qakbot | 2e774230640debe52a0ff7f4aa9ccdc5b2b271192492b773b41b827ef41f4674

Resubmissions

25-05-2020 16:07

200525-ddd1ggsbdj 10

Analysis

max time kernel
1031s
max time network
1799s
platform
windows7_x64
resource
win7v200430
submitted
25-05-2020 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kaufvertrag_648230011400_21052020.vbs
Size

36.3MB
MD5

86d77e33adbd08281bde87c925026219
SHA1

62393354f0037c8f56ebc33606b43ee71de3079b
SHA256

bfca22cf77eb45df30fa08fa3995163683633919c30332d60d015eaf23544194
SHA512

d1a0dc4c63e8e309366eb48bf9d124a546dfa689636880d968b80ddb92548f3d21043cd2fe22b8ea5673648c0ee1ee0c533323062579cd5bd7960a4a6e694368

Score

10^/10

qakbot notset spx125 1588850855 1590138228 banker cryptone evasion packer persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

spx125

Campaign

1590138228

190.75.168.108:2078

93.114.192.211:2222

47.39.76.74:443

182.56.134.44:995

24.201.79.208:2078

207.246.71.122:443

50.244.112.10:443

88.207.27.144:443

72.204.242.138:443

72.204.242.138:2078

72.204.242.138:990

76.187.8.160:443

220.135.31.140:2222

86.126.97.183:2222

86.126.112.153:995

68.49.120.179:443

101.108.125.44:443

203.101.163.187:443

197.165.212.10:443

207.255.161.8:2078

Extracted

Family

qakbot

Botnet

notset

Campaign

1588850855

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

24.110.14.40:443

96.35.170.82:2222

50.78.93.74:443

76.187.97.98:2222

202.77.4.37:443

89.38.171.30:443

66.26.160.37:443

58.108.188.231:443

67.83.54.76:2222

102.41.116.213:995

78.96.245.58:443

176.193.14.165:2222

73.1.68.242:443

96.37.113.36:443

98.22.234.245:443

76.15.41.32:443

95.77.235.132:0

24.226.137.154:443

24.99.180.247:443

24.43.22.220:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

CryptOne packer 23 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe	cryptone
\Users\Admin\AppData\Local\Temp\PicturesViewer.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe	cryptone
\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe	cryptone
C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe	cryptone

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

3 1016 WScript.exe

flow	pid	process
3	1016	WScript.exe

Executes dropped EXE 11 IoCs

Processes:

PicturesViewer.exePicturesViewer.exeoovgku.exeoovgku.exePicturesViewer.exeoovgku.exeoovgku.exegzsimndyjihsrmcsgwxdsyceehqpeq.exeoovgku.exeoovgku.exeoovgku.exe

pid	process
464	PicturesViewer.exe
976	PicturesViewer.exe
1296	oovgku.exe
1596	oovgku.exe
1484	PicturesViewer.exe
1676	oovgku.exe
316	oovgku.exe
1956	gzsimndyjihsrmcsgwxdsyceehqpeq.exe
1652	oovgku.exe
1532	oovgku.exe
1332	oovgku.exe

Loads dropped DLL 9 IoCs

Processes:

PicturesViewer.exePicturesViewer.exeexplorer.exe

pid	process
464	PicturesViewer.exe
464	PicturesViewer.exe
464	PicturesViewer.exe
1484	PicturesViewer.exe
1580	explorer.exe
1580	explorer.exe
1580	explorer.exe
1580	explorer.exe
1580	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\zmcqct = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Wnreo\\oovgku.exe\""	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1584 schtasks.exe

pid	process
1584