xworm | ad34f6a17ee318591b59ac4fbc300c53808630e4f163b644a58eadc85057348a

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NetCat Loader.exe
Size

76KB
MD5

1a56b39b62cff3bf7a75a708f6a11762
SHA1

180d91a57ebb95a81bfaa394bca35c123efa916e
SHA256

ad34f6a17ee318591b59ac4fbc300c53808630e4f163b644a58eadc85057348a
SHA512

b86dfa4287e283fd7e734cc3897589c2bb6b98e35f1c82a6ab50f271baf8a9748a125a6c04425ccdf93566ddacb453290a9a63e5fc0d2797b70fb70b6dac03fb
SSDEEP

1536:JqDtM7DwroXh9bSQ6/jyrV9nmRWnXzWb6Alyj:EwblSlryrV9nmwPeyj

Score

10^/10

xworm aspackv2 bootkit defense_evasion discovery execution persistence rat trojan upx

Malware Config

Extracted

Family

xworm

194.59.31.87:1111

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001227e-5.dat	family_xworm
behavioral2/memory/3068-8-0x00000000008E0000-0x00000000008F6000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2304	powershell.exe
2736	powershell.exe

Disables Task Manager via registry modification
defense_evasion

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0005000000019547-624.dat	aspack_v212_v242

Executes dropped EXE 9 IoCs

pid	Process
3068	System32.exe
544	fkmugq.exe
2600	MBRPayload.exe
2064	melter.exe
1744	Craze.exe
2868	screenscrew.exe
948	lines.exe
2984	INV.exe
552	Craze.exe

Loads dropped DLL 14 IoCs

pid	Process
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe
2132	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63B3.tmp\\MBRPayload.exe"	MBRPayload.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBRPayload.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000016d1c-31.dat	upx
behavioral2/memory/544-32-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/544-137-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/files/0x00050000000195a7-186.dat	upx
behavioral2/memory/1744-191-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral2/memory/2132-188-0x00000000005A0000-0x0000000000614000-memory.dmp	upx
behavioral2/memory/1744-623-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral2/memory/544-651-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/552-653-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral2/memory/552-654-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral2/memory/552-658-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral2/memory/552-662-0x0000000000400000-0x0000000000474000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Craze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fkmugq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	melter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Craze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	screenscrew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBRPayload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 10 IoCs

