Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- max time kernel
43s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20251231-en - resource tags
- submitted
17/01/2026, 16:48
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260117-vbc3sagy6d
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
91.151.95.112:1604
-
QSR_MUTEX_L8AWYFSXAaJziO1ajz
-
encryption_key
G2WUHJaRgAk0FybAFvFu
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
-
metasploit
-
metasploit_stager
-
43.134.163.224:4444
Extracted
-
stealc
-
crypt
-
http://196.251.107.23
-
url_path
/7ffc7a279c17c091.php
Extracted
-
xworm
-
196.251.107.104:1177
-
196.251.107.23:1177
-
Install_directory
%Userprofile%
-
install_file
synhost.exe
Extracted
-
asyncrat
-
0.5.8
-
Default
-
196.251.107.104:6606
-
196.251.107.104:7707
-
196.251.107.104:8808
-
kqNlEor85bqX
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Detect Xworm Payload 2 IoCs
- Detects SvcStealer Payload 1 IoCs
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Async RAT payload 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 13 IoCs
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 5 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 5 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 12 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 33 IoCs
- Suspicious use of SendNotifyMessage 25 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"3⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe4⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\reverse_shell.exereverse_shell.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\opnic.exeopnic.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "66E1D82A4F66D7EF"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\reverse.exereverse.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\actu.exeactu.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\' -Verb RunAs"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\'}"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\demon.exedemon.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File eazyy.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File eaz.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File EASY.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File eazyyyyyyy.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\vz.exevz.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /tn "66E1D82A4F66D7EF" /tr "C:\Users\Admin\AppData\Roaming\66E1D82A4F66D7EF\66E1D82A4F66D7EF.exe"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Documents.exeDocuments.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1_240626921.exe"C:\Users\Admin\AppData\Local\Temp\1_240626921.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2_240651281.exe"C:\Users\Admin\AppData\Local\Temp\2_240651281.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-09RRPQMJGY.tmp\2_240651281.tmp"C:\Users\Admin\AppData\Local\Temp\is-09RRPQMJGY.tmp\2_240651281.tmp" /SL5="$10638,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240651281.exe"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2_240651281.exe"C:\Users\Admin\AppData\Local\Temp\2_240651281.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80987⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-JEKHUX1BO7.tmp\2_240651281.tmp"C:\Users\Admin\AppData\Local\Temp\is-JEKHUX1BO7.tmp\2_240651281.tmp" /SL5="$106C6,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240651281.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80988⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\payload.exepayload.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ofu.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File shell.ps14⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\duobs.exeduobs.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\donut.exedonut.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File SECOND.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\nc.exenc.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File tesst.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\Polarised_97.74.8_INSTALL.exePolarised_97.74.8_INSTALL.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3S08G.tmp\Polarised_97.74.8_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-3S08G.tmp\Polarised_97.74.8_INSTALL.tmp" /SL5="$202C4,2714024,817152,C:\Users\Admin\AppData\Local\Temp\a\Polarised_97.74.8_INSTALL.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\Polarised_97.74.8_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\Polarised_97.74.8_INSTALL.exe" /VERYSILENT /PASSWORD=c9d4bb30-cb45-43e6-a5a5-0428b46e6eec6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DJ2AF.tmp\Polarised_97.74.8_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-DJ2AF.tmp\Polarised_97.74.8_INSTALL.tmp" /SL5="$20346,2714024,817152,C:\Users\Admin\AppData\Local\Temp\a\Polarised_97.74.8_INSTALL.exe" /VERYSILENT /PASSWORD=c9d4bb30-cb45-43e6-a5a5-0428b46e6eec7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe"C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TE.exeTE.