734403a96fad68cb2ef2b340adddd9cadd5894007aac703dcdb4a4cb8326c538

max time kernel
1088s
max time network
1202s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/MEMZ 3.0 (1)/MEMZ 3.0/MEMZ.bat
Size

12KB
MD5

13a43c26bb98449fd82d2a552877013a
SHA1

71eb7dc393ac1f204488e11f5c1eef56f1e746af
SHA256

5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
SHA512

602518b238d80010fa88c2c88699f70645513963ef4f148a0345675738cf9b0c23b9aeb899d9f7830cc1e5c7e9c7147b2dc4a9222770b4a052ee0c879062cd5a
SSDEEP

384:nnLhRNiqt0kCH2LR0GPXxGiZgCz+KG/yKhLdW79HOli+lz3:nLhRN9t0SR4iZtzlREBWhuF

Score

7^/10

bootkit discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1984	MEMZ.exe
112	MEMZ.exe
1828	MEMZ.exe
1936	MEMZ.exe
3052	MEMZ.exe
2172	MEMZ.exe
2244	MEMZ.exe

Loads dropped DLL 64 IoCs

pid	Process
1984	MEMZ.exe
1984	MEMZ.exe
1984	MEMZ.exe
1984	MEMZ.exe
1984	MEMZ.exe
1984	MEMZ.exe
1984	MEMZ.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe
5984	taskmgr.exe
5984	taskmgr.exe
5984	taskmgr.exe
5984	taskmgr.exe
5984	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe
5984	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe
5984	taskmgr.exe
2684	taskmgr.exe
5984	taskmgr.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000cb666e0dbe9e247212d9302aa7b5ae085b406874b35780554da48104034c3611000000000e800000000200002000000059f953e43b8bcc3da80e71a7cb9cd3100e1389ca11e0bac1ced9d6edfab3f2bc2000000083f5926b7c615178dcfe6da51f0abcebd1efd8e812fa046323d5e5a36fe0f41f400000002920dce0d59c31a1d2edb1817e1cb82b2b7649f7c29fddf18cbd88861060c19f6d2ac3b6dc2c6e9a8d398f4bf4251018c099d117980649bd8c96573eef691bf5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000824f12bb61011d79aae47972fe8d22e7b26f1273ba5504b2ae42e816e5782537000000000e8000000002000020000000ce32622c1e4f111d9d50ce1259a6a336831ff16de9eccd15829f628d9c02ca37900000001498acfb1835dd4f00e569d73e2c6cc0c4060ffff07e33aa330a4595524237bae3df28aeed43664c3ee0bd308b25b3d4604faace1a398c81f7722d1a4afd81b19eadcb20562a935e364cf6a29754348c895e66da58d77f5bd3d98d752dbcf39f87938695ed6142c5bad5bae942a82dd1bde285ed21497a2cd71ffda7eb26d2644268e1b9e4216a88b2aa15d08ed9884d40000000fb154f8d77e6f808e52c2e314c99bee98541031ccbaa6d4943862b834eb06cbdc01df4f2eb7b88ae43d2ce6e9b8f105c7f84ed01dac36d07b546df25c3821d9e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50830b07bd07db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Runs regedit.exe 5 IoCs

pid	Process
9936	regedit.exe
3324	regedit.exe
1300	regedit.exe
4436	regedit.exe
5280	regedit.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1984	MEMZ.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
112	MEMZ.exe
112	MEMZ.exe
1828	MEMZ.exe
1828	MEMZ.exe
112	MEMZ.exe
1936	MEMZ.exe
1828	MEMZ.exe
3052	MEMZ.exe
1936	MEMZ.exe
112	MEMZ.exe
1828	MEMZ.exe
3052	MEMZ.exe
1936	MEMZ.exe
112	MEMZ.exe
1828	MEMZ.exe
3052	MEMZ.exe
1936	MEMZ.exe
112	MEMZ.exe
2172	MEMZ.exe
1828	MEMZ.exe
3052	MEMZ.exe
1936	MEMZ.exe
112	MEMZ.exe
2172	MEMZ.exe
1828	MEMZ.exe
112	MEMZ.exe
3052	MEMZ.exe
1936	MEMZ.exe
2172	MEMZ.exe
2172	MEMZ.exe
1828	MEMZ.exe
112	MEMZ.exe
3052	MEMZ.exe
1936	MEMZ.exe
1828	MEMZ.exe
3052	MEMZ.exe
2172	MEMZ.exe
112	MEMZ.exe
1936	MEMZ.exe
3052	MEMZ.exe
1828	MEMZ.exe
1936	MEMZ.exe
112	MEMZ.exe
2172	MEMZ.exe
3052	MEMZ.exe
1828	MEMZ.exe
1936	MEMZ.exe
112	MEMZ.exe
2172	MEMZ.exe
3052	MEMZ.exe
1936	MEMZ.exe
1828	MEMZ.exe
112	MEMZ.exe
2172	MEMZ.exe
3052	MEMZ.exe
1828	MEMZ.exe
2172	MEMZ.exe
1936	MEMZ.exe
112	MEMZ.exe
3052	MEMZ.exe
1828	MEMZ.exe
2172	MEMZ.exe
1936	MEMZ.exe
112	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 17 IoCs

pid	Process
2792	mmc.exe
2684	taskmgr.exe
2804	mmc.exe
2244	MEMZ.exe
3648	mmc.exe
4848	mmc.exe
3712	mmc.exe
5072	mmc.exe
2188	iexplore.exe
4400	mmc.exe
3680	mmc.exe
5984	taskmgr.exe
5252	mmc.exe
4968	mmc.exe
4856	mmc.exe
7000	mmc.exe
6816	mmc.exe

