad089a

SHA1
539c0264d52aaec27e8cbeb005e582ba54156490

SHA256
7ec8d28f6cd220a953915778010a1578b4a2302da95d117b60b13759a16cf9d3

SHA512
690988d38f96fe5bd98653d989efc175c24c13e2baf49c39a5b715993fa58a2b3d90da2b24987162bb7f2444bc421c8415fdf7ef139036b41cc23e451be9c337

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\WallPaper.exe

Filesize
27KB

MD5
8869f2eb40c1444fffec25804c51e756

SHA1
2f121dcf0ab1d7e152b9223c6d5bbef753adc612

SHA256
e3149bd7c1c55dfb9f926bafd45a298771814d38a4d7ebd4c9ababdeb9c2fee8

SHA512
f32debb5a382cb3cd7fab4ff60b94182156cbec775857fe2685c5816105712a4c7e3e96b78089b2556ce846c7de2047359449d93b288e4fb1d7617402ad05220

Download Submit
C:\Users\Public\Documents\RECSLLE.BIN\system\QQMusic.exe

Filesize
623KB

MD5
d9746c8d55bed7b372ccef704f96ddda

SHA1
61c6b8ba9108fc7617264bb7d58e163457946e5b

SHA256
afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd

SHA512
e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e

Download Submit
C:\Verifier\QaLJEO

Filesize
96KB

MD5
6103dbe823a015788397731babc5e4ee

SHA1
2cecbdaff319322365fa2b0a87d191e185d73e4a

SHA256
37e0a8caa6c3b65799690bd9f655ede1eb476f00410f6021c14d1138e01aa7b7

SHA512
62d5bf0481a69c7403290b0b37d6a36dd9645a659b7c00e50fc494b2fad99fb06fa2dfb93a9e716271b156f2f3c27bbbe84d4e95a59a8071cfbfa3e44b31ba5d

Download Submit
C:\Verifier\TQMxSGIC

Filesize
108KB

MD5
32c4e9c809fd633ce8e661c003e4cbec

SHA1
1b9b6c7d78bf69397648ef30697366a7d83af487

SHA256
2af34e5ddf1c38783ab319e1320a7f40f526d66c45e910a0f906fab6c2eb7dba

SHA512
dffd43ca0326b4e501ee0586ab795e7196e2f11c3bbf212a367477174c4877b32a1677b5240976c93f45a065df77989f686597bda6a3bc414931617f4729419c

Download Submit
\Users\Admin\AppData\Local\_2.dll

Filesize
344KB

MD5
27bfaff47dce732f5e1bada41b756612

SHA1
33efd88e7ce656e01939b48ad2ff513fa29b9699

SHA256
ab27ae2fa1ee803f1d7269b674a4825ef7f70badfe8b9e7456b2ce6235fe9b56

SHA512
057ce5a8e47a59ec2d98581bb5e6568c2968709c87adcb7aa761cfa0ff07ea1706ca74f4c0fffef0eb92cdfdadf6dafa8664e3c69ed9d94deb423a1b0b6c1da1

Download Submit
memory/444-499-0x0000000000320000-0x0000000000359000-memory.dmp

Filesize
228KB

Download
memory/444-591-0x0000000006BC0000-0x000000000742F000-memory.dmp

Filesize
8.4MB

Download
memory/444-496-0x0000000000320000-0x0000000000359000-memory.dmp

Filesize
228KB

Download
memory/444-617-0x0000000006BC0000-0x000000000742F000-memory.dmp

Filesize
8.4MB

Download
memory/444-488-0x0000000002220000-0x0000000002276000-memory.dmp

Filesize
344KB

Download
memory/444-557-0x0000000000320000-0x0000000000359000-memory.dmp

Filesize
228KB

Download
memory/444-590-0x0000000005EE0000-0x000000000674F000-memory.dmp

Filesize
8.4MB

Download
memory/444-565-0x0000000005EE0000-0x000000000674F000-memory.dmp

Filesize
8.4MB

Download
memory/1360-634-0x0000000000410000-0x000000000049A000-memory.dmp

Filesize
552KB

Download
memory/1360-637-0x0000000000410000-0x000000000049A000-memory.dmp

Filesize
552KB

Download
memory/1864-346-0x0000000000230000-0x00000000002BA000-memory.dmp

Filesize
552KB

Download
memory/2164-298-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2312-511-0x0000000000630000-0x0000000000669000-memory.dmp

Filesize
228KB

Download
memory/2312-508-0x0000000000630000-0x0000000000669000-memory.dmp

Filesize
228KB

Download
memory/2312-504-0x0000000001DE0000-0x0000000001E36000-memory.dmp

Filesize
344KB

Download
memory/2552-434-0x0000000005580000-0x0000000005DEF000-memory.dmp

Filesize
8.4MB

Download
memory/2552-358-0x00000000006E0000-0x000000000076A000-memory.dmp

Filesize
552KB

Download
memory/2552-492-0x00000000006E0000-0x000000000076A000-memory.dmp

Filesize
552KB

Download
memory/2552-360-0x00000000006E0000-0x000000000076A000-memory.dmp

Filesize
552KB

Download
memory/2552-361-0x0000000000160000-0x0000000000193000-memory.dmp

Filesize
204KB

Download
memory/2552-424-0x0000000004AA0000-0x000000000530F000-memory.dmp

Filesize
8.4MB

Download
memory/2552-473-0x0000000005580000-0x0000000005DEF000-memory.dmp

Filesize
8.4MB

Download