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File CU.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\winhost.exewinhost.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1_240630109.exe"C:\Users\Admin\AppData\Local\Temp\1_240630109.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2_240651390.exe"C:\Users\Admin\AppData\Local\Temp\2_240651390.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DDJKU0ESDR.tmp\2_240651390.tmp"C:\Users\Admin\AppData\Local\Temp\is-DDJKU0ESDR.tmp\2_240651390.tmp" /SL5="$205EE,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240651390.exe"6⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2_240651390.exe"C:\Users\Admin\AppData\Local\Temp\2_240651390.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80987⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3_240660234.exe"C:\Users\Admin\AppData\Local\Temp\3_240660234.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4_240666578.exe"C:\Users\Admin\AppData\Local\Temp\4_240666578.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6_240675125.exe"C:\Users\Admin\AppData\Local\Temp\6_240675125.exe"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ikmero.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Setup.exeSetup.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PMV1C9VCLN.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-PMV1C9VCLN.tmp\Setup.tmp" /SL5="$2034A,2668797,842240,C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"C:\Users\Admin\AppData\Local\Temp\a\Setup.exe" /VERYSILENT /PASSWORD=487f1878-6b19-4d1e-baec-6fcf9b5529516⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-4C2AQ67T1M.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-4C2AQ67T1M.tmp\Setup.tmp" /SL5="$3033E,2668797,842240,C:\Users\Admin\AppData\Local\Temp\a\Setup.exe" /VERYSILENT /PASSWORD=487f1878-6b19-4d1e-baec-6fcf9b5529517⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe"C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe" -Embedding8⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exeClient-built.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"5⤵
- Checks computer location settings
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exenamuvpnx2.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\soporte.exesoporte.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe5⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\grid-enabled_7888.43.58.91_INSTALL.exegrid-enabled_7888.43.58.91_INSTALL.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-331I4.tmp\grid-enabled_7888.43.58.91_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-331I4.tmp\grid-enabled_7888.43.58.91_INSTALL.tmp" /SL5="$20348,3319519,56832,C:\Users\Admin\AppData\Local\Temp\a\grid-enabled_7888.43.58.91_INSTALL.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\namu864.exenamu864.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\namu864.exe"C:\Users\Admin\AppData\Roaming\namu864.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\p4nd4w4.exep4nd4w4.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\sincyi.exesincyi.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File STEINFTPP.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exeNAMUVPN32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe"C:\Users\Admin\AppData\Local\Temp\365VPN32\365VPN32.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\aibpcqx.exeaibpcqx.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"5⤵
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\aiopbu.exeaiopbu.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File richard.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\folderagent-2017-01-03.exefolderagent-2017-01-03.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-2D2GK.tmp\folderagent-2017-01-03.tmp"C:\Users\Admin\AppData\Local\Temp\is-2D2GK.tmp\folderagent-2017-01-03.tmp" /SL5="$B00D6,570697,121344,C:\Users\Admin\AppData\Local\Temp\a\folderagent-2017-01-03.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\cnc.execnc.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exeNAMUVPN32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exeNAMUVPN7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exeNAMUVPN7.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\stub.exestub.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exeNAMUVPN7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\Test.exeTest.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\a\agent_clean.exeagent_clean.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\ctfmon.exectfmon.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\ctfmon.exeC:\Users\Admin\AppData\Roaming\ctfmon.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\IMG001.exeIMG001.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe6⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe7⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\alfa.exealfa.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe5⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "NHHNXIBN"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "NHHNXIBN" binpath= "C:\ProgramData\lyvmbzqbnqcl\bokjoamzbbvc.