cobaltstrike | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe(4).exe
Size 10KB
Sample241028-xprjfasrax
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike koiloader metasploit phorphiex xmrig backdoor discovery evasion execution loader miner persistence trojan upx worm

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.1.13:5555

Extracted

Family

koiloader

http://79.124.78.148/inure.php

Attributes

payload_url
https://amatriciamo.it/wp-content/uploads/2018/03

Extracted

Family

cobaltstrike

http://89.197.154.115:7700/mdS9

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
KoiLoader
KoiLoader is a malware loader written in C++.
loader koiloader
Koiloader family
koiloader
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysarddrvs.exe

Phorphiex family
phorphiex

Phorphiex payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023ac6-22.dat	family_phorphiex
behavioral2/files/0x0009000000023d3d-479.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects KoiLoader payload 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4840-84-0x0000000000C80000-0x0000000000C8D000-memory.dmp	family_koi_loader

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral2/memory/2604-163-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-164-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-167-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-166-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-169-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-168-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-170-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-171-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-172-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
120	3788	powershell.exe
122	3788	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2604	powershell.exe
3044	powershell.exe
2164	powershell.exe
3788	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	NewApp.exe
File created	C:\Windows\system32\drivers\etc\hosts	Updater.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe(4).exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sysarddrvs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SmartPlayer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	a13.exe

Executes dropped EXE 20 IoCs

pid	Process
3672	backd00rhome.exe
4828	11.exe
3388	sysarddrvs.exe
4840	clitoritissR.exe
5052	NewApp.exe
2372	Updater.exe
3724	SmartPlayer.exe
4084	ZinTask.exe
4840	Session.exe
3736	SmartPlayer.exe
2420	a14.exe
3228	tt.exe
1924	evetbeta.exe
1512	sysmablsvr.exe
1176	a13.exe
2616	A3.exe
3184	A3.exe
1172	A3.exe
1768	a3.exe
3196	icsys.icn.exe

Loads dropped DLL 7 IoCs

pid	Process
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	tt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
63	bitbucket.org
105	raw.githubusercontent.com
120	bitbucket.org
10	raw.githubusercontent.com
61	bitbucket.org
88	pastebin.com
89	pastebin.com
106	raw.githubusercontent.com
119	bitbucket.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4052	powercfg.exe
1844	powercfg.exe
2904	powercfg.exe
1516	powercfg.exe
3872	powercfg.exe
4204	powercfg.exe
4252	powercfg.exe
1960	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	NewApp.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 3288	2372	Updater.exe	183
PID 2372 set thread context of 2604	2372	Updater.exe	187
PID 2616 set thread context of 1172	2616	A3.exe	215

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2604-160-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-159-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-162-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-163-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-164-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-167-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-158-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-166-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-169-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-168-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-161-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-170-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-171-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-172-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\sysmablsvr.exe	tt.exe
File opened for modification	C:\Windows\sysmablsvr.exe	tt.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	A3.exe
File created	C:\Windows\sysarddrvs.exe	11.exe
File opened for modification	C:\Windows\sysarddrvs.exe	11.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4424	sc.exe
5044	sc.exe
1996	sc.exe
2552	sc.exe
3184	sc.exe
1088	sc.exe
5028	sc.exe
5068	sc.exe
1680	sc.exe
2140	sc.exe
1908	sc.exe
4168	sc.exe
1172	sc.exe
4628	sc.exe
2348	sc.exe
3536	sc.exe
2748	sc.exe
3616	sc.exe
2332	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	4084	WerFault.exe	193