Suspicious behavior: SetClipboardViewer 15 IoCs

pid	Process
2804	mmc.exe
3648	mmc.exe
4848	mmc.exe
3712	mmc.exe
5072	mmc.exe
4400	mmc.exe
3680	mmc.exe
4968	mmc.exe
5252	mmc.exe
4856	mmc.exe
7000	mmc.exe
6816	mmc.exe
7720	mmc.exe
8084	mmc.exe
9196	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2792	mmc.exe
Token: SeIncBasePriorityPrivilege	2792	mmc.exe
Token: 33	2792	mmc.exe
Token: SeIncBasePriorityPrivilege	2792	mmc.exe
Token: 33	2792	mmc.exe
Token: SeIncBasePriorityPrivilege	2792	mmc.exe
Token: 33	2252	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2252	AUDIODG.EXE
Token: 33	2252	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2252	AUDIODG.EXE
Token: SeDebugPrivilege	2684	taskmgr.exe
Token: 33	2804	mmc.exe
Token: SeIncBasePriorityPrivilege	2804	mmc.exe
Token: 33	2804	mmc.exe
Token: SeIncBasePriorityPrivilege	2804	mmc.exe
Token: 33	3648	mmc.exe
Token: SeIncBasePriorityPrivilege	3648	mmc.exe
Token: 33	3648	mmc.exe
Token: SeIncBasePriorityPrivilege	3648	mmc.exe
Token: 33	4848	mmc.exe
Token: SeIncBasePriorityPrivilege	4848	mmc.exe
Token: 33	4848	mmc.exe
Token: SeIncBasePriorityPrivilege	4848	mmc.exe
Token: 33	3712	mmc.exe
Token: SeIncBasePriorityPrivilege	3712	mmc.exe
Token: 33	3712	mmc.exe
Token: SeIncBasePriorityPrivilege	3712	mmc.exe
Token: 33	5072	mmc.exe
Token: SeIncBasePriorityPrivilege	5072	mmc.exe
Token: 33	5072	mmc.exe
Token: SeIncBasePriorityPrivilege	5072	mmc.exe
Token: 33	4400	mmc.exe
Token: SeIncBasePriorityPrivilege	4400	mmc.exe
Token: 33	4400	mmc.exe
Token: SeIncBasePriorityPrivilege	4400	mmc.exe
Token: 33	3680	mmc.exe
Token: SeIncBasePriorityPrivilege	3680	mmc.exe
Token: 33	3680	mmc.exe
Token: SeIncBasePriorityPrivilege	3680	mmc.exe
Token: SeDebugPrivilege	5984	taskmgr.exe
Token: 33	4968	mmc.exe
Token: SeIncBasePriorityPrivilege	4968	mmc.exe
Token: 33	4968	mmc.exe
Token: SeIncBasePriorityPrivilege	4968	mmc.exe
Token: 33	5252	mmc.exe
Token: SeIncBasePriorityPrivilege	5252	mmc.exe
Token: 33	5252	mmc.exe
Token: SeIncBasePriorityPrivilege	5252	mmc.exe
Token: 33	4856	mmc.exe
Token: SeIncBasePriorityPrivilege	4856	mmc.exe
Token: 33	4856	mmc.exe
Token: SeIncBasePriorityPrivilege	4856	mmc.exe
Token: 33	7000	mmc.exe
Token: SeIncBasePriorityPrivilege	7000	mmc.exe
Token: 33	7000	mmc.exe
Token: SeIncBasePriorityPrivilege	7000	mmc.exe
Token: 33	6816	mmc.exe
Token: SeIncBasePriorityPrivilege	6816	mmc.exe
Token: 33	6816	mmc.exe
Token: SeIncBasePriorityPrivilege	6816	mmc.exe
Token: 33	7720	mmc.exe
Token: SeIncBasePriorityPrivilege	7720	mmc.exe
Token: 33	7720	mmc.exe
Token: SeIncBasePriorityPrivilege	7720	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
532	cscript.exe
2188	iexplore.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe
2684	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
2640	mmc.exe
2792	mmc.exe
2792	mmc.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE
1356	IEXPLORE.EXE
2244	MEMZ.exe
2852	mspaint.exe
2852	mspaint.exe
2852	mspaint.exe
2852	mspaint.exe
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE
2244	MEMZ.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
2244	MEMZ.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2244	MEMZ.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
2244	MEMZ.exe
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2620	IEXPLORE.EXE
2244	MEMZ.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
1448	mmc.exe
2804	mmc.exe
2804	mmc.exe
2244	MEMZ.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
1836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 532	2396	cmd.exe	31
PID 2396 wrote to memory of 532	2396	cmd.exe	31
PID 2396 wrote to memory of 532	2396	cmd.exe	31
PID 2396 wrote to memory of 1984	2396	cmd.exe	32
PID 2396 wrote to memory of 1984	2396	cmd.exe	32
PID 2396 wrote to memory of 1984	2396	cmd.exe	32
PID 2396 wrote to memory of 1984	2396	cmd.exe	32
PID 1984 wrote to memory of 112	1984	MEMZ.exe	33
PID 1984 wrote to memory of 112	1984	MEMZ.exe	33
PID 1984 wrote to memory of 112	1984	MEMZ.exe	33
PID 1984 wrote to memory of 112	1984	MEMZ.exe	33
PID 1984 wrote to memory of 1828	1984	MEMZ.exe	34
PID 1984 wrote to memory of 1828	1984	MEMZ.exe	34
PID 1984 wrote to memory of 1828	1984	MEMZ.exe	34
PID 1984 wrote to memory of 1828	1984	MEMZ.exe	34
PID 1984 wrote to memory of 1936	1984	MEMZ.exe	35
PID 1984 wrote to memory of 1936	1984	MEMZ.exe	35
PID 1984 wrote to memory of 1936	1984	MEMZ.exe	35
PID 1984 wrote to memory of 1936	1984	MEMZ.exe	35
PID 1984 wrote to memory of 3052	1984	MEMZ.exe	36
PID 1984 wrote to memory of 3052	1984	MEMZ.exe	36
PID 1984 wrote to memory of 3052	1984	MEMZ.exe	36
PID 1984 wrote to memory of 3052	1984	MEMZ.exe	36
PID 1984 wrote to memory of 2172	1984	MEMZ.exe	37
PID 1984 wrote to memory of 2172	1984	MEMZ.exe	37
PID 1984 wrote to memory of 2172	1984	MEMZ.exe	37
PID 1984 wrote to memory of 2172	1984	MEMZ.exe	37
PID 1984 wrote to memory of 2244	1984	MEMZ.exe	38
PID 1984 wrote to memory of 2244	1984	MEMZ.exe	38
PID 1984 wrote to memory of 2244	1984	MEMZ.exe	38
PID 1984 wrote to memory of 2244	1984	MEMZ.exe	38
PID 2244 wrote to memory of 348	2244	MEMZ.exe	39
PID 2244 wrote to memory of 348	2244	MEMZ.exe	39
PID 2244 wrote to memory of 348	2244	MEMZ.exe	39
PID 2244 wrote to memory of 348	2244	MEMZ.exe	39
PID 2244 wrote to memory of 2188	2244	MEMZ.exe	41
PID 2244 wrote to memory of 2188	2244	MEMZ.exe	41
PID 2244 wrote to memory of 2188	2244	MEMZ.exe	41
PID 2244 wrote to memory of 2188	2244	MEMZ.exe	41
PID 2188 wrote to memory of 1356	2188	iexplore.exe	42
PID 2188 wrote to memory of 1356	2188	iexplore.exe	42
PID 2188 wrote to memory of 1356	2188	iexplore.exe	42
PID 2188 wrote to memory of 1356	2188	iexplore.exe	42
PID 2188 wrote to memory of 1296	2188	iexplore.exe	44
PID 2188 wrote to memory of 1296	2188	iexplore.exe	44
PID 2188 wrote to memory of 1296	2188	iexplore.exe	44
PID 2188 wrote to memory of 1296	2188	iexplore.exe	44
PID 2244 wrote to memory of 2640	2244	MEMZ.exe	45
PID 2244 wrote to memory of 2640	2244	MEMZ.exe	45
PID 2244 wrote to memory of 2640	2244	MEMZ.exe	45
PID 2244 wrote to memory of 2640	2244	MEMZ.exe	45