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "NHHNXIBN"5⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File sweet.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\torkilsmicmuter.exetorkilsmicmuter.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\a\background_9.5982.7702.8199_INSTALL.exebackground_9.5982.7702.8199_INSTALL.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-WIWG1QT0OW.tmp\background_9.5982.7702.8199_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-WIWG1QT0OW.tmp\background_9.5982.7702.8199_INSTALL.tmp" /SL5="$104A0,3851360,893440,C:\Users\Admin\AppData\Local\Temp\a\background_9.5982.7702.8199_INSTALL.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\background_9.5982.7702.8199_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\background_9.5982.7702.8199_INSTALL.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80986⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-SMUS0VAS3Y.tmp\background_9.5982.7702.8199_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-SMUS0VAS3Y.tmp\background_9.5982.7702.8199_INSTALL.tmp" /SL5="$204A0,3851360,893440,C:\Users\Admin\AppData\Local\Temp\a\background_9.5982.7702.8199_INSTALL.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80987⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe"C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe" -Embedding8⤵
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnxp.exenamuvpnxp.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vilta.exevilta.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Driver_EN_msc_AMD_v22.39.exeDriver_EN_msc_AMD_v22.39.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\agent.exeagent.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File newww.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\sunilost.exesunilost.exe4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "synhost" /tr "C:\Users\Admin\synhost.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\485.exe485.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\1_240654468.exe"C:\Users\Admin\AppData\Local\Temp\1_240654468.exe"5⤵
-
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2_240664734.exe"C:\Users\Admin\AppData\Local\Temp\2_240664734.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PNMIKGNN6K.tmp\2_240664734.tmp"C:\Users\Admin\AppData\Local\Temp\is-PNMIKGNN6K.tmp\2_240664734.tmp" /SL5="$80054,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240664734.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\3_240672843.exe"C:\Users\Admin\AppData\Local\Temp\3_240672843.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeLoader.exe4⤵
- Checks computer location settings
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\a\Loader.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ShowMyPC3510.exeShowMyPC3510.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\ShowMyPC\-ShowMyPC3510\SMPCSetup.exe"C:\Users\Admin\AppData\Local\Temp\ShowMyPC\-ShowMyPC3510\SMPCSetup.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\m.exem.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\update.exeupdate.exe4⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ZeroTier_One.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i DH9338297YV389821.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i v4.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\Intel_CardReader_CR_Realtek_EN_V1.23.43.exeIntel_CardReader_CR_Realtek_EN_V1.23.43.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\clean.execlean.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\scalable_8599.9243.77_INSTALL.exescalable_8599.9243.77_INSTALL.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-9R79IWI9FP.tmp\scalable_8599.9243.77_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-9R79IWI9FP.tmp\scalable_8599.9243.77_INSTALL.tmp" /SL5="$1059E,3783017,893440,C:\Users\Admin\AppData\Local\Temp\a\scalable_8599.9243.77_INSTALL.exe"5⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\scalable_8599.9243.77_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\scalable_8599.9243.77_INSTALL.exe" /VERYSILENT /PASSWORD=018a971e-03f3-4100-94f1-c89ee66df8586⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-5YGZ0Z7PC7.tmp\scalable_8599.9243.77_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-5YGZ0Z7PC7.tmp\scalable_8599.9243.77_INSTALL.tmp" /SL5="$10614,3783017,893440,C:\Users\Admin\AppData\Local\Temp\a\scalable_8599.9243.77_INSTALL.exe" /VERYSILENT /PASSWORD=018a971e-03f3-4100-94f1-c89ee66df8587⤵
- Loads dropped DLL
-
C:\ProgramData\b307acaf-30f0-40ee-87eb-208056b3a2d6\FnHotkeyUtility.exe"C:\ProgramData\b307acaf-30f0-40ee-87eb-208056b3a2d6\FnHotkeyUtility.exe" -Embedding8⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\phantom.exephantom.exe4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get HypervisorPresent5⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\implant.exeimplant.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sliver.exesliver.exe4⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i voice3567800122006222039012.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\AnyDesk.exeAnyDesk.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\a\AnyDesk.exe" --local-service5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\a\AnyDesk.exe" --local-control5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tmgm.exetmgm.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jsuoni.exejsuoni.exe4⤵