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe(4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backd00rhome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clitoritissR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SmartPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evetbeta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZinTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SmartPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\DefaultIcon	SmartPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\SPTemp\\SmartPlayer.exe,0"	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dav	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open\command	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open	SmartPlayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\.mp4\ = "SmartPlayer.Files"	SmartPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dav\ = "SmartPlayer.Files"	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files	SmartPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SPTemp\\SmartPlayer.exe\" \"%1\""	SmartPlayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\.mp4	SmartPlayer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2164	powershell.exe
2164	powershell.exe
5052	NewApp.exe
2604	powershell.exe
2604	powershell.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
2372	Updater.exe
3044	powershell.exe
3044	powershell.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1512	sysmablsvr.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	4363463463464363463463463.exe(4).exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	1844	powercfg.exe
Token: SeCreatePagefilePrivilege	1844	powercfg.exe
Token: SeShutdownPrivilege	2904	powercfg.exe
Token: SeCreatePagefilePrivilege	2904	powercfg.exe
Token: SeShutdownPrivilege	1516	powercfg.exe
Token: SeCreatePagefilePrivilege	1516	powercfg.exe
Token: SeShutdownPrivilege	4052	powercfg.exe
Token: SeCreatePagefilePrivilege	4052	powercfg.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeShutdownPrivilege	4252	powercfg.exe
Token: SeCreatePagefilePrivilege	4252	powercfg.exe
Token: SeShutdownPrivilege	1960	powercfg.exe
Token: SeCreatePagefilePrivilege	1960	powercfg.exe
Token: SeShutdownPrivilege	4204	powercfg.exe
Token: SeCreatePagefilePrivilege	4204	powercfg.exe
Token: SeShutdownPrivilege	3872	powercfg.exe
Token: SeCreatePagefilePrivilege	3872	powercfg.exe
Token: SeLockMemoryPrivilege	2604	explorer.exe
Token: SeDebugPrivilege	3788	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1924	evetbeta.exe
1768	a3.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1924	evetbeta.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3672	3200	4363463463464363463463463.exe(4).exe	88
PID 3200 wrote to memory of 3672	3200	4363463463464363463463463.exe(4).exe	88
PID 3200 wrote to memory of 3672	3200	4363463463464363463463463.exe(4).exe	88
PID 3200 wrote to memory of 4828	3200	4363463463464363463463463.exe(4).exe	106
PID 3200 wrote to memory of 4828	3200	4363463463464363463463463.exe(4).exe	106
PID 3200 wrote to memory of 4828	3200	4363463463464363463463463.exe(4).exe	106
PID 4828 wrote to memory of 3388	4828	11.exe	107
PID 4828 wrote to memory of 3388	4828	11.exe	107
PID 4828 wrote to memory of 3388	4828	11.exe	107
PID 3388 wrote to memory of 1968	3388	sysarddrvs.exe	108
PID 3388 wrote to memory of 1968	3388	sysarddrvs.exe	108
PID 3388 wrote to memory of 1968	3388	sysarddrvs.exe	108
PID 3388 wrote to memory of 3492	3388	sysarddrvs.exe	110
PID 3388 wrote to memory of 3492	3388	sysarddrvs.exe	110
PID 3388 wrote to memory of 3492	3388	sysarddrvs.exe	110
PID 1968 wrote to memory of 2164	1968	cmd.exe	112
PID 1968 wrote to memory of 2164	1968	cmd.exe	112
PID 1968 wrote to memory of 2164	1968	cmd.exe	112
PID 3492 wrote to memory of 4424	3492	cmd.exe	113
PID 3492 wrote to memory of 4424	3492	cmd.exe	113
PID 3492 wrote to memory of 4424	3492	cmd.exe	113
PID 3492 wrote to memory of 1088	3492	cmd.exe	114
PID 3492 wrote to memory of 1088	3492	cmd.exe	114
PID 3492 wrote to memory of 1088	3492	cmd.exe	114
PID 3492 wrote to memory of 5044	3492	cmd.exe	115
PID 3492 wrote to memory of 5044	3492	cmd.exe	115
PID 3492 wrote to memory of 5044	3492	cmd.exe	115
PID 3492 wrote to memory of 5028	3492	cmd.exe	116
PID 3492 wrote to memory of 5028	3492	cmd.exe	116
PID 3492 wrote to memory of 5028	3492	cmd.exe	116
PID 3492 wrote to memory of 2140	3492	cmd.exe	117
PID 3492 wrote to memory of 2140	3492	cmd.exe	117
PID 3492 wrote to memory of 2140	3492	cmd.exe	117
PID 3200 wrote to memory of 4840	3200	4363463463464363463463463.exe(4).exe	122
PID 3200 wrote to memory of 4840	3200	4363463463464363463463463.exe(4).exe	122
PID 3200 wrote to memory of 4840	3200	4363463463464363463463463.exe(4).exe	122
PID 3200 wrote to memory of 5052	3200	4363463463464363463463463.exe(4).exe	123
PID 3200 wrote to memory of 5052	3200	4363463463464363463463463.exe(4).exe	123
PID 2196 wrote to memory of 3800	2196	cmd.exe	137
PID 2196 wrote to memory of 3800	2196	cmd.exe	137
PID 3788 wrote to memory of 3936	3788	cmd.exe	169
PID 3788 wrote to memory of 3936	3788	cmd.exe	169
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 3200 wrote to memory of 3724	3200	4363463463464363463463463.exe(4).exe	192
PID 3200 wrote to memory of 3724	3200	4363463463464363463463463.exe(4).exe	192
PID 3200 wrote to memory of 3724	3200	4363463463464363463463463.exe(4).exe	192
PID 3200 wrote to memory of 4084	3200	4363463463464363463463463.exe(4).exe	193
PID 3200 wrote to memory of 4084	3200	4363463463464363463463463.exe(4).exe	193
PID 3200 wrote to memory of 4084	3200	4363463463464363463463463.exe(4).exe	193
PID 3724 wrote to memory of 3736	3724	SmartPlayer.exe	194
PID 3724 wrote to memory of 3736	3724	SmartPlayer.exe	194

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(4).exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(4).exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\Files\backd00rhome.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\backd00rhome.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3672
- C:\Users\Admin\AppData\Local\Temp\Files\11.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\sysarddrvs.exe
    C:\Windows\sysarddrvs.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4424
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1088
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5044
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5028
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2140
- C:\Users\Admin\AppData\Local\Temp\Files\clitoritissR.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\clitoritissR.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\Files\NewApp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\NewApp.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3800
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2748
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1996
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4168
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1908
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
    3⤵
    - Launches sc.exe
    PID:2552
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5068
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3536
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
    3⤵
    - Launches sc.exe
    PID:2348
- C:\Users\Admin\AppData\Local\Temp\Files\SmartPlayer.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\SmartPlayer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe
    "C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe" C:\Users\Admin\AppData\Local\Temp\Files
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3736
- C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 232
    3⤵
    - Program crash
    PID:2080
- C:\Users\Admin\AppData\Local\Temp\Files\Session.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Session.exe"
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\Files\a14.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\a14.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" –NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\815B.tmp\815C.tmp\815D.ps1
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\a13.exe
      "C:\Users\Admin\AppData\Local\Temp\a13.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\A3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\A3.exe
        
        C:\Users\Admin\AppData\Local\Temp\A3.exe
        6⤵
        Executes dropped EXE
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\A3.exe
        
        C:\Users\Admin\AppData\Local\Temp\A3.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1172
        
        \??\c:\users\admin\appdata\local\temp\a3.exe
        
        c:\users\admin\appdata\local\temp\a3.exe
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:1768
        
        C:\Windows\Resources\Themes\icsys.icn.exe
        
        C:\Windows\Resources\Themes\icsys.icn.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3196
- C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3228
- - C:\Windows\sysmablsvr.exe
    C:\Windows\sysmablsvr.exe
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:1512
- C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1924

C:\ProgramData\GoogleUP\Chrome\Updater.exe
C:\ProgramData\GoogleUP\Chrome\Updater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3936
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2332
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4628
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1172
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3184
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3616
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3288
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4084 -ip 4084
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c26a6d7d885bb2a355809c6684937ad05498c8717b76b981a43329f814a609df
MD5 a5f6c631d31c3b6a46b12d428ccb600c
SHA1 1a11d7123193871704bc2cf26e96911639bcf447
SHA512 5e7c3ac2f0bb6ca7141834e2fe93605b65044e84dc4e3d796b73adc6901f74dfa7caa6f187da16866d9d2c338c52074530ff44123ea4e62c1adbda38cf5baadf
SSDEEP 384:rsf+BV9i+f+JkoBiz4gPo9oDcTpK6seYM607eKk3SoEAsfYn2Oz/8pQ0gDN+PKhj:wfIMLoDgoDcTpNkkISXQFz/8Iwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