defense_evasion

pid	Process
2504	timeout.exe
1160	timeout.exe
2820	timeout.exe
1640	timeout.exe
3016	timeout.exe
2752	timeout.exe
3004	timeout.exe
2592	timeout.exe
708	timeout.exe
1676	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3036	taskkill.exe
2812	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000411c40e9cb07fc4094d277538864517300000000020000000000106600000001000020000000bb37745092842e23388bc96ebcf7a5d62a4fa1966865582fec60337d6dc8b90c000000000e8000000002000020000000a10c83415da5b0c8e6833c839adf128752ee220490907f228f4e976850d27d6620000000b19748b17339d0e30ed5dd1d4c21241ada09cf65e5e3cc5a7134d39a41ef1527400000000031b2082ba73a1b9b0a85af7829b8a7fca5bf9286200923f6b5f89d6cb9c74169d763e0be116c026dbe3be7c92844d8a17240566ed07fdfad7c6faac1cb1028	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e000e933ac6edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D84B481-DA9F-11EF-AF7A-C23FE47451C3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000411c40e9cb07fc4094d27753886451730000000002000000000010660000000100002000000062790b4a5aa5f6a851adfbf1cdc0ae92cc3b2972a0b51e03ab578c1dede4a360000000000e8000000002000020000000e8dcc497526667c9d07559cfdd21be09b88b8f1e8458e54fbd1d0d4eb8c0cdfc900000005cac20d0769e29270e10ea6a98368548b1cbd2a0ef220ead64e129b7716a909442f6c3a1f61c77c75d60f3042918db67602534595c8f1e39a353b47a2f4ae749dda5527c91372d464854171781f2b9bac80af0ae4d8047373e93c8f7443e1b5fc0b10a2ef3af9d8e7d25b2f4f671dabed30e6b4ece07146a1968f2249812c21f9e80c991e379f919d999b5ca524040d540000000fa5a89a38da4a81fca6dbc7f84e9f9bfbd5adde8f04ecb295776ceff3a22e7e5baac2ffb434164301d1c2156f85241b849268add51961f82ffee0f28eaf3c83b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1060	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2212	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3068	System32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2304	powershell.exe
2736	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	System32.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	3068	System32.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeShutdownPrivilege	1408	shutdown.exe
Token: SeRemoteShutdownPrivilege	1408	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1568	iexplore.exe
1568	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3068	432	NetCat Loader.exe	29
PID 432 wrote to memory of 3068	432	NetCat Loader.exe	29
PID 432 wrote to memory of 3068	432	NetCat Loader.exe	29
PID 432 wrote to memory of 2880	432	NetCat Loader.exe	30
PID 432 wrote to memory of 2880	432	NetCat Loader.exe	30
PID 432 wrote to memory of 2880	432	NetCat Loader.exe	30
PID 3068 wrote to memory of 2304	3068	System32.exe	32
PID 3068 wrote to memory of 2304	3068	System32.exe	32
PID 3068 wrote to memory of 2304	3068	System32.exe	32
PID 3068 wrote to memory of 2736	3068	System32.exe	34
PID 3068 wrote to memory of 2736	3068	System32.exe	34
PID 3068 wrote to memory of 2736	3068	System32.exe	34
PID 3068 wrote to memory of 544	3068	System32.exe	36
PID 3068 wrote to memory of 544	3068	System32.exe	36
PID 3068 wrote to memory of 544	3068	System32.exe	36
PID 3068 wrote to memory of 544	3068	System32.exe	36
PID 544 wrote to memory of 2132	544	fkmugq.exe	37
PID 544 wrote to memory of 2132	544	fkmugq.exe	37
PID 544 wrote to memory of 2132	544	fkmugq.exe	37
PID 544 wrote to memory of 2132	544	fkmugq.exe	37
PID 2132 wrote to memory of 708	2132	cmd.exe	39
PID 2132 wrote to memory of 708	2132	cmd.exe	39
PID 2132 wrote to memory of 708	2132	cmd.exe	39
PID 2132 wrote to memory of 708	2132	cmd.exe	39
PID 2132 wrote to memory of 2600	2132	cmd.exe	40
PID 2132 wrote to memory of 2600	2132	cmd.exe	40
PID 2132 wrote to memory of 2600	2132	cmd.exe	40
PID 2132 wrote to memory of 2600	2132	cmd.exe	40
PID 2132 wrote to memory of 1060	2132	cmd.exe	41
PID 2132 wrote to memory of 1060	2132	cmd.exe	41
PID 2132 wrote to memory of 1060	2132	cmd.exe	41
PID 2132 wrote to memory of 1060	2132	cmd.exe	41
PID 2600 wrote to memory of 2212	2600	MBRPayload.exe	42
PID 2600 wrote to memory of 2212	2600	MBRPayload.exe	42
PID 2600 wrote to memory of 2212	2600	MBRPayload.exe	42
PID 2600 wrote to memory of 2212	2600	MBRPayload.exe	42
PID 2132 wrote to memory of 1700	2132	cmd.exe	44
PID 2132 wrote to memory of 1700	2132	cmd.exe	44
PID 2132 wrote to memory of 1700	2132	cmd.exe	44
PID 2132 wrote to memory of 1700	2132	cmd.exe	44
PID 2132 wrote to memory of 1160	2132	cmd.exe	45
PID 2132 wrote to memory of 1160	2132	cmd.exe	45
PID 2132 wrote to memory of 1160	2132	cmd.exe	45
PID 2132 wrote to memory of 1160	2132	cmd.exe	45
PID 2132 wrote to memory of 1420	2132	cmd.exe	46
PID 2132 wrote to memory of 1420	2132	cmd.exe	46
PID 2132 wrote to memory of 1420	2132	cmd.exe	46
PID 2132 wrote to memory of 1420	2132	cmd.exe	46
PID 2132 wrote to memory of 2064	2132	cmd.exe	47
PID 2132 wrote to memory of 2064	2132	cmd.exe	47
PID 2132 wrote to memory of 2064	2132	cmd.exe	47
PID 2132 wrote to memory of 2064	2132	cmd.exe	47
PID 2132 wrote to memory of 1676	2132	cmd.exe	48
PID 2132 wrote to memory of 1676	2132	cmd.exe	48
PID 2132 wrote to memory of 1676	2132	cmd.exe	48
PID 2132 wrote to memory of 1676	2132	cmd.exe	48
PID 1420 wrote to memory of 1568	1420	WScript.exe	49
PID 1420 wrote to memory of 1568	1420	WScript.exe	49
PID 1420 wrote to memory of 1568	1420	WScript.exe	49
PID 1420 wrote to memory of 1568	1420	WScript.exe	49
PID 1568 wrote to memory of 2512	1568	iexplore.exe	50
PID 1568 wrote to memory of 2512	1568	iexplore.exe	50
PID 1568 wrote to memory of 2512	1568	iexplore.exe	50
PID 1568 wrote to memory of 2512	1568	iexplore.exe	50