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\gfdhgcxww_x64.exegfdhgcxww_x64.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\apps.exeapps.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\c.exec.exe4⤵
- Suspicious use of SetThreadContext
-
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\zp.exezp.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\fobxyv.exefobxyv.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\synchost.exesynchost.exe4⤵
- Checks computer location settings
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\a\synchost.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\5.exe5.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe6.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\8.exe8.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\smk.exesmk.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9856 -s 2325⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\dw.exedw.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\1_240671859.exe"C:\Users\Admin\AppData\Local\Temp\1_240671859.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\defsyscn.exedefsyscn.exe4⤵
-
C:\Windows\system32\audiodg.exe"C:\Windows\system32\audiodg.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\eti0i1zwbba6.exeeti0i1zwbba6.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\z.exez.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ShellHost.exeShellHost.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\csrss.execsrss.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ZeroTier_One.msi3⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File richard.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File newww.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\vilta.exevilta.exe3⤵
-
-
-
C:\Users\Admin\Pictures\svchost.exeC:\Users\Admin\Pictures\svchost.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\66E1D82A4F66D7EF\66E1D82A4F66D7EF.exeC:\Users\Admin\AppData\Roaming\66E1D82A4F66D7EF\66E1D82A4F66D7EF.exe1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\66E1D82A4F66D7EF\66E1D82A4F66D7EF.exeC:\Users\Admin\AppData\Roaming\66E1D82A4F66D7EF\66E1D82A4F66D7EF.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 9856 -ip 98561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8700 -ip 87001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6920 -ip 69201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5976 -ip 59761⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8492 -ip 84921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 9724 -ip 97241⤵
-
C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exeC:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 9244 -ip 92441⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000013c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000158 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000148 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000258 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000298 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000c4 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000013c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000012c 000000841⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000023c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000b8 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000160 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000b8 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000b8 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000150 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000154 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000154 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000194 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000160 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000188 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000174 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000013c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000017c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000144 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000017c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000017c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000174 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000194 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000b8 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000154 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000c4 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000174 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000188 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000158 