311054877.exe

Path C:\Users\Admin\AppData\Local\Temp\311054877.exe
Size 108KB
SHA256 84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02
MD5 1fcb78fb6cf9720e9d9494c42142d885
SHA1 fef9c2e728ab9d56ce9ed28934b3182b6f1d5379
SHA512 cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3
SSDEEP 3072:LFQC4AbS79Bo0bTtS3v4P09loyBE7QXNn8IJrF:LFQC4A+7jfiw8HoyYQXdXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

A3.exe

Path C:\Users\Admin\AppData\Local\Temp\A3.exe
Size 5.8MB
SHA256 14af32f4c3f443d9203726cfca49e18bba8f248561863410fefffad41b47a32b
MD5 1392bfc8f059d959b5b251d3d651dedb
SHA1 1bb03d893222f35dd2f816eb65b2481a677d11d8
SHA512 30398215e0805222f9ec895cda09f8625e8a881ce334348f4d85ca9f0d4f4cef4c9b05c50f88d594c7b96a11200d8fa5018ed7342a3e0e3a54db14625ae673ef
SSDEEP 98304:XNrgD7BjT4/HFI6q4PKT6oileRmZvgo6V2NOpgFAzBsnuYlAUzeB2LIG/9yUBsPd:9M3B3U+6NK8leAIBnN0uYlg20y9aPVQo
MD5 SHA1 SHA512 SSDEEP

Submit Download

11.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\11.exe
Size 79KB
SHA256 d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3
MD5 e2e3268f813a0c5128ff8347cbaa58c8
SHA1 4952cbfbdec300c048808d79ee431972b8a7ba84
SHA512 cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc
SSDEEP 1536:W9mw4/inFmav82TmKtj+5qUPsY3BCHYJhcWPA4G9kj3K1:CmwohOBiPsWMH4ogj3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

NewApp.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\NewApp.exe
Size 5.8MB
SHA256 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7
MD5 190e68a764f232fa236a23317f80892b
SHA1 a37b9e226334bc69abaacb539fb7ba9722831a76
SHA512 34c5d7d35a639a2c6ea183ad808a10bc0adaebf806975f6949da119c1d90c50f065b3d238a0bd6b7159394fe39a0322590fe229cae73f7c9cc393e721449c0a2
SSDEEP 98304:ICAKtK2disEKWIAN9rDUQ60m+E+3syUSIkJEhxfAF8p4ucmEyVHNJdNOD5A:I7ObErIYeQ3nEIsyU2Y48CeHxNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Session.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Session.exe
Size 19KB
SHA256 722359ebd46ace2d25802959791ae3f6af433451d81b915cdb72890cbba357ef
MD5 370dcc1d0729d93d08255de011febaa4
SHA1 12462b20ff78fa8bc714c02fe6b4427d7b82842d
SHA512 3e43839663825a4c4ee1ca8f81beda5b142539dc559e89df41bc24cedeaa9e58d85d326b47e24bf0a3cf08f9f64683c527e7867901ae979ef81efc9112df133c
SSDEEP 192:yV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/28pZkEtNx/WF8qa1Dojjgi:8qaCF31cix+Dc4zjPwFFF46gi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartPlayer.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\SmartPlayer.exe
Size 2.2MB
SHA256 1c03b7adaaf5c03a970ab75ba103feb8231920ddef9736950d390bf0c6fcbc20
MD5 23472f2189b3dde069ffb527a84e3668
SHA1 51ce355914ebeb90892437832862140a0c991f1f
SHA512 a88c136c6914b082f03becb71c842b91201c78e8c92afd8e06e2f782a869b1bfa3951c0c4db89c73b5f706c1e06495bdc10f2a7c5300a0e29ad64a20656aafaa
SSDEEP 49152:E+MLUlD9LaZqOkqB85Bn6iOPHLRSwHuXlD9bh6Lad4O:E9e0qBrjOPHlP66+d4O
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZinTask.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe
Size 2.5MB
SHA256 3d0a544073fc4c02d5634bd33f76f9dae07d9a325340ed747bcfde51ea52e23f
MD5 dba7abdb1d2ada8cb51d1c258b1b3531
SHA1 fa18a0affb277c99e71253bca5834e6fe6cd7135
SHA512 0491865151140a5252a87a771f6552fd527fae3dec3c43ca0b806702e7ad4953b7d16bd1d8f275828f8b094bc337f79ed5c298beed4ec99186e4f4c3bd3cdf2a
SSDEEP 49152:CXN0e412pgwvidaFEILTDRFlseh5rcBTxSTtwvi:CXCe4QjMaWI/DRF9xcBTxST2v
MD5 SHA1 SHA512 SSDEEP

Submit Download

a14.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\a14.exe
Size 85KB
SHA256 9fa501e984cc0d7c2c178af9e7c8a3c93f0bfc7ba6075c93f216249ee327e2ed
MD5 6917037b3307cd41e28175a327299d4d
SHA1 fa814d1d43b2031ba7b2464de255a5837692fd0c
SHA512 bd5fdefacbbdd46f780ec5fefbb129c2a5ee376dca00a57dea5c18781ae519e63c9adb957ee066842d416f7f467ff32e91267e99456acc3e76e710b58f722cd4
SSDEEP 1536:67f++rgYVjYpunEipICdMkFhzxL+5/Q9wFkXomIOlnToIfhXOx:4Jg0eSGCikEGfXoENTBfhS
MD5 SHA1 SHA512 SSDEEP

Submit Download

backd00rhome.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\backd00rhome.exe
Size 72KB
SHA256 ec34977344bded135083b97756df058d33565bb80a1ab48cccb82999a6b340cf
MD5 ef397426691bc35566bc401598e10d60
SHA1 40ac43354d2ea80706dae6a60ce5cb668ba35514
SHA512 023009d6a0b923d582a84a6db93b4b4a5c8017ef2217937490e83df801c56b12a962ba88ec4f28bb1fc2aee7ad393d8c93bd097e27b969f061876ac85339e746
SSDEEP 1536:IHzUocxDi3rjpHjuNwsnW//qJsUuRhbNZkegkMb+KR0Nc8QsJq39:CzUocpqrjpD/Uu/q1u/b3kede0Nc8Qss
MD5 SHA1 SHA512 SSDEEP

