dharma | 526b432752bac2edc49ee4a3cc2428f5d7249fa3afe66deba5d23e12e4bce68c

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rack/d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
Size

304KB
MD5

19e48e72c51e0e652a2b5c75db0ef9bc
SHA1

b4ea00205b0e611e2fc155d5ded19b22cd6341f3
SHA256

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191
SHA512

65269d693b7ddf70c76069d2a80cec73ba1f78a38b0cfcf029af5c30eca972a7b2f21c327f63ac5a17d85a7fab4008e4c04d6ba4e50561f2f71ea7ede52175e2
SSDEEP

6144:6V13slAMd1EHcabi6NiwnpmxKFGgTU55MlP:6VxZM3raLdnAKFGg4HMx

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 3ADA075C In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (521) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe = "C:\\Windows\\System32\\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe"	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Drops file in System32 directory 2 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
File created	C:\Windows\System32\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Windows\System32\Info.hta	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Drops file in Program Files directory 64 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\THMBNAIL.PNG.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-100_contrast-white.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ui-strings.js.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook2x.png.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\cancelled.slk	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\createpdf.svg.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-32.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_am.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Regular.otf.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\IrisProtocol.winmd	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\selector.js.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\ui-strings.js.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssui.dll.mui	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sk_get.svg	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\hyph_en_GB.dic.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Dark.scale-125.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-100.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\Add-Numbers.Tests.ps1	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\contrast-white\Error.svg	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libhds_plugin.dll.id-3ADA075C.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2756	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4860	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4440	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5000	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1964	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4768	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2940	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3340	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4976	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3280	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2332	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4320	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2404	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2008	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5012	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3180	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2640	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
792	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
560	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1120	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3848	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3420	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5036	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3836	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3772	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4404	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2220	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
952	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
220	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3116	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4392	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5808	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6064	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5892	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5744	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6104	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5964	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2688	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1944	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5316	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
7000	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
540	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5772	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6096	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
388	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5064	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4400	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2080	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4352	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5344	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6780	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6348	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2040	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6296	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5656	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6224	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5844	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6800	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6036	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2572	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4992	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2724	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4596	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
6056	1884	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

1848 vssadmin.exe
1852 vssadmin.exe

pid	process
1848	vssadmin.exe
1852	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

pid	process
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1744 vssvc.exe
Token: SeRestorePrivilege 1744 vssvc.exe
Token: SeAuditPrivilege 1744 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1744	vssvc.exe
Token: SeRestorePrivilege	1744	vssvc.exe
Token: SeAuditPrivilege	1744	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.execmd.execmd.exe