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000188 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000150 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000c4 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000c4 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000028c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000001cc 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000158 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000194 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000a8 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000158 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000158 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000013c 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000144 000000841⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000001c0 000000841⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
eServiceHost.exe
FnHotkeyUtility.exe
yAeRuTlGfKjf
Chrome_History
ga[1].js
1_240630109.exe
2_240651390.exe
365VPN32.exe
3_240660234.exe
4_240666578.exe
6_240675125.exe
History
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
Log.log
SMPCSetup.exe
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_dufjvxcl.bwj.ps1
02.08.2022.exe
02.08.2022.exe
02.08.2022.exe
NAMUVPN32.exe
NAMUVPN7.exe
mic-off-corner-small.jpg
mic-on-corner-small.jpg
_isdecmp.dll
_setup64.tmp
_isdecmp.dll
background_9.5982.7702.8199_INSTALL.tmp
tftp.exe
system.conf
IMG001.exe
namu864.exe
sqlite3.dll
svchost.exe
synhost.exe
cache.txt
cache.txt
cache.txt
cache.txt
memory/468-692-0x0000028DE16E0000-0x0000028DE16FE000-memory.dmp
memory/468-693-0x0000028DE1830000-0x0000028DE1878000-memory.dmp
memory/1372-618-0x000001D9FDDA0000-0x000001D9FDDE8000-memory.dmp
memory/1372-617-0x000001D9FDD80000-0x000001D9FDD9E000-memory.dmp
memory/1372-2376-0x000001D9FDF50000-0x000001D9FDF5C000-memory.dmp
memory/1484-860-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-865-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-867-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-861-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-863-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-862-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-864-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-866-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-856-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1484-828-0x00007FF747500000-0x00007FF7475CC000-memory.dmp
memory/1988-615-0x000002345A900000-0x000002345A91E000-memory.dmp
memory/1988-616-0x000002345A920000-0x000002345A968000-memory.dmp
memory/2044-181-0x0000000140000000-0x00000001400050E8-memory.dmp
memory/2244-1357-0x0000000000200000-0x0000000000216000-memory.dmp
memory/2392-1386-0x000000006DEA0000-0x000000006E007000-memory.dmp
memory/2392-632-0x000000006DEA0000-0x000000006E007000-memory.dmp
memory/2392-4677-0x000000006DEA0000-0x000000006E007000-memory.dmp
memory/2392-3491-0x0000000005CA0000-0x0000000005CB2000-memory.dmp
memory/2840-1090-0x000001827D810000-0x000001827D820000-memory.dmp
memory/2840-608-0x000001827D7E0000-0x000001827D7FE000-memory.dmp
memory/2840-609-0x000001827F1A0000-0x000001827F1E8000-memory.dmp
memory/3096-691-0x0000012A1B1E0000-0x0000012A1B228000-memory.dmp
memory/3096-690-0x0000012A1B000000-0x0000012A1B01E000-memory.dmp
memory/3292-696-0x0000026ECB950000-0x0000026ECB96E000-memory.dmp
memory/3292-697-0x0000026EE5570000-0x0000026EE55B8000-memory.dmp
memory/3468-628-0x00000183D7EA0000-0x00000183D7EBE000-memory.dmp
memory/3468-629-0x00000183D7FF0000-0x00000183D8038000-memory.dmp
memory/3704-138-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-150-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-149-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-148-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-147-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-146-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-145-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-144-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-140-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3704-139-0x0000011AF0F50000-0x0000011AF0F51000-memory.dmp
memory/3772-1625-0x0000000010000000-0x000000001000A000-memory.dmp
memory/3980-1623-0x0000000000400000-0x0000000000487000-memory.dmp
memory/3980-4679-0x0000000000400000-0x0000000000487000-memory.dmp
memory/3980-703-0x0000000000400000-0x0000000000487000-memory.dmp
memory/4200-607-0x0000000070180000-0x000000007022A000-memory.dmp
memory/4320-300-0x00000218083B0000-0x00000218083D2000-memory.dmp
memory/4320-613-0x0000021808390000-0x00000218083AE000-memory.dmp
memory/4320-614-0x0000021808500000-0x0000021808548000-memory.dmp
memory/4364-2607-0x0000000005480000-0x000000000548A000-memory.dmp
memory/4364-2495-0x0000000000A40000-0x0000000000B22000-memory.dmp
memory/4364-2608-0x00000000056B0000-0x0000000005706000-memory.dmp
memory/4424-700-0x0000000000690000-0x0000000000767000-memory.dmp
memory/4424-401-0x0000000000690000-0x0000000000767000-memory.dmp
memory/4516-699-0x000001B2D0CD0000-0x000001B2D0D18000-memory.dmp