C:\Users\Admin\AppData\Local\Temp\NetCat Loader.exe
"C:\Users\Admin\AppData\Local\Temp\NetCat Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Roaming\System32.exe
  "C:\Users\Admin\AppData\Roaming\System32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System32.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\fkmugq.exe
    "C:\Users\Admin\AppData\Local\Temp\fkmugq.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\63B3.tmp\PanKoza.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:708
    - - C:\Users\Admin\AppData\Local\Temp\63B3.tmp\MBRPayload.exe
        
        MBRPayload.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2600
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\63B3.tmp\MBRPayload.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2212
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1060
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63B3.tmp\note.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1160
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\63B3.tmp\sites.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/channel/UCTmub7HjR9Kc8Uh-Vy3eLaw
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\63B3.tmp\melter.exe
        
        melter.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2064
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 6 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1676
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im melter.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\63B3.tmp\Craze.exe
        
        Craze.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1744
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 4 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2820
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im craze.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\63B3.tmp\screenscrew.exe
        
        screenscrew.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2868
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\63B3.tmp\lines.exe
        
        lines.exe
        5⤵
        Executes dropped EXE
        
        PID:948
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\63B3.tmp\INV.exe
        
        INV.exe
        5⤵
        Executes dropped EXE
        
        PID:2984
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 6 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\63B3.tmp\Craze.exe
        
        craze.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:552
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 8 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2504
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown /r /t 1000 /c "It's Your final 1000 seconds to use Windows"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Thanks For Using.txt
  2⤵
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cbee761af8629cb005972f5525e4ee0

SHA1
ef9ce0fd41a0f6269c23354685d3d4f2a13e6d83

SHA256
47c860a4c699d93053b1be74522a7b34caa752369850dded65001b60f7164d3c

SHA512
775c25980ab9db97374450ff1efe85338037fbc856405d0446a5a9e45a3223805fcc1b01f1ca01f74d51e22a00fa9a96d5ee47681b55ccae2403aede97a8f825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eac2c39a2ba41a3d3ee8ca7683608b9

SHA1
fc165df1e44d7b8b9dd89532ea50f1d594221493

SHA256
003e2590d3d3c303fb7f9deb047a50d84e7f74cd8ff7bcea1985ab5ce7c05a3c

SHA512
4da0345995f56b8ea95e3df0b479eb669ffe0f210c1b7068399f5f7b15234b22a1c542cac2fd62d9ebd51a1392165ecdecbf8d034f1ba3d11e078cdca0a5f6db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01372c6ac797249189bba70bbe50b846

SHA1
bed0097afc262d1cea899bdc265caa1513db40f4

SHA256
10d401bb5e0bb029cd1108583097ea7d190beea458777c91ab694b50c334ea61

SHA512
7e9dd8fe3b1451e2c5002ec38933dad228e7963c30e2c62f90b38c08a137765cc25e41d4536100aaafea15c002a2322d4cbccee314b3f716812722091c06f890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0d86539943790bab855de18a279d714

SHA1
0788089432ca31a37e442e92246b762376d3c7fd

SHA256
5e5759ff3646fd3f618074e44bd53c825c236c24dc95be077a2aaeef91622d6d

SHA512
4b3b1ea8169819afad1eb62403b567009bde42b2bd9e159543677e1cc8aea9c6d23ef746d7f6deb641e32e3a5b9deba8ccc3efd3e2f285bc5e20b4a66b7c2242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
712afd9f652a853ff0a05e1598fe3d68