PID 2640 wrote to memory of 2792	2640	mmc.exe	46
PID 2640 wrote to memory of 2792	2640	mmc.exe	46
PID 2640 wrote to memory of 2792	2640	mmc.exe	46
PID 2640 wrote to memory of 2792	2640	mmc.exe	46
PID 2244 wrote to memory of 2392	2244	MEMZ.exe	47
PID 2244 wrote to memory of 2392	2244	MEMZ.exe	47
PID 2244 wrote to memory of 2392	2244	MEMZ.exe	47
PID 2244 wrote to memory of 2392	2244	MEMZ.exe	47
PID 2188 wrote to memory of 1200	2188	iexplore.exe	48
PID 2188 wrote to memory of 1200	2188	iexplore.exe	48
PID 2188 wrote to memory of 1200	2188	iexplore.exe	48
PID 2188 wrote to memory of 1200	2188	iexplore.exe	48
PID 2244 wrote to memory of 2004	2244	MEMZ.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:532
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:112
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1828
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1936
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3052
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2172
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:348
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2188
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1356
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:209950 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1296
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:1061908 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1200
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:406565 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2940
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:734245 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:268
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:537645 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2976
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:996444 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2620
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:996461 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1836
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:1520712 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:1904
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:1324166 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:3412
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:3945557 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2880
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:3421273 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        
        PID:892
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:2962522 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2100
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:2962554 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        
        PID:3472
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:1979510 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:3272
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:1717379 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2792
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2392
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2852
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2684
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2696
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1448
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2804
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3860
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3572
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3120
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:3544
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:4088
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:812
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Runs regedit.exe
      PID:3324
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:988
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      Runs regedit.exe
      PID:1300
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3472
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:3648
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      PID:4728
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:4848
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4516
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3556
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      Runs regedit.exe
      PID:4436
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      PID:3668
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3828
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:4400
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      PID:2968
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:3680
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:5984
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6120
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5716
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5408
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:5252
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5152
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Runs regedit.exe
      PID:5280
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6028
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6020
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6636
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6988
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:7000
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6740
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3132
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6728
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:6816
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4804
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6604
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7708
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        Suspicious behavior: SetClipboardViewer
        Suspicious use of AdjustPrivilegeToken
        