memory/4516-698-0x000001B2B7070000-0x000001B2B708E000-memory.dmp
memory/4616-428-0x0000000000690000-0x0000000000767000-memory.dmp
memory/4616-328-0x0000000000690000-0x0000000000767000-memory.dmp
memory/4620-548-0x0000000070180000-0x000000007022A000-memory.dmp
memory/4700-2592-0x0000011D244E0000-0x0000011D244E8000-memory.dmp
memory/4700-2540-0x0000011D244D0000-0x0000011D244DC000-memory.dmp
memory/4700-230-0x0000000140000000-0x00000001400050E8-memory.dmp
memory/4700-694-0x0000011D0A740000-0x0000011D0A75E000-memory.dmp
memory/4700-695-0x0000011D24210000-0x0000011D24258000-memory.dmp
memory/4752-4675-0x0000000000400000-0x0000000000487000-memory.dmp
memory/4752-1622-0x0000000000400000-0x0000000000487000-memory.dmp
memory/4752-702-0x0000000000400000-0x0000000000487000-memory.dmp
memory/4948-620-0x000001F4E3160000-0x000001F4E31A8000-memory.dmp
memory/4948-619-0x000001F4C96F0000-0x000001F4C970E000-memory.dmp
memory/5036-688-0x0000000000820000-0x00000000008FC000-memory.dmp
memory/5036-399-0x0000000000820000-0x00000000008FC000-memory.dmp
memory/5208-266-0x0000000000AE0000-0x0000000000AEA000-memory.dmp
memory/5208-497-0x0000000005350000-0x00000000053EC000-memory.dmp
memory/5212-411-0x0000000000940000-0x0000000000CA3000-memory.dmp
memory/5472-800-0x0000000005350000-0x000000000536E000-memory.dmp
memory/5472-708-0x0000000004FE0000-0x00000000051A2000-memory.dmp
memory/5472-662-0x00000000003A0000-0x0000000000624000-memory.dmp
memory/5472-4021-0x0000000006DF0000-0x0000000006E02000-memory.dmp
memory/5472-1025-0x0000000005D10000-0x000000000618E000-memory.dmp
memory/5472-735-0x00000000057E0000-0x0000000005D0C000-memory.dmp
memory/5472-718-0x0000000005230000-0x00000000052A6000-memory.dmp
memory/5472-717-0x0000000004F60000-0x0000000004FB0000-memory.dmp
memory/5472-4019-0x00000000053B0000-0x00000000053BA000-memory.dmp
memory/5536-612-0x000001F0CB270000-0x000001F0CB2B8000-memory.dmp
memory/5536-611-0x000001F0B1680000-0x000001F0B169E000-memory.dmp
memory/5576-261-0x0000000000520000-0x0000000000538000-memory.dmp
memory/6044-689-0x0000000000400000-0x000000000040E000-memory.dmp
memory/6224-414-0x00000000006E0000-0x000000000073E000-memory.dmp
memory/6224-534-0x00000000050E0000-0x0000000005146000-memory.dmp
memory/6224-439-0x0000000005010000-0x00000000050A2000-memory.dmp
memory/6224-427-0x0000000005520000-0x0000000005AC4000-memory.dmp
memory/6224-1790-0x0000000006270000-0x00000000062AC000-memory.dmp
memory/6224-1431-0x0000000005D30000-0x0000000005D42000-memory.dmp
memory/6340-678-0x00000000009A0000-0x0000000000D03000-memory.dmp
memory/6364-622-0x0000000000870000-0x0000000000CA7000-memory.dmp
memory/6532-753-0x0000000000400000-0x0000000000414000-memory.dmp
memory/6532-447-0x0000000000400000-0x0000000000414000-memory.dmp
memory/6580-754-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6580-4686-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6580-495-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6636-496-0x0000000140000000-0x0000000140005228-memory.dmp
memory/6740-684-0x0000000000400000-0x0000000000428000-memory.dmp
memory/6780-590-0x0000000000820000-0x00000000008FC000-memory.dmp
memory/6828-1624-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6828-4672-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6828-704-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6880-2575-0x00000000062C0000-0x00000000062DE000-memory.dmp
memory/6880-683-0x0000000005590000-0x0000000005BB8000-memory.dmp
memory/6880-2628-0x00000000063C0000-0x000000000640C000-memory.dmp
memory/6880-1076-0x0000000005DC0000-0x0000000005E26000-memory.dmp
memory/6880-1093-0x0000000005EA0000-0x00000000061F4000-memory.dmp
memory/6880-661-0x0000000002D70000-0x0000000002DA6000-memory.dmp
memory/6880-1075-0x0000000005D20000-0x0000000005D42000-memory.dmp
memory/6996-1621-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6996-701-0x0000000000400000-0x0000000000487000-memory.dmp
memory/6996-4673-0x0000000000400000-0x0000000000487000-memory.dmp
memory/7144-598-0x00000000008A0000-0x00000000008B9000-memory.dmp
memory/7164-4667-0x0000000000400000-0x0000000000487000-memory.dmp
memory/7164-630-0x0000000000400000-0x0000000000487000-memory.dmp
memory/7164-1385-0x0000000000400000-0x0000000000487000-memory.dmp
memory/7732-758-0x00000000009C0000-0x0000000000AA9000-memory.dmp
memory/7784-2158-0x0000000000400000-0x0000000000487000-memory.dmp
memory/7784-4668-0x0000000000400000-0x0000000000487000-memory.dmp
memory/7784-767-0x0000000000400000-0x0000000000487000-memory.dmp
memory/7800-778-0x00000159A20A0000-0x00000159A22D0000-memory.dmp
memory/7800-1197-0x00000159A2870000-0x00000159A287E000-memory.dmp
memory/8556-4401-0x0000000005E60000-0x00000000061B4000-memory.dmp
memory/9244-4420-0x0000000069F70000-0x000000006A0DA000-memory.dmp
memory/9244-3064-0x0000000069F70000-0x000000006A0DA000-memory.dmp
memory/9384-4018-0x00007FF9CBD20000-0x00007FF9CBF53000-memory.dmp
memory/9384-4681-0x00007FF9CBD20000-0x00007FF9CBF53000-memory.dmp
memory/9856-3166-0x0000000000400000-0x000000000040D000-memory.dmp
memory/10532-4341-0x00007FF6B12F0000-0x00007FF6B130C000-memory.dmp