SHA1
2db4c655a43a167cae48eb2111f500885c943374

SHA256
18492bcf9b1e860b9972c6b02dcb8401fe06e3bf69d6d350be536a59665a2087

SHA512
fd290d04b3e0bf542e4e2561e5397ad89e0ef3e5be43a90f93cda130b6fa28eb2c7baf20e5d370b1f54e881ad0246d3132609e977f7f920c7073a60c808ecb1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd2dcd6211e03d82ebc9cff80da850b2

SHA1
4de8a3440aefd016d95d87d6fdb1c9ca8f3483a8

SHA256
b3f6ae27945032bfd2579a7c93b0f69be3cefab960cdf9a03a960cd624cb1137

SHA512
2bd4e8624ed627acc4413db8f5c30286182aab1a2f12c7c8cb998df4a38c1c05e73c65657bf459c36888dcd077eb22dcd015eb3f669319b4b9a68b29570096eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
903e6dccd3bc8b3dde453fd6b60befda

SHA1
857c8263e17f6828a2b2324f6c185d764a47e820

SHA256
426baeee5b7e9b1f1f56bb9d0f21b7c0f80ed7987a3028d85bdeebc6e138ef42

SHA512
93cd7624a6ee3694df529217d950daa3935af552e887a5a000d1b84e6c6012cafd657fba1ab3751f596c3b58a7652d1fcf9f4f224efdd8ad78e66583e02990e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95db014b94f6a4c15742b803d7779c4f

SHA1
eaa920e9e9559ec1ceadf8417f52ded1af3d5dd3

SHA256
455a1ae336036931bba324a20acefa3e1e1fd17c397b049c37896ebd85b949d6

SHA512
95bea40b7830a36c5e8ec6dbb4ba93b237dd3aadffd4ff79543d35513e86abc53faaf74d54890d76739711bc250f194f89ee6190f2e7951c1ab3ec9933c1c319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5380861c09ba03a708fd72a1f86007f0

SHA1
9492dd1e8d58fc9f34936ddcb68ba52052507beb

SHA256
b5226dbe9ee75df5e8384995f55e31d61791ac75725e0ae8694a61b1c7bf42c9

SHA512
8de6ae48c6528460155c4d84eca153479fe497e9b9110ed4668550415c639960eb0f982c2201db59d8bb8402e3551f71531df6720b719b13670e6646983b14bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\melo7gx\imagestore.dat

Filesize
5KB

MD5
375dfbdffc565ca776d477bc00f5e8e4

SHA1
53ed02c92d2bd81b277a7c1279e582e3791cc3ec

SHA256
1ae794bbc9696e972b2d6da11b754aac8d19e253e8c65d2ec29aca07725e2478

SHA512
a69676ffd18c573f87795d0de0eb21fd1ce0fc585694770ab0401feb024f0e51e82ef364b0513c8c36e39482b36a4493d6362ce46dee5df942ba6f42e6a50072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\63B3.tmp\PanKoza.bat

Filesize
736B

MD5
24f0349bbf490fea5eb3acbf54bd1ba8

SHA1
e3ca3514fe098b27dac66dfaa93e035fe6ef25f0

SHA256
78c3005b4d5f500de7d540822cf2c334fc585a6a0d45da8c4af47f1500239899

SHA512
4aac8a6652c1ff52c797344299f5f21746ff1769425bcdbbe4b04fa9363619e320811a8bf8ef0c18e7d0758f38d6a33249c14c9af4a3773da61bb2d7910fa26b

Download Submit
C:\Users\Admin\AppData\Local\Temp\63B3.tmp\lines.exe

Filesize
103KB

MD5
50caeee44dc92a147cf95fd82eb6e299

SHA1
a6619a150a31f4c1b4913884123f5b5334e23489

SHA256
81b9a2e3e9ee39f05b585ad871696a946837fcf784d3d4ecd4b9caea16560a1e

SHA512
e009de28d24abbecac2b20c4dcbbe4bd2de461c0d3140043d1ef6db3e4807d13723fb1916bc9bd1a636cfdc4bb3e102ecae645e783901ebdf9996e9bcdd9466b