Submit Download

clitoritissR.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\clitoritissR.exe
Size 189KB
SHA256 e66fe85a6a0b7c2dd85c4e8d884832f5b358de27f77b64ee6673ed1b7acd1d96
MD5 03b6be8fed80988489e171c7092d9541
SHA1 acb6110dfcf13ad3b55d3017fd2ace13b55e4d11
SHA512 e8dcde11a8d68f16e76b4da2a3457a738bb204be51fd83aa947dc4eb082a957f127b1198ac6cdc8ec6d0c089266d687ac48e613a5c7b7f7b5bb614e442402552
SSDEEP 3072:gA+MPNsjU+g/Pu92PkWMW50y4jrv34ClUCezULLtfYJpjcvnopvLRlpr7IlC/T8f:HJPxktlKIwJpjcwhLRlF3jCv
MD5 SHA1 SHA512 SSDEEP

Submit Download

evetbeta.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe
Size 92KB
SHA256 a370eacabf4af9caa5502c39b40c95eda6be23666231e24da1b56277a222f3e9
MD5 6f6137e6f85dc8dac7ff87ca4c86af4c
SHA1 fc047ad39f8f2f57fa6049e1883ccab24bea8f82
SHA512 2a3d60bac0a40730b49d361d13000115539c448ef1ecbbffafa22ebe78fc9009db0846e84e7f3c3526d22d5531cedddae8fae7678f453e48876581824cd9dea4
SSDEEP 1536:ohhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP60rq:uhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tt.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
Size 88KB
SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
MD5 ababca6d12d96e8dd2f1d7114b406fae
SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_it4pcqnx.tiw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_it4pcqnx.tiw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

a13.exe

Path C:\Users\Admin\AppData\Local\Temp\a13.exe
Size 6.0MB
SHA256 89c52c25de71a058d6620ede4d86483696bf54d35574281ad74667470ea3d6f6
MD5 1259ce3bb6ed185c5d186baab1a42d13
SHA1 095bdfbd41048fc711f633d4f046a2e93f6b7c77
SHA512 f31386d92127e85c8c9d6b4d4824f5b650c25baa097eb7622177487740cba77eb9ea664b4732b33a6cfe077fc20cfde84c217b13d5da66a4a75cc0d03f797e69
SSDEEP 196608:VfvGcXNBXL6mHdOU0IHFitVcV1gqeopp:hJXNBXugsUecVybKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.xml

Path C:\Users\Admin\AppData\Roaming\SPTemp\Config\config.xml
Size 195B
SHA256 b19c4020255de091a2cdf594b82d36e4de9c1a8d297ba099a7056b526e9b896b
MD5 c0e6efae18bb3c023b0c8ee5ed8db368
SHA1 b58f07cc134b41db881ba8ab58545db42b2aef73
SHA512 91896b798064c34d818d8dfcdf2536ab8b99978e144f7c586bac3c7592048a5bc8b11d8b56f24c0629cc9a54fdf1173c257da36147b513938660f717a504d8aa
MD5 SHA1 SHA512

Submit Download

IvsDrawer.dll

Path C:\Users\Admin\AppData\Roaming\SPTemp\IvsDrawer.dll
Size 428KB
SHA256 014ab931cf4a97aae30c6843e690ecbb632c2aef67824dc2c46473591823debc
MD5 493617737d5587574933f3c9d8aefba2
SHA1 a56e6f8c7a72ffdee4dc5e1669ff0841bf85a5bd
SHA512 f205f27247685725c807c1f779285efa367363c75d272ab2e61383db8f2f248715f3dd58129be3dbd82035e70de5c99901725e06485982f09ab0cd760288f914
SSDEEP 6144:64xooqv/MadWhSJCLqMZFk55icZr3+VJ8GmpzEoZcmapT:l1PaWICLpFk/ZGaGdT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_0.xml

Path C:\Users\Admin\AppData\Roaming\SPTemp\Lang_0.xml
Size 1KB
SHA256 e97d6f5c7535d2e1065c0b6fdf2655a619bd4b65afa41d5d39885b0e654ce0b2
MD5 4cd37c04dd00781343e50be238837b9b
SHA1 788f433028157c4573f4706d3165522dfe6e8985
SHA512 360721b305f4860bd20dbae1f72b650255724c11fe3069aff7cd93dee41c9f6c12ab313da3ca73d7910d86369b7aba689ff64cf141f910a99e4bf8711b353570
MD5 SHA1 SHA512

Submit Download

PlayModule.dll

Path C:\Users\Admin\AppData\Roaming\SPTemp\PlayModule.dll
Size 120KB
SHA256 74de688b5cc7f9f44b2ee33061902384aeee0a9a1f7deaa673c566f1bb2e3334
MD5 ddb53748213a4552dbeadb0d7823f0a5
SHA1 97ca5912406ffc371d8e41b27151982dea68668a
SHA512 4509fe1e586ab0c38c257e05bc7482f88d67d4fc736311d43b83e57f66e22a8eab4f1daf2d7294d18ad13fa97ca304b1eae4450ef4bf6707787f8c971462c28a
SSDEEP 1536:lPkrw8Qc/uPC6xYQbQthSs8HIkodnGtWSczn9w++te6soP6y:lPkrwy/uPCx4QIXW9yte9E6y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SF_UIBase_R.dll

Path C:\Users\Admin\AppData\Roaming\SPTemp\SF_UIBase_R.dll
Size 724KB
SHA256 fe65b2d4099a80eb614f9e6628d4ad5934055073d32e4abf85863f5f48509f57
MD5 44526398fb6d0a2011e450dc289c6cc3
SHA1 3b320ee9bc793bb1a4347f5ff1be75bf9c9f62c1
SHA512 67150170102f74dfe14b60443d1dc7b3e1b294ae3893aa962b16ac8322c2c7f2239afa8e243a12e47e327d4def463cc972228a40b00fe8cc32440e4f6e08b983
SSDEEP 12288:D4Dpp5DRTk3frRY3ONUy33PXFWRb6+Ukmg14NASM:op3DorPNUy33PUAk34OSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