description	pid	process	target process
PID 1884 wrote to memory of 1632	1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	cmd.exe
PID 1884 wrote to memory of 1632	1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	cmd.exe
PID 1632 wrote to memory of 3408	1632	cmd.exe	mode.com
PID 1632 wrote to memory of 3408	1632	cmd.exe	mode.com
PID 1632 wrote to memory of 1848	1632	cmd.exe	vssadmin.exe
PID 1632 wrote to memory of 1848	1632	cmd.exe	vssadmin.exe
PID 1884 wrote to memory of 3268	1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	cmd.exe
PID 1884 wrote to memory of 3268	1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	cmd.exe
PID 3268 wrote to memory of 1340	3268	cmd.exe	mode.com
PID 3268 wrote to memory of 1340	3268	cmd.exe	mode.com
PID 3268 wrote to memory of 1852	3268	cmd.exe	vssadmin.exe
PID 3268 wrote to memory of 1852	3268	cmd.exe	vssadmin.exe
PID 1884 wrote to memory of 5604	1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	mshta.exe
PID 1884 wrote to memory of 5604	1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	mshta.exe
PID 1884 wrote to memory of 5292	1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	mshta.exe
PID 1884 wrote to memory of 5292	1884	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	mshta.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Rack\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
"C:\Users\Admin\AppData\Local\Temp\Rack\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:3408
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 512
  2⤵
  - Program crash
  PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 520
  2⤵
  - Program crash
  PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 564
  2⤵
  - Program crash
  PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 552
  2⤵
  - Program crash
  PID:5000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 564
  2⤵
  - Program crash
  PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 608
  2⤵
  - Program crash
  PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 668
  2⤵
  - Program crash
  PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 688
  2⤵
  - Program crash
  PID:3340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 720
  2⤵
  - Program crash
  PID:4976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 736
  2⤵
  - Program crash
  PID:3280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 776
  2⤵
  - Program crash
  PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 784
  2⤵
  - Program crash
  PID:4320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 756
  2⤵
  - Program crash
  PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 764
  2⤵
  - Program crash
  PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 748
  2⤵
  - Program crash
  PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 800
  2⤵
  - Program crash
  PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 816
  2⤵
  - Program crash
  PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 836
  2⤵
  - Program crash
  PID:792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 808
  2⤵
  - Program crash
  PID:560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 840
  2⤵
  - Program crash
  PID:1120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 836
  2⤵
  - Program crash
  PID:3848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 768
  2⤵
  - Program crash
  PID:3420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 840
  2⤵
  - Program crash
  PID:5036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 852
  2⤵
  - Program crash
  PID:3836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 756
  2⤵
  - Program crash
  PID:3772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 820
  2⤵
  - Program crash
  PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 760
  2⤵
  - Program crash
  PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 816
  2⤵
  - Program crash
  PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 996
  2⤵
  - Program crash
  PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1004
  2⤵
  - Program crash
  PID:3116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 800
  2⤵
  - Program crash
  PID:4392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 936
  2⤵
  - Program crash
  PID:5808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 984
  2⤵
  - Program crash
  PID:6064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1020
  2⤵
  - Program crash
  PID:5892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 928
  2⤵
  - Program crash
  PID:5744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 960
  2⤵
  - Program crash
  PID:6104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 800
  2⤵
  - Program crash
  PID:5964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 900
  2⤵
  - Program crash
  PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 860
  2⤵
  - Program crash
  PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 952
  2⤵
  - Program crash
  PID:5316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 868
  2⤵
  - Program crash
  PID:7000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 840
  2⤵
  - Program crash
  PID:540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1008
  2⤵
  - Program crash
  PID:5772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 748
  2⤵
  - Program crash
  PID:6096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1016
  2⤵
  - Program crash
  PID:388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 800
  2⤵
  - Program crash
  PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 960
  2⤵
  - Program crash
  PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 888
  2⤵
  - Program crash
  PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 748
  2⤵
  - Program crash
  PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 956
  2⤵
  - Program crash
  PID:5344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 780
  2⤵
  - Program crash
  PID:6780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 980
  2⤵
  - Program crash
  PID:6348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 956
  2⤵
  - Program crash
  PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 800
  2⤵
  - Program crash
  PID:6296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 892
  2⤵
  - Program crash
  PID:5656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 960
  2⤵
  - Program crash
  PID:6224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 812
  2⤵
  - Program crash
  PID:5844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 916
  2⤵
  - Program crash
  PID:6800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 816
  2⤵
  - Program crash
  PID:6036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 940
  2⤵
  - Program crash
  PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 872
  2⤵
  - Program crash
  PID:4992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 816
  2⤵
  - Program crash
  PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 760
  2⤵
  - Program crash
  PID:4596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 876
  2⤵
  - Program crash
  PID:6056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 868
  2⤵
  PID:6188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 992
  2⤵
  PID:4396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 868
  2⤵
  PID:6200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 920
  2⤵
  PID:6636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 856
  2⤵
  PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 588
  2⤵
  PID:6924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 948
  2⤵
  PID:4992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 780
  2⤵
  PID:3304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 960
  2⤵
  PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 624
  2⤵
  PID:5256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 856
  2⤵
  PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1012
  2⤵
  PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 780
  2⤵
  PID:5696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 624
  2⤵
  PID:6928
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:1340
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 828
  2⤵
  PID:732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1124
  2⤵
  PID:6236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1176
  2⤵
  PID:928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1328
  2⤵
  PID:6228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1336
  2⤵
  PID:1672
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:5604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1292
  2⤵
  PID:6684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1560
  2⤵
  PID:2892
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:5292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1596
  2⤵
  PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1372
  2⤵
  PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1884 -ip 1884
1⤵
PID:1548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1884 -ip 1884
1⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1884 -ip 1884
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1884 -ip 1884
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1884 -ip 1884
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1884 -ip 1884
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1884 -ip 1884
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1884 -ip 1884
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1884 -ip 1884
1⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1884 -ip 1884
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1884 -ip 1884
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1884 -ip 1884
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1884 -ip 1884
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1884 -ip 1884
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1884 -ip 1884
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1884 -ip 1884
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1884 -ip 1884
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1884 -ip 1884
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1884 -ip 1884
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1884 -ip 1884
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1884 -ip 1884
1⤵
PID:284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1884 -ip 1884
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1884 -ip 1884
1⤵
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1884 -ip 1884
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1884 -ip 1884
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1884 -ip 1884
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1884 -ip 1884
1⤵
PID:472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1884 -ip 1884
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1884 -ip 1884
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1884 -ip 1884
1⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1884 -ip 1884
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1884 -ip 1884
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1884 -ip 1884
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1884 -ip 1884
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1884 -ip 1884
1⤵
PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1884 -ip 1884
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1884 -ip 1884
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1884 -ip 1884
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1884 -ip 1884
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1884 -ip 1884
1⤵
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1884 -ip 1884
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1884 -ip 1884
1⤵
PID:6412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1884 -ip 1884
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1884 -ip 1884
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1884 -ip 1884
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1884 -ip 1884
1⤵
PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1884 -ip 1884
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1884 -ip 1884
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1884 -ip 1884
1⤵
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1884 -ip 1884
1⤵
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1884 -ip 1884
1⤵
PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1884 -ip 1884
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1884 -ip 1884
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1884 -ip 1884
1⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1884 -ip 1884
1⤵
PID:6196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1884 -ip 1884
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1884 -ip 1884
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1884 -ip 1884
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1884 -ip 1884
1⤵
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1884 -ip 1884
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1884 -ip 1884
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1884 -ip 1884
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1884 -ip 1884
1⤵
PID:6408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1884 -ip 1884
1⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1884 -ip 1884
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1884 -ip 1884
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1884 -ip 1884
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1884 -ip 1884
1⤵
PID:6668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1884 -ip 1884
1⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1884 -ip 1884
1⤵
PID:6212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1884 -ip 1884
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1884 -ip 1884
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1884 -ip 1884
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1884 -ip 1884
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1884 -ip 1884
1⤵
PID:6556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1884 -ip 1884
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1884 -ip 1884
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1884 -ip 1884
1⤵
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1884 -ip 1884
1⤵
PID:5972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1884 -ip 1884
1⤵
PID:6764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1884 -ip 1884
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1884 -ip 1884
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1884 -ip 1884
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1884 -ip 1884
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1884 -ip 1884
1⤵
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1884 -ip 1884
1⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1884 -ip 1884
1⤵
PID:5148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\javafx-src.zip.id-3ADA075C.[[email protected]].money