        PID:7720
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:8164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7888
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7828
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7096
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: SetClipboardViewer
        
        PID:8084
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7380
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7304
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7916
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6796
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6704
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:8588
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:8872
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:9176
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
        5⤵
        Drops file in System32 directory
        Suspicious behavior: SetClipboardViewer
        
        PID:9196
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:9100
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      PID:7148
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        
        PID:8860
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:8360
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://google.co.ck/search?q=virus.exe
      4⤵
      PID:9068
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5612
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      PID:7540
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        
        PID:7264
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      PID:9728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:10092
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      PID:7220
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        
        PID:9372
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:9264
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      Runs regedit.exe
      PID:9936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1888

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-537294296381397741-746782650-325521037-202186846218929080-12926830942040939462"
1⤵
PID:7380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1df4559dc042f51453d31bbd6d406cac

SHA1
defff321b0e39935b0281192bc732a47edc22d84

SHA256
2e5e6363cb570b2bdfef7476d83333ea9e7699f5418fb102d5ffa795f0536d9d

SHA512
c4a96d6fa0d96e706e89a571ad916c8995cb045bc3d30ac8f83b57c95bc1ee59e983ca42534b24f02ad862959826df6b5aac6f4a1288f5a3fb0eaf873f13f731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_09E5FD68127B2EBD22C529250B8D2273

Filesize
471B

MD5
cea7f7436b62d1aa1808fbf42c7614e8

SHA1
d8530285ce4e6fd1ca352a617263fe26d46d383a

SHA256
dfddd19826ded2ca69f63200f442f8f4dcf9b5ec1dd78e15d74d015c651ba190

SHA512
3c679f47869a4e78c2b7a5a5ac20ce4ae922e4231f2cee533cf44d25e1ee45e848a3fd55d8e4c3d98bbe357ea2b9825dcbab55d9b71d5472d29b9e77aa86fda0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B115649384851BE6BDDEA6DCEC8C2FEC

Filesize
472B

MD5
57fabf8ce960f6516a99cb1065e0f1b5

SHA1
0f06fda5952c1e047f2fdd06a941cde444e7fd1b

SHA256
287c0da810f4506a1fca9807d8457c52631b4f723f272412631a59fdda36d179

SHA512
df597f53035b5dc18aaefbe0fb232e9e2770343319e716a32d416d27be2b4d77e4671786d0e6711549440dda3e68fb122e61c42fc781238cb158d0c4d1546cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_193C88518F770D3F8D3CDA4F180E8635

Filesize
472B

MD5
2e15489eb620ba4779210d523e343152

SHA1
c6674bbf4ad29b2742ab2382f6ce4c17754b05d6

SHA256
04ba2c1f6dde1be4f81cdd43a931f554f357fa751ce75028929f14695995c99e

SHA512
87ea9978c49ce2b715361cdd60900ed5e3a7a589986056f4df3b547ad0168ee3bbe453b0a1a348ce7911a5548bd17cc6918aa88c689b2b46eeb857e2ec9ae471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
9dce601eaed307f3e2205fd4343c4400

SHA1
bdc2ffe277b4a7013defcf33bd35c17de8128deb

SHA256
781f7892e91b1f7e68bc038281a09a6b5cc4ce25bf52645441956b94f0e5d397

SHA512
c6f6a4bbcdf8ba8fbc19905e3f28ab281128d3c1a381221908fc7198b6c60da1b38e23496157e3c83c9833ad1bb12b77787e6e7f1f183d8e8022524bcc47e907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b684e7e2fc96a07e431d72e5b8ffff54

SHA1
dbc0d065b3b1536b368b587bf7ea69ca06b8dc60

SHA256
999cd21d45e4d24955032fbed3c0f6012f2c0e3f73bdd0e44a7708a201829564

SHA512
28ff83c38cc000dd01ced3cf01985eb8bcfc84466e0408e4804174468a0c074caa96d70654935af868c2206fb0c327690f890c670b62c6a1cd8f27dd5c5cf385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_09E5FD68127B2EBD22C529250B8D2273

Filesize
406B

MD5
6bf2fe64bfd5e8eb981993e5cb97d2cf

SHA1
9c60a356a3d93ad3d5b3570397405afe7b741815

SHA256
5f3b7139dea91e41a2351fafcd8e7436dc9039c0ab6f8609fe6276e006dc55fc

SHA512
026e315902209f8ba221282bc9396b806e5b5c99d9e12e9a06dfd897473cfbc2232e412e2bcc5728640f3ea6ec63b0f0385115dfad7e51abe148f2a92f05f23d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B115649384851BE6BDDEA6DCEC8C2FEC

Filesize
398B

MD5
4024d896fb01e93427b00b8e2d918e27

SHA1
cb2630a547a2a7eb7bc957f3d340ceb540533bcf

SHA256
33d44c19ff1c9022063997ab0908766da58e221e0ab81a8c2bee1ea99089a56e

SHA512
40922f6eb6c313d0bf00056aa04ad8352c0925907ffde73ac210e1117f9dd82373a9e91f05982c84223bb0507e4ba3320d6b1512cff3119b900c6834301833bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcbb6ff38a7a6e7b732aa12bdfe94b9f

SHA1
8e4463272987d0eaec106c881d61befafa1b1df8

SHA256
81cb315f7b2ec90e42ae0ce8f4b0319e80967dce897ce6a61a2c86709abae776

SHA512
00578969945a40861bf0e9f3a619c9be4650662c684f74d21e82fb87df7bc451368e68fbda0e013a237191e5d304fad61f2286e6ef0aaeae0edccb9612bbfdfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8654ae3628cd715dc174b8c38b2a09c0