Download Submit
C:\Users\Admin\AppData\Local\Temp\63B3.tmp\melter.exe

Filesize
3KB

MD5
d9baac374cc96e41c9f86c669e53f61c

SHA1
b0ba67bfac3d23e718b3bfdfe120e5446d0229e8

SHA256
a1d883577bcb6c4f9de47b06fe97c370c09bddffb6569b6cf93576371bdbc412

SHA512
4ecdf8757e75b02da06a9d42a8ca62b9f2ef292dc04fa37d96603af78433f8aa9dd82fcf1e128a8f463b9691dcc1645b4a64e34f3c5d631f3a0e0670da0d0457

Download Submit
C:\Users\Admin\AppData\Local\Temp\63B3.tmp\note.vbs

Filesize
123B

MD5
b41b06859fca8e157db46e6609e4a51d

SHA1
8daa0836735347c030e641abdc277bbd66662c33

SHA256
f613aec542d7967cae9d01794b7061bce5083d68c825821a5b702e97f32039c4

SHA512
4290d132c7c1ad154a3ade465e810e9fe4db5a8e0604a35d53e82a6482cd22fdd8ba74e97c0bc2e146e2bcf2ecc9afcc4e4e358e98b353168b67a71b71ced75c

Download Submit
C:\Users\Admin\AppData\Local\Temp\63B3.tmp\sites.vbs

Filesize
287B

MD5
5c5324b059b0abf1824a5223832b8479

SHA1
145c596bd6bfc1bfbd1a5a2aa8e5f4b3cef4ef57

SHA256
9fd517699e352ffb9fd73319eb1ec58e7e771457f6e7c1d715e0f57e1d37d733

SHA512
b8219eba1d34c83cc193b5ba2da8aa9dce4f8b221c9aac3a52256e6c2855b77be4270a629dec7e36c92652f9b5e4c1dbc84b91a3bcdca663cc3d728eada6c3e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6BC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6ED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fkmugq.exe

Filesize
552KB

MD5
4860c95131365be3bfa06efd3d95b7af

SHA1
3bc68ad8b5725137ff85709988ef434088ae2c81

SHA256
7bda3690420d2b0cf562713a67b95071d9b44ac01bfabe6cab4c4acbbaa04737

SHA512
00dcca22cd2feeab004a44f8f61c8c67172c88ee4ff4fa8dd495d09606fb6f231be79c8a2707e1c8cc934ffda73445bdaeb05f5ba77034cfbce3a8af75c7f00e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ccbcd93163e278ccfa5d6f276ede24c3

SHA1
432072a22870c13bacfc3a93dbe7abc8ee5de484

SHA256
e75b486a0edcadc86852c5827d4378ab5774ae6daae11364e7ea4a0ee6bab881

SHA512
be7cfe52c835fc0c15f678f629e8b52faa7704d6004a167bf962c8125e2ff3e24febc1e1b073d755ef3a550b34b77100e161e1c4bebcfcc7e74e4c4c66e9011a

Download Submit
C:\Users\Admin\AppData\Roaming\System32.exe

Filesize
63KB

MD5
66bbe5829a613fedad7f79e2c6273448

SHA1
57314396a65e08b7bfc5f0b8cdfa9a050579d9d9

SHA256
72499a032c26ef7031b942590e4dd2e28d60b332620c7d2dc42bc4b70995e0dd

SHA512
9b0ea0bb6a4a6ae75c6463f2bc3b5bd012a40a89f491868979230b850b948240b40326c703211edd349911e97a218bf77d01d06f254c33d83939c21a152efae3

Download Submit
C:\Users\Admin\AppData\Roaming\Thanks For Using.txt

Filesize
57B

MD5
f9cfd0c4da0a9a068f8a26ee31c85036

SHA1
ea75b71cfdf7364eacfafcaac0421f9c80a2b4e5

SHA256
e52f33ee65ceb7e5fe9cd47744888c089c37ba7dbadeaf345e75b5cadd43ee2d

SHA512
f81823ed92d8f5aa299d0164f59fb77a3af4c6a9ca5a98e0d4b33104ec7f15ef19037d4bb4f3b2c8c1ca156bac2253f5052eb801468db73d71a67b10405e4b51