FrameMain.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\FrameMain.png
Size 547B
SHA256 ebbc50a53552a1db6319bd08c55e5f271a412269bebdf1c53b399a832c54e199
MD5 7a23fd2600c0842417c4930160fc49dc
SHA1 a5e89dbf267e61f86af0e184f9550681abd8b246
SHA512 fcf222bfe0d3624119d7e545863775a7ec3c61969fae065f7dbd0d328ff08ace5be7e61cb3097b4eb40f6b224f4b1c0ce9657d8e7c32b1cab1d343f47b295664
MD5 SHA1 SHA512

Submit Download

bg_filelisttitle.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_filelisttitle.png
Size 389B
SHA256 024d759d6adc6be3467747f56d68dae765c5e8bccb96319cae5ee85406354fde
MD5 9a742979b291fc7e4beab9319b5c1462
SHA1 619f2c6138a934115be7f517575c2f300e529260
SHA512 b59ef0e475767d82a7329748633ddfe07ced98b656c1e9e6916d9d8996b9f9326a09d22740f0e6057efb1d1d33eb1c5939f96244cd02aeaf011cb720db48d8fa
MD5 SHA1 SHA512

Submit Download

bg_monitor.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_monitor.png
Size 77B
SHA256 8b85e5c405b63d5d9dad299dc1ddbaef7226114c964233d17765cb32efb4d23c
MD5 10fc711d6064cc815b8fd8d4f798a015
SHA1 f06d826040d7b1f0ebd0bd6d54b97e651cfe4641
SHA512 fcce89c13cacc76d8ef2e522a8afb72ff3afdf9eb6b36084b04c6bf35741052742f254c3c89314276fae94483eaaeaf580931b2a1b30bd83668391c9d7f24e0c
MD5 SHA1 SHA512

Submit Download

bg_tabbar.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_tabbar.png
Size 77B
SHA256 66756117995117e29abfffac6e3704eaa25408f3413d663186546022c468f33e
MD5 2b9c8c7df76186d5cae41c6f739ad9bf
SHA1 0b07959ae4b221d570acaaeaf7a86eb154167964
SHA512 9bf2f75dd459e14e9d5eadee3a9d5155fac96d93eae5176f470e24da51ca01e2143316384d2edd2c7febd4ae5f176fc4f0a8647b974270fb945a2b135ba96fbd
MD5 SHA1 SHA512

Submit Download

bg_toolbar.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_toolbar.png
Size 122B
SHA256 75cda4d81e888033d08a32ba989d6725a4e8a113ac11801f166143fd5b07c4c8
MD5 c29fe7bfdea70172872b7b44db7bfa0b
SHA1 41bd4d81ab5ef87f193dfdbfc298a9d43be3b0df
SHA512 2a14b17e5bffa1478e56a4607393fa988bae5ce41bd98df08bce8e4a0fb0eb553f5f029b28cca6f5e90a6751955c42a299f90dca74c0e7500539c47011d81881
MD5 SHA1 SHA512

Submit Download

btn_addfiledown.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfiledown.png
Size 1KB
SHA256 b21f6662d5ed8c8f68939e9d8c9c477fcbb0500701e3ba6443edad5d04a610fa
MD5 4e3b00cb070d2e40967a89fe6c829bc9
SHA1 ad35cd40c93f94bd9761dbc83c9e5a57b068e6be
SHA512 51aab24b0455c123e43804aed514979fbccf71b68fed1acf3a993b7c31ca30e4226d97cc5031da57388d6b4ec37f52805c06db449775fff171186865ea76978f
MD5 SHA1 SHA512

Submit Download

btn_addfilenor.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfilenor.png
Size 744B
SHA256 adbf87a4bd9913e01463b29a05cb60897baa2e8c8bc4b8c14d3ad0771dc9a24e
MD5 94846e7e8a4d5ce3da43e9c6f3d9da17
SHA1 e24572d54a35f4903e8c5080e629429e347fc04a
SHA512 bd5640877723dd30965c5402fa34183d044d94e79fb02dcd4de734ca74855f7a9d552d4d355d35ef0768227d1fa270953739ebf24beb41e854eddf5dde03aeb6
MD5 SHA1 SHA512

Submit Download

btn_addfileover.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfileover.png
Size 988B
SHA256 ec60b901e6f4838cd3e0f23761c8be9a5dc2a67328d9e873d4b018cf0ba9e98e
MD5 098ffe4b357a8f9f9c7fac758141e16a
SHA1 bfe9e4de38bbae644d3e166daa664d713460cf20
SHA512 c6f8a43791a0bca0340e0e1439f176359239580d0a81f947767e0fc8e478620ba7b2edbbea57a9716623fddee054b98a584aeeebc157d10bc38318ff25caed0d
MD5 SHA1 SHA512

Submit Download

btn_close.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_close.png
Size 136B
SHA256 fb9db7364ca43411ea444c09894d7d178b9f803d0020731ca58a739edb2d9999
MD5 f36adcdf529ae67e51f4c365dd57ffa6
SHA1 acb0190c014ecba805843f0c0f1630db97c760eb
SHA512 201dfec402070a9548e6b234ba0e33e5dcb90bb609745a84e6ecf52544927f15a724a8bc2100e842864404a895dcaaaad43457cd63a6ed962cbed7fe9159c7ce
MD5 SHA1 SHA512

Submit Download

btn_configdown.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_configdown.png
Size 2KB
SHA256 b09c7d28972ed79c7c475fe1589387f56b87db05606cb26579e710516368665c
MD5 5587839ba743967ff7f76931510b07d3
SHA1 6e653da59c2bae701ebf9fa84e7e38c8e1baa467
SHA512 b6cf6df2afed15027d8aea771d47f55a886f546d818c382eaa39d992b8438a405bb1771509048fba6edba0f66ce28c3ea781d664bfd259bc00cca10371220b01
MD5 SHA1 SHA512