SHA1
08725e51d64cdb6a25f7affbc9decdb8fd636c56

SHA256
75671d6b3362a54c50fee0fde974b62f5e4b6db74e1a76ba111a352da0eee780

SHA512
4bc35bb1bec041acc1efa0fd8e41de8fcb0968206056b854bb44e4c3584cf425e5cb06c83565e27f965be49ae1e8da072b95517eeb445341d74787f36b10b245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3312679c054b00c3a64ff102e5c4d0f

SHA1
b9ac678e527d0a9fe65df1c84fd55748273e6dab

SHA256
af6bbac0d87303b0620752c29a613bfe1fd62ae5c65eee81080f17fea93b6153

SHA512
60d75a4a72c1089b2a9194d9e36853b857a8d2c51407760e519281575ff9f7ad4003189c84c79c4f1df2aa363514935cb7516dc1ff5c549f629711d8e1685bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a35833aa9d4f1ae111127e5056fba313

SHA1
fcc7ff70edcaedef040b2ad10afde1c4a456b4d3

SHA256
8f2721d46e0aa32473a548c67ced0ac0c2e1c7475836a09942084696d433a812

SHA512
348b2fc115dfb92e54c6bc21d868c190ac5694756b47c297b989260c9be40b48365688fb1bfc2a76b7695f2d1cea3469a383296699edfc95dee72bcabdf3b01e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15d26eab764bcaac0431fc7810fd30c1

SHA1
4f1d97dd244e25664372ce22c9ad423c9e8f3732

SHA256
ab3691b062476d1fffad0295f3dc9e5075ecf2cba7d3dc0b00b18fd6703d86f0

SHA512
579cecb22f7e6a2f540a9af2c976202245f2e84169553c5d5f986bf32da03b5a563c5a3784d83a0c44770479740f50d28ecb88af6a04d652050885d3084c1c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f5e9da9c83bd121e7aeef0a34ce465c

SHA1
d5866142738f495b016b765a88df3c90bcee800e

SHA256
584a1997841cd7f0fec1ef7acf54887453e21159557677fea50a21ebf9fa89fd

SHA512
34a044444d87c4cb38d60e3226e4854af577cd93228e382a3ff66e0c4d9ad085d9cb92c1af42cb2365c2a20c566565f2e9bf6a619a46c0b2078ca51b528a7d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5d41382368bfef6e40e3a33c5fb21c9

SHA1
e36eb29e5f82773b299d0be44b84ce78a012d628

SHA256
e35e16a9910147dd395f2e16bc2967bcd07239ff9f51cc5c2c9b391bc3c4dace

SHA512
b298b7c6ba74679b57103e292976f68b7b47a7af8af83fc7bdab2d95a21f3aeae410e94946a7f4d859ac7d61a395e8a8c39208f9ae705100c1dce7193aa3fc79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a542c98e9b5468f915c66462cdf8a0ba

SHA1
a42f2168087430415f89e61ab903c909f809b2e1

SHA256
689efa9cbed9c6a28912ef03b8048426e64ffaf1186d4b26f6ab98f9234659de

SHA512
4dcede4ec54cd5384632f745dfb0dc0ad7a24ea5cb5f9577e7774aab1ac4c27ad36e706fe50ed1d459e2eda11da66635d577b2b9df59d2a2e5a8333ebdbdfa60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7edd69fa110e5e4bbce964a71c59e9f0

SHA1
fcfcb358a2659ac1fde0fb24a8d67b5e6f926f16

SHA256
90d386468898962c52a5d13ca76c13b92853d7febfe0c6bbc17b923abe7c7a24

SHA512
fae6e43831e86827e38d20c8d1c28af075e18f27f21914df6a7aad45d1720828f04447244d0f4c18d8eb53526a32e93de8bd1fe7275696997ccb4be09bbd3b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6931b0b3d5096db1126ab1e78cbf5a34

SHA1
4b8a992fc9c97830c92c8a51dbc2e8e11f3af55d

SHA256
f0f944324d9474fdab15272c1fa33c6f85173801e2ce809a98cdfa36655c4f7a

SHA512
923c376139a036c72983856404fff138c7c639a960a58cc53545b1e06481995feff7e1ea44b77f1ea39f969c582e5896f9bd57f6475798c450be4cd2ea7e426c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a821f3249abf32035ef6a7813f0f8b3

SHA1
1313b5274b1bde16276e6c8261d7ae84f12f874e

SHA256
4d3f3ba6846c832d62beda665c7fbead35fe497165a26fdfea5edd3dac2cd9e2

SHA512
6a38c4ad8e17cb4c4d0c455b62194261f8470dbb482cc7dc2b8a4ee56b9a95136cbcc54c6ff79eecb8522e1b3961b53cbc8130c63221f6138911218a2bd6cb0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4704594dd0fc9f071090022d5297bb5a

SHA1
792ae98905a154835ef1527e6798341c32626a5f

SHA256
47c4f9a6f1b93366e8323874b667a4a470d12e6ab71ff39bf34e5f06e8e23014

SHA512
e50fbf0af58a977718b4df71858eb11ec50ed9c8ab6004241f061ad03f26292d23edf2283178dfbb93bd2fe69ca0db3e51203e961821663a33b5ebbeeed58e69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc649791d6ef856ebb9c277eec67ade7