Download Submit
\Users\Admin\AppData\Local\Temp\63B3.tmp\Craze.exe

Filesize
202KB

MD5
ad27143d078706b7cadcbb3f63212384

SHA1
71e532c89954881636f8fe973b9ea035a9e2de6d

SHA256
0b86d60e99e9f4a3bfa60cd447ac62eda52428be564f777151c883fdf547fb26

SHA512
39d8abb4883d3db96a88e88ea76ec8cc6a11e8905eeba593789a08b7d26cf449d682b2537cda790b124e06dc94bede7a78477f941220fe47d3e7ffad3bf9868b

Download Submit
\Users\Admin\AppData\Local\Temp\63B3.tmp\INV.exe

Filesize
103KB

MD5
e079c468c9caed494623dbf95e9ce5e8

SHA1
4d8d1d17e9d7ff455a5c69e048d7575b5a3ea0f7

SHA256
8e217ce5670ac1021fdb6101372f9322f7ff82481ecd9badc104ff542e46128c

SHA512
d9c1a6f28c0c76b6856dec8723eb79d1b620a70b8ab3b5f028848e890a684beeb3460e310959c69f21cffb0a14751ea6cb719aacdbc2043121f057dd56f868a8

Download Submit
\Users\Admin\AppData\Local\Temp\63B3.tmp\MBRPayload.exe

Filesize
101KB

MD5
3aa620597abcae5c26b71e21e15b9acf

SHA1
ed797bc834050bc108a31f1511102608943391c5

SHA256
91f9327997754b0238caeff5cffced7eed3e13d5ac39dec87b329678bee8a145

SHA512
562de36b77f6cf5a369c8b434fb5605ee4169fa50c6a4df4d22c1a64dfec39d779b1fc285407ab851ef27b33061159cb1bb548079fa0d0a3d2e10517f8ee0b12

Download Submit
\Users\Admin\AppData\Local\Temp\63B3.tmp\screenscrew.exe

Filesize
111KB

MD5
e87a04c270f98bb6b5677cc789d1ad1d

SHA1
8c14cb338e23d4a82f6310d13b36729e543ff0ca

SHA256
e03520794f00fb39ef3cfff012f72a5d03c60f89de28dbe69016f6ed151b5338

SHA512
8784f4d42908e54ecedfb06b254992c63920f43a27903ccedd336daaeed346db44e1f40e7db971735da707b5b32206be1b1571bc0d6a2d6eb90bbf9d1f69de13

Download Submit
memory/432-1-0x00000000002F0000-0x000000000030A000-memory.dmp

Filesize
104KB

Download
memory/432-0-0x000007FEF65A3000-0x000007FEF65A4000-memory.dmp

Filesize
4KB

Download
memory/544-32-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/544-137-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/544-651-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/552-653-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/552-658-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/552-654-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/552-662-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/948-641-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1744-623-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1744-191-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2132-199-0x00000000005A0000-0x0000000000614000-memory.dmp

Filesize
464KB

Download
memory/2132-188-0x00000000005A0000-0x0000000000614000-memory.dmp

Filesize
464KB

Download
memory/2132-645-0x00000000005A0000-0x0000000000614000-memory.dmp

Filesize
464KB

Download
memory/2132-633-0x00000000005A0000-0x0000000000614000-memory.dmp

Filesize
464KB

Download
memory/2132-634-0x00000000005A0000-0x0000000000614000-memory.dmp

Filesize
464KB

Download
memory/2132-646-0x00000000005A0000-0x0000000000614000-memory.dmp

Filesize
464KB

Download
memory/2304-17-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2304-16-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/2600-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2736-24-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/2736-23-0x000000001B350000-0x000000001B632000-memory.dmp

Filesize
2.9MB

Download
memory/2868-640-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2868-649-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2868-656-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2984-648-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3068-8-0x00000000008E0000-0x00000000008F6000-memory.dmp

Filesize
88KB

Download
memory/3068-10-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Filesize
9.9MB

Download
memory/3068-628-0x000000001B440000-0x000000001B520000-memory.dmp

Filesize
896KB

Download
memory/3068-11-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Filesize
9.9MB

Download
memory/3068-25-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Filesize
9.9MB

Download
memory/3068-26-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Filesize
9.9MB

Download