Filesize
5.7MB

MD5
023b13f2e72cdf6d73aa5e90e304a459

SHA1
2cefcea5b1cadc6b982535c2b2bc92e372bb77a0

SHA256
0ee1d8d0196d51e02776605bce29a6e58f026bbad124f676660d64b3e5716a48

SHA512
a6a2322b6196162f83775f3e686179aeda75bfa1fba9ef3873d84a377eb5e9a5c94be636d087947ce127a5ba8486c38f9a3504d8815fa2ef0aeaef821bf5f440

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
bf55c1f3e91575d16ade307dc8db28a1

SHA1
a8843dce93cd74e37d44a61f749ff377e51ae6a0

SHA256
c4814c59041cc89cfe4912ee054843f4850bbfcf433773ce330a13c97e3c102a

SHA512
07eecaf7271b114d98ec64c7342185d64175e5ad2a9b435652cdd373a2d63409bbd6cf9138ac9f1dd7708213aa66637430504be0db8d7e2e29b0c1abb032a77e

Download Submit
memory/1884-2-0x00000000006D0000-0x00000000006E9000-memory.dmp

Filesize
100KB

Download
memory/1884-1-0x0000000000720000-0x0000000000820000-memory.dmp

Filesize
1024KB

Download
memory/1884-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1884-7-0x0000000000720000-0x0000000000820000-memory.dmp

Filesize
1024KB

Download
memory/1884-8-0x00000000006D0000-0x00000000006E9000-memory.dmp

Filesize
100KB

Download
memory/1884-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1884-9-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download