SHA1
f3cfffcc85e77e2f3beadce8c0b14d66d8c92c1e

SHA256
43b269a8d8f029b072bb60c56938b8e43c339f000bb4464b9c5cbdd6ef7b2d88

SHA512
03b0e69d011e43c8038fc21f6543f37f0e8322352e686659b68bd6c33ece4a5c17455bd4f36539bdfa1fb11225041ef2beca40b7e7f3ad9e29f02ad5469277ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b203820b3f8ccf03507eb301fa796f70

SHA1
8188ef19da5426526dac973f977ffafe7ec0a03d

SHA256
50726be6de0897b48b0a4e2d7f061f2ce3258f3b4f8a20e30b5eb7da3055b155

SHA512
20e45527522785006ed46c04f9579d38f82aaa30f66590db4f65f26e28a8898f09fba70854eb6225b025df3f0801c58cd56eba41276a1e3b385ce1f65032094a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d985e3dc7a2006cc96a5fd73ebaf0ce9

SHA1
a06600c814fbd7e4bc603b61978e38615cc69de9

SHA256
d4f8ba429e7480a79879bcba24e5fb50b567da3fa88b36e15787abaa9d48e496

SHA512
49d91784aefe07c16f4709d7dc89f92131e20f6fd769dd9d49598ef8f0e2ec88c1e82516ba47eb03a3645dd1581c3a9a72a4264040f5f9d82d899a69f3dc5340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c12400b8b917bd128cbc8c3190de5d45

SHA1
5a97f61c2bf655676aae45fd7614092c7994b641

SHA256
ac36c9be959bfa3f45ea00f60b13f50c46a4d662eaf59563133f5d6f91755bc8

SHA512
73134ffd505516c3d74bea6fb43f021cb34849c957aaf84df766acc01ff9bacd104a1a6b36f8a9b26c2d9a0e81e88f3c4ea2eeb1b685870dbf319f702961c8aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a8c6c67ea802a7e4ca35cd06ae7429a

SHA1
1ecb208021f4d045fdaf2fdf0c4b72eb90bfab5f

SHA256
a8a24dadea7683738a863ac1e501c9a2dce13578a999598a074bc39de2228836

SHA512
f0486541945950e66965aad2379559df478855dd69d77d0c1049defec944ecf74f7b256b750ea23908f4b36ff3c3301aba181b6b9a8a18c855a3cb26a37e14c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
945ad4f7ba7de0470c9fffd8aa9b20ab

SHA1
9b59eea7c636835abd823a6a6c85300d5f6f1ecf

SHA256
c80d5f254591bf22eae389e98279bf7ee62273527cbe5f126bd30291948caa0a

SHA512
55b07ed97dbce4f90c75ff0e5e37f96a0aaf576d56f181fdce59b4e09a560eb5516a70384dc1a52769843c061906513c39d55181c8f8510a0004de33538d3b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d77538a96184efeed7833e02a60c0393

SHA1
ca99e83edb09e53fdb0483009f4457c0f5774991

SHA256
0430136fb243590762e8a3189c2e7cc879c2a3e15f7875469c4923627cb6c08e

SHA512
00e1955ba27a27d4faa9e623c600070ae63e79ed98619d45939f8d3879e9c4dadc420e8b0003a32647e5141f66619a0726d5d07a46b5d949dbfbfa526b40dd6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8a09e1567daf5294fce5fb30f26931d

SHA1
9ccb64d0675801c2642a187f896606183153cc3b

SHA256
9b959e9a8bd88939cd21c92136d77d4cc5cffad04f1f64914a0457854b10ca18

SHA512
0c067c608213a3e4cad8cf4dae13ed08189625b2fe0919b121aa278dc1fa87387f815987496f298e68d6146212ee3c476797f045040bc3d31ad3226fe2052352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1c32a20936ebc9cc48e1259c139039a

SHA1
f83011a6b3305b543a8433eabfc3a747f0f46341

SHA256
8b414ce2fbdc3d227170dbba3801f15032700eded01304c606bf27db1044dfd8

SHA512
6553b7ae325e6428d39e001b08352065c35cd3af49976ac3de684cb7e7213a63d147d42145077a608a01ccf7e1a167e39ec24088969555e001147bfec47cad30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_193C88518F770D3F8D3CDA4F180E8635

Filesize
398B

MD5
2231cbf4dab6758212db0dd83e7e7a9a

SHA1
91c56f7b73db70a1a252e740c67ae6aecbbd854e

SHA256
1e3c8584c78889bbbf4381912f9bfa7530f940b7da67d0bfb9d5419ee90c540c

SHA512
ad95228898aab6bc2715af5cf8d28cac25224964961854f992f1d1133e49e1a5272a92e200f2d6a9b1de97bc79e5870811a6b10d07f515b7b99422bbc7931189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\LOL9I7C8\www.google[1].xml

Filesize
99B

MD5
deb9fd7b5315d41872653c5523b47e54

SHA1
fd62df33cd0912c24a12110f6a3fc4d18542aaeb

SHA256
27f7850c5f26e68bdc1eedd5374285a723ba89ae5a4a510678b5a1503264947d

SHA512
915b15e4d303369b0a93dc799139337db1405cd99771108456a1d2dfd6d4bf8f7c873cd877c901d91d233c68119c2172197d98c8f4fca4d45da1e6ca9d377e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\njqq61f\imagestore.dat