Submit Download

btn_confignor.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_confignor.png
Size 1KB
SHA256 b58932afee4e2f335f64083364bd416fafd3094dceb6f3b6ab10c84c19f822bd
MD5 9f9981655e6d1115705d533a9ad70e4f
SHA1 d3efae54cc12f079e3638e108e2c12afc7c620b6
SHA512 75c1c845f2b350bcfb7e99b02d975c883f4c5aab20c16372cd8d693038f8617c29aa5632a1f5d5ae2dd0ae4a29a77b6f697c37a18d2dad794e01a1e74cbef065
MD5 SHA1 SHA512

Submit Download

btn_configover.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_configover.png
Size 2KB
SHA256 b6d8a23d293b81f1b05abb15e3d541f085c166b3b3c1211997b843b67c026101
MD5 01f4103cd31e715894d9af8b4aad03d0
SHA1 c5e32d02938a6c9c292a2a5b5a28a7edf72b7d74
SHA512 60eb8ce31483f9a799e9dec8fc320a97e43b81f1bbc1011d1cd0fadb204fb2f859895de160eadf6f44c73be9465b6b48ac284934d1560872bc48913eb62f14d4
MD5 SHA1 SHA512

Submit Download

btn_dragdown.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragdown.png
Size 1KB
SHA256 0e36a701f7634d9671d645da5c442aeed6917be2713c14f88df6b2dc58a69d55
MD5 f12358ba6c842a6af92e3e75afc525bb
SHA1 3c248c9c6adb5d88f3b0d5aa472dd52c7710907b
SHA512 cac5d6ba1d2d07d90e365336f3e37b3868b103598fc5b79c60bafff06e3b590cef1407ce67ee835007b721f3ec9672a80e58c9c6d3c7aa035eadea05fe900153
MD5 SHA1 SHA512

Submit Download

btn_dragnor.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragnor.png
Size 886B
SHA256 8714d5b08be85e69ee9c8fb600f1845e4086b03b749cb167e697c330913375e2
MD5 8d5f75afe049f5167f17f67dec83d789
SHA1 d058df8d45b290d281ede5f8ef10e9e229ae6e22
SHA512 5ceb3d755bbc17c3498c979ca7fd38f5480c7ca1b34d430b9d29ffe4747684e2cb78e4781a5e118cb0d3e2b57a8c4eb149fdec12b0409d38ac8e12e16cdc431b
MD5 SHA1 SHA512

Submit Download

btn_dragover.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragover.png
Size 1KB
SHA256 1e70b468ee758509bfa415e7028a67d34420284245b009fb3c08202d4372fd06
MD5 9b4b4a119010fb88a6eeab32bacf8fde
SHA1 2ae0e957da471292d03a9bafb56d4996be877f81
SHA512 e90a658860e2aecc8b1e639417c68cc749349d28a29a9a5399c7fa74be21c61fe514b4b20944f22e56f4d861ea039340111b72b09abf39620e2e63139c1945b3
MD5 SHA1 SHA512

Submit Download

btn_frameselectdown.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectdown.png
Size 1KB
SHA256 4efe0a62a02e7d45e8ec66be642eb4fa2d89b1254ae176dc061b0c7f807a0348
MD5 ab0d96f0b87c908510a3708704de3a19
SHA1 9b2f2516a5d09721e70712da7b37616563d59fe9
SHA512 ea60dbceadd99316ccd295101fa82a3410e075edc8f9bc35364c6febe74ab40b19b89417122bff2fa81a1e1ffede93bd59f416a25a12164b5946954aae47c402
MD5 SHA1 SHA512

Submit Download

btn_frameselectnor.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectnor.png
Size 648B
SHA256 8deadabb0f536cd4573549db60541e9b1dae598cc198f69f3cd1a8e2b05838a3
MD5 5bb2b24eef14734c1e0ec6cc99101c8e
SHA1 052ae2655810ee4111721ef3f38b0bcf0152ef86
SHA512 9af48b3e5a58715945685b158ff30d097cdf4324291ddbf39c581c7e994100bb2a6a8be9046e24c0a56056a1e30df3a451e07e5d0e15b236db3cd022c7d104ad
MD5 SHA1 SHA512

Submit Download

btn_frameselectover.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectover.png
Size 919B
SHA256 7a0225509d5ce02480ebe5302600b01720aca54109c34a378351bb79a2db8893
MD5 6433810686ef08782885446a59989995
SHA1 f5a0dbcc3ee4c5b61bd5e04219e5a2e68cc9c11f
SHA512 ea75ae8fdefcdcfec8beec5c859432d50e68dafc312bbdebc39ee57c593fef2fc408961da909b5ef53c42ccde5653c9092f04ee33eacf487b3ec6d49b304b3a2
MD5 SHA1 SHA512

Submit Download

btn_fullscreendown.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreendown.png
Size 1KB
SHA256 b25d1b88dbaf21147eb1f09be0ed05a10873d41c33b31b56a307d4a54d6cb38e
MD5 5b9285018bd492361894ffa18d864539
SHA1 5f60922f094e5ac000a446fa9c1492cfb123fff9
SHA512 c7b05ffedff2e2a4925b561471d071b2fb45b0df716ef48ce392708a00aff38d81c019a18250f0981a3c0a57301b1d1dc7b3c9fd74e0a17ec6d733e1ad2cc98d
MD5 SHA1 SHA512

Submit Download

btn_fullscreennor.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreennor.png
Size 899B
SHA256 4a688c6def45cbbe46d7897434f4dc84f99b7abd6c015d2a22545b546912d1c3
MD5 7285052cbb0ff14ff9cd86431a63ae1b
SHA1 549c5f6a1bb9271ecbbd69f52326a9c0a3adb033
SHA512 a79d987dcdd2fcd26a856fa4bf270c5c966900b7f946e96a32aac83a9ab7c9e35cb26f7bc1a34c3d1369b05a8a47dbe7604b312e5da6021eae8a56cb728d1412
MD5 SHA1 SHA512