Filesize
5KB

MD5
f38bf57a514b27fb15fdfaf9004a61f9

SHA1
eebd3b80550728cac006b1441080482a3731653d

SHA256
917c06e73b99d62a490ee9e09b1f300bea279977ad9a5fa9e891f4aaef3af2a0

SHA512
f9a611fc422f2bdd04d26d43f61fcce10b2022e9c096064f57415630c220c7fc8ddfa99b02af91257a4cc11156cbc7948bc4b5fa576f7c4db84ccbc3a4984e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\NewErrorPageTemplate[1]

Filesize
1KB

MD5
cdf81e591d9cbfb47a7f97a2bcdb70b9

SHA1
8f12010dfaacdecad77b70a3e781c707cf328496

SHA256
204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd

SHA512
977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\logo_48[1].png

Filesize
2KB

MD5
ef9941290c50cd3866e2ba6b793f010d

SHA1
4736508c795667dcea21f8d864233031223b7832

SHA256
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

SHA512
a0c69c70117c5713caf8b12f3b6e8bbb9cdaf72768e5db9db5831a3c37541b87613c6b020dd2f9b8760064a8c7337f175e7234bfe776eee5e3588dc5662419d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\recaptcha__en[1].js

Filesize
537KB

MD5
c7be68088b0a823f1a4c1f77c702d1b4

SHA1
05d42d754afd21681c0e815799b88fbe1fbabf4e

SHA256
4943e91f7f53318d481ca07297395abbc52541c2be55d7276ecda152cd7ad9c3

SHA512
cb76505845e7fc0988ade0598e6ea80636713e20209e1260ee4413423b45235f57cb0a33fca7baf223e829835cb76a52244c3197e4c0c166dad9b946b9285222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\httpErrorPagesScripts[2]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\webworker[1].js

Filesize
102B

MD5
ad5e6a567d064cba36f2a56caab2d866

SHA1
a3b46ea0ca5df5a6b6ab6bb228cf805065523cd1

SHA256
e70942d2b905910af2538c685c2223c25e5068bfbccb9742cfa5ffa48150d291

SHA512
ba45b3d74c0d2e0ac22bc97bacb6df549d7a4eae8d64050af41167376926f4379ccb6be84a666ba615caa7c5ee6838f98020c530f5c2ce51f71dad369d130681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf

Filesize
34KB

MD5
4d88404f733741eaacfda2e318840a98

SHA1
49e0f3d32666ac36205f84ac7457030ca0a9d95f

SHA256
b464107219af95400af44c949574d9617de760e100712d4dec8f51a76c50dda1

SHA512
2e5d3280d5f7e70ca3ea29e7c01f47feb57fe93fc55fd0ea63641e99e5d699bb4b1f1f686da25c91ba4f64833f9946070f7546558cbd68249b0d853949ff85c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf

Filesize
34KB

MD5
4d99b85fa964307056c1410f78f51439

SHA1
f8e30a1a61011f1ee42435d7e18ba7e21d4ee894

SHA256
01027695832f4a3850663c9e798eb03eadfd1462d0b76e7c5ac6465d2d77dbd0

SHA512
13d93544b16453fe9ac9fc025c3d4320c1c83a2eca4cd01132ce5c68b12e150bc7d96341f10cbaa2777526cf72b2ca0cd64458b3df1875a184bbb907c5e3d731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\KFOmCnqEu92Fr1Mu4mxP[1].ttf

Filesize
34KB

MD5
372d0cc3288fe8e97df49742baefce90

SHA1
754d9eaa4a009c42e8d6d40c632a1dad6d44ec21

SHA256
466989fd178ca6ed13641893b7003e5d6ec36e42c2a816dee71f87b775ea097f

SHA512
8447bc59795b16877974cd77c52729f6ff08a1e741f68ff445c087ecc09c8c4822b83e8907d156a00be81cb2c0259081926e758c12b3aea023ac574e4a6c9885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\styles__ltr[1].css

Filesize
55KB

MD5
4adccf70587477c74e2fcd636e4ec895

SHA1
af63034901c98e2d93faa7737f9c8f52e302d88b

SHA256
0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

SHA512
d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\-HiUwdQxDKLzt71CPYD-hKnPnujfGhcYgWkgX6BRpVU[1].js

Filesize
24KB

MD5
242324a437f1e8dfa268b1be80e57fdc

SHA1
2198c8b982542d263d2df13efc9e476563b5874f

SHA256
f87894c1d4310ca2f3b7bd423d80fe84a9cf9ee8df1a17188169205fa051a555

SHA512
74d8caa815fbae1b8510c883da00cec7f43fed56890c50eb24e44d281e31d9579b592553be87d2ce8ccb04cb2e3f78eaa8889068762fa36b1143b85cb21f3410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\api[1].js

Filesize
870B

MD5
db3f5a748364d84b2b5f75e3d4e851d0

SHA1
17b34ff20d429abee726b4b74530e5af2819f7bc

SHA256
343ed5ecd144d781de67aa8638b1ca4fce5772faedbb72720daacb250884f4e1

SHA512
3ee552fff8e93097120367c7f5f6aed88145150d706349542e8800e65722f4e6507bc0802e41a305cda56aaf4bcd40c036ad7a4d2aabea9dc70f908bf400dd90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\dnserror[1]

Filesize
1KB

MD5
73c70b34b5f8f158d38a94b9d7766515

SHA1
e9eaa065bd6585a1b176e13615fd7e6ef96230a9

SHA256
3ebd34328a4386b4eba1f3d5f1252e7bd13744a6918720735020b4689c13fcf4

SHA512
927dcd4a8cfdeb0f970cb4ee3f059168b37e1e4e04733ed3356f77ca0448d2145e1abdd4f7ce1c6ca23c1e3676056894625b17987cc56c84c78e73f60e08fc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab50A1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEEEEE~1\MALWAR~1\MALWAR~1\MEMZ3~1.0(1\MEMZ3~1.0\z.zip

Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar50A4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\x

Filesize
10KB

MD5
fc59b7d2eb1edbb9c8cb9eb08115a98e

SHA1
90a6479ce14f8548df54c434c0a524e25efd9d17

SHA256
a05b9be9dd87492f265094146e18d628744c6b09c0e7efaabf228a9f1091a279

SHA512
3392cfc0dbddb37932e76da5a49f4e010a49aaa863c882b85cccab676cd458cfc8f880d8a0e0dc7581175f447e6b0a002da1591ecd14756650bb74996eacd2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\x

Filesize
4KB

MD5
3f7105990762acdeab73dad5893a0968

SHA1
3bba599c9db8686561ca67f32c5b95fd79bd3339

SHA256
97330e7450ed724e86fa930489e40d7eb8ef7f2eb8440f900b17c2b3e6ca8144

SHA512
771f79408eaecea7b26662b5e4cf116cad56369700d99bf6b8b7b1ed5c3ac85900bfe3c6f3fd8c6b8e38c6ae1a3c98bbc3236ff5fd8aafef3de588828ab0641e

Download Submit
C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\MEMZ 3.0 (1)\MEMZ 3.0\x.js

Filesize
448B

MD5
8eec8704d2a7bc80b95b7460c06f4854

SHA1
1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

SHA256
aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

SHA512
e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA751031951C5317C.TMP

Filesize
16KB

MD5
bdd9803d5ed64de9f02e2072a95e5026

SHA1
ec74b54457e12bfd849283f6d692e9fe8a537334

SHA256
6785a86738850e47a302aec0059542216c7d30920ecee2d90b8cc10effade603

SHA512
a3c03f096ad84854a98291445a6d84319149d25572471be2ac49703158712a7ec0f5c7b6124e0610ec76af4b5dd684fabb7e9c1066190f15bb98a7b49d11f08a

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe

Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PXFBNP6J.txt

Filesize
405B

MD5
d9e2bb29482a27c13fc572760a68427e

SHA1
bc82db8fd6d2a6c1cc53e45a5df24a3c4773d919

SHA256
1f55b58601420e51e87a9ca340fbde426d9a328dbbc0e4735b516e5f4183bf73

SHA512
d9b5e0ca996c8f70cff1ed53290258da2beabcdd58960a1242e6f0d35c7682a5db1e83df500e003283ec5aa3a8bfed5cb3f1f6b0ab50a07dc75b50ae976f3944

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/532-150-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2804-2096-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/2804-1949-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/2804-1493-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/2804-1609-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/2804-1415-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/2804-1314-0x000007FEF5BD0000-0x000007FEF5C0A000-memory.dmp

Filesize
232KB

Download
memory/2804-1527-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/2804-1937-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/2804-1876-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/2804-1534-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/2804-1808-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/2804-1732-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/2804-1695-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/2804-1606-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/2804-1688-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/2804-1673-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/2804-1616-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/2804-1268-0x000007FEF5BD0000-0x000007FEF5C0A000-memory.dmp

Filesize
232KB

Download
memory/3648-1611-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/3648-1693-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1936-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1617-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1875-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1526-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1813-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/3648-1535-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1675-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/3648-1769-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1744-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/3648-1416-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/3648-2094-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1497-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/3648-1686-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/3648-1605-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1948-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3648-1737-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/3680-1953-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1687-0x000007FEF5720000-0x000007FEF575A000-memory.dmp

Filesize
232KB

Download
memory/3680-1879-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1537-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1940-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1621-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1810-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1610-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1674-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1734-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1768-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1692-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/3680-1745-0x000007FEF5720000-0x000007FEF575A000-memory.dmp

Filesize
232KB

Download
memory/4400-1747-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/4400-1669-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4400-1607-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4400-1689-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/4400-1536-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/4400-1608-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4400-1620-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/4400-1528-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4400-1942-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4400-1736-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4400-1696-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4400-1812-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4856-1752-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4856-1960-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/4856-1809-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4856-1690-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4856-1733-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/4856-2099-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/4856-1941-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/4856-1694-0x000007FEF5680000-0x000007FEF56BA000-memory.dmp

Filesize
232KB

Download
memory/5252-1811-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/5252-1950-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/5252-1612-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/5252-1677-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/5252-1685-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/5252-1877-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/5252-1735-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/5252-1743-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/6816-1880-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/6816-1817-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/6816-1955-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/6816-1739-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/7000-1816-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/7000-1938-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/7000-1786-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/7000-1738-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/7000-1951-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/7000-1878-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/7000-1697-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/7000-2097-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/8084-1943-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/8084-1881-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/8084-1963-0x000007FEF7B60000-0x000007FEF7B9A000-memory.dmp

Filesize
232KB

Download
memory/8084-2100-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/9196-2098-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download
memory/9196-1939-0x000007FEF5760000-0x000007FEF579A000-memory.dmp

Filesize
232KB

Download