Submit Download

btn_fullscreenover.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreenover.png
Size 1KB
SHA256 697f724bb29bc65cc9d1dbde18f5d5815e26cb3286a2f3588442bcdd09d3d278
MD5 466663ff4161f277af7cd0d577532dfb
SHA1 0874ca70c4d1f88b2332d3f0fa18b2a88fbb48e8
SHA512 106bb579ca53f1e11dd2b996a30fc578b48306c72c3703b19c9fa05cdad982add8a42e3b28fb325d950cbe7d623034f7bd12787e4e30835599a95b5e6e907377
MD5 SHA1 SHA512

Submit Download

btn_lock.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_lock.png
Size 144B
SHA256 cd51d6520d600bc174c600a1e91c2b142f762ad306d93155390ac3af837ab173
MD5 a3039eedf5764c9057b0565b4db40b46
SHA1 58056d11cc5a2e82c6e27ab14da9f57a2cdc5732
SHA512 827a90eaa695a60993a01d3138e794bebbdbc96eb9a387b71a64ec838b09f79ec7c11daea09df9f52f8ed7bcea75e763f4dd1d04fbdd7e6c9323d267737e019c
MD5 SHA1 SHA512

Submit Download

btn_maximize.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_maximize.png
Size 111B
SHA256 8c3545e4342ee9967d07df77ec8ee146ac4a639c4abbdf50f3fa66efe40e770d
MD5 fd6ee378a7d1387fd243e9917c517b30
SHA1 b5ab64ebf5d9731ceb2baec21412f4d6ae8fe6fb
SHA512 db162aca73d93f519110d89ca0f14800b3ba04337fdb8c6a364ad84e9ce313f7f753d198c9ef13ba7f0e75cf99282438fc3e62177761e934dcec7669d15aeeae
MD5 SHA1 SHA512

Submit Download

btn_minimize.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_minimize.png
Size 96B
SHA256 8abae066bf6fb536aa1ee3b4c4fcf1c84a350a32ab47b8afde269de9617d9440
MD5 e5cc3d4ac9846c3a14c3d48e0e2ad311
SHA1 4e5662bd831f531baff84d54945a4ea16d6373ef
SHA512 c952748bb4baf693a6b1cead8c56481aae2214f07472aa8de466bdb6f4f74b1f55db5b056e0210daa3b4ace4755ac379616364d3a04483a18ec4c8fe87845858
MD5 SHA1 SHA512

Submit Download

btn_selectdown.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectdown.png
Size 1KB
SHA256 9d243e2448ff419348ae35eb97ea597a5bee581bae99ec437ad4f6762cf445ba
MD5 8462df8225f820bb91489f5c10ad735d
SHA1 b294a4f25152ca2bfc75ffa6683e10cc6615d4ae
SHA512 f73c483a2cf5dc653e424652a3e25cb5bdb19a9800747dd3c0a55d557169451308dcc3f7493651aeedec121dbf472d281c18f35a0c06747a4eb11d9f9dde432e
MD5 SHA1 SHA512

Submit Download

btn_selectnor.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectnor.png
Size 628B
SHA256 f44901379ca39395b4dce48ff23be16bfc725ed2c007c24c812598e1497f80b6
MD5 d7ee8ccb2bc2fcd1c3708a80aff7ddd9
SHA1 b69d4192597b8b934152ffbf976a3dc3573097a3
SHA512 cf0df6a997d25cfa960b5309f084c3333fd5f0e88cd6d294a08c67b953bd852bcd609e86eaef8fa705efa2c0e1637ce15a77e84cbd53f6af7803b3d6dac65294
MD5 SHA1 SHA512

Submit Download

btn_selectover.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectover.png
Size 899B
SHA256 bb9cb825e856efb4066406eea66ab5f520bba7b068d2b76b4835cf1e9833d12e
MD5 b94c73ac1116415faefb972c7cd2a508
SHA1 f3830123f4e1089387d4261658bfe266d0cff627
SHA512 bdbc5c0660a4db7efcfa642a1f7bd13feac5b2ba7723d37cf9b08c9502b0df550d7389e2a16e9879d3128816a928acb2227067f1a498b56c135f9f90a2688527
MD5 SHA1 SHA512

Submit Download

btn_seperater.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_seperater.png
Size 141B
SHA256 ef0ef6f92c648f53a7501fd1d7f2076b0f79e1f7403991bbc8849c27aef5fba8
MD5 a13fc81362de6b7cee25ac2109b1d9c6
SHA1 59c568a1d9dc8c0bd13716d170914efedce405ea
SHA512 54a52eb63d83c5d22e8b97b18b2952643b87122c19f2014027ba634df620668f7568e14aca8a691d484fb01c77f97f1169549abb8b96f6d3e500c518a5d6cd15
MD5 SHA1 SHA512

Submit Download

logo_0.png

Path C:\Users\Admin\AppData\Roaming\SPTemp\Skin\logo_0.png
Size 4KB
SHA256 e3536ca7433446331f77ccfc7d3411d8f4492f95e663bf2eca90db92e3ebbdc6
MD5 7747afae7a5684d2a0aaeda8b0d54b00
SHA1 87c99edb8937f5123fcbb47694a8718fce5d2002
SHA512 8a1965db72fa10f37b1ea9cbb026c1863ff8906b8ad3a7a993b26b9e082c65ff3cd7f3d526bf0a1b28fb6e243e8b131379bcd691ab5769101d46f787e1fd44e3
SSDEEP 96:CVy9HdIvuKWqq4BCnem/PTlDNwWESZmRLWMM+yYBizoPKWJh8:CVUI1BCem/PTMPSZ1cyYO1f
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartPlayer.exe

Path C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe
Size 800KB
SHA256 98c4e937dde640de3a3ab5193f1f71406ca71f62af001bec65eae2af1db97d38
MD5 12a8a9bf78f4b9d78c86b480fb8456c9
SHA1 5a78587b273de9336384b3de9b7af8d09b0321d0
SHA512 27c3ed2c101ee8319b9075893546b11560367b53f22832b78936cd5fb54f749af1c5fecb2093e2626178edc0bea655f019a5089ab3bf03363cacdf281e984246
SSDEEP 24576:fB+OFBqZCLBhynviiXDtbDr8wK3VUaGFWW:ZJFBDBwviYtoVUaGQW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhplay.dll

Path C:\Users\Admin\AppData\Roaming\SPTemp\dhplay.dll
Size 396KB
SHA256 21ab7faf55bd68e69e3ae92fbbd172caa4818b34a04e7c51174e3bc1b05086af
MD5 268f003d3b47d9187b557dfce26b886e
SHA1 bd6202b53fa093fc0e16cb8b7befa97ade279e59
SHA512 e13e1d6c2be866c568f090df5528f9b23a69592b4e562434a18d9d8a11a305278ae54418d555fba0c915b6e42f5cb3d867332f8f82e01d505bc6cf79d7c35ef9
SSDEEP 6144:TmahID58pXda9sOsdcxewxGTLjAYLD5j0C+HIUIc9tFZv:aaODoXDTCTYgw5wNHIURp
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 3KB
SHA256 eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
MD5 00930b40cba79465b7a38ed0449d1449
SHA1 4b25a89ee28b20ba162f23772ddaf017669092a5
SHA512 cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
MD5 SHA1 SHA512

Submit Download

memory/1172-529-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1172-531-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1176-521-0x0000000005170000-0x0000000005202000-memory.dmp

Download

memory/1176-520-0x0000000000280000-0x000000000088A000-memory.dmp

Download

memory/1768-538-0x000001B92FB40000-0x000001B9300D6000-memory.dmp

Download

memory/2164-34-0x00000000053C0000-0x0000000005426000-memory.dmp

Download

memory/2164-31-0x00000000026C0000-0x00000000026F6000-memory.dmp

Download

memory/2164-32-0x0000000004D90000-0x00000000053B8000-memory.dmp

Download

memory/2164-33-0x0000000004CF0000-0x0000000004D12000-memory.dmp

Download

memory/2164-35-0x0000000005430000-0x0000000005496000-memory.dmp

Download

memory/2164-45-0x0000000005770000-0x0000000005AC4000-memory.dmp

Download

memory/2164-46-0x0000000005CB0000-0x0000000005CCE000-memory.dmp

Download

memory/2164-47-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

Download

memory/2164-48-0x0000000006280000-0x00000000062B2000-memory.dmp

Download

memory/2164-49-0x000000006F9B0000-0x000000006F9FC000-memory.dmp

Download

memory/2164-59-0x0000000006E70000-0x0000000006E8E000-memory.dmp

Download

memory/2164-60-0x0000000006EA0000-0x0000000006F43000-memory.dmp

Download

memory/2164-61-0x0000000007700000-0x0000000007D7A000-memory.dmp

Download

memory/2164-69-0x0000000007370000-0x0000000007378000-memory.dmp

Download

memory/2164-62-0x0000000007050000-0x000000000706A000-memory.dmp

Download

memory/2164-63-0x00000000070C0000-0x00000000070CA000-memory.dmp

Download

memory/2164-68-0x0000000007390000-0x00000000073AA000-memory.dmp

Download

memory/2164-67-0x00000000072A0000-0x00000000072B4000-memory.dmp

Download

memory/2164-66-0x0000000007290000-0x000000000729E000-memory.dmp

Download

memory/2164-65-0x0000000007270000-0x0000000007281000-memory.dmp

Download

memory/2164-64-0x00000000072D0000-0x0000000007366000-memory.dmp

Download

memory/2372-117-0x00007FF7F89E0000-0x00007FF7F95E6000-memory.dmp

Download

memory/2604-172-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-171-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-158-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-166-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-161-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-167-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-168-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-164-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-165-0x0000000000890000-0x00000000008B0000-memory.dmp

Download

memory/2604-160-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-169-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-170-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-163-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-162-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-159-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/2604-101-0x0000017DEC130000-0x0000017DEC152000-memory.dmp

Download

memory/3044-143-0x00000219DCF50000-0x00000219DCF58000-memory.dmp

Download

memory/3044-141-0x00000219DCF40000-0x00000219DCF4A000-memory.dmp

Download

memory/3044-139-0x00000219DCDF0000-0x00000219DCDFA000-memory.dmp

Download

memory/3044-137-0x00000219DCD10000-0x00000219DCD2C000-memory.dmp

Download

memory/3044-142-0x00000219DCFA0000-0x00000219DCFBA000-memory.dmp

Download

memory/3044-145-0x00000219DCF90000-0x00000219DCF9A000-memory.dmp

Download

memory/3044-144-0x00000219DCF80000-0x00000219DCF86000-memory.dmp

Download

memory/3044-140-0x00000219DCF60000-0x00000219DCF7C000-memory.dmp

Download

memory/3044-138-0x00000219DCD30000-0x00000219DCDE5000-memory.dmp

Download

memory/3200-2-0x0000000004AC0000-0x0000000004B5C000-memory.dmp

Download

memory/3200-3-0x0000000074D90000-0x0000000075540000-memory.dmp

Download

memory/3200-1-0x0000000000050000-0x0000000000058000-memory.dmp

Download

memory/3200-17-0x0000000074D90000-0x0000000075540000-memory.dmp

Download

memory/3200-16-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

Download

memory/3200-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

Download

memory/3288-150-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3288-157-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3288-151-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3288-153-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3288-152-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3288-154-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3672-15-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/3736-431-0x0000000002490000-0x0000000002515000-memory.dmp

Download

memory/3736-424-0x0000000000A80000-0x0000000000AA0000-memory.dmp

Download

memory/3736-427-0x0000000000AB0000-0x0000000000B1C000-memory.dmp

Download

memory/3788-509-0x0000000007960000-0x0000000007982000-memory.dmp

Download

memory/3788-510-0x00000000087C0000-0x0000000008D64000-memory.dmp

Download

memory/3788-491-0x0000000006A20000-0x0000000006A6C000-memory.dmp

Download

memory/3788-480-0x0000000005E50000-0x00000000061A4000-memory.dmp

Download

memory/4084-405-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4840-501-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4840-465-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/4840-84-0x0000000000C80000-0x0000000000C8D000-memory.dmp

Download

memory/5052-98-0x00007FF778670000-0x00007FF779276000-memory.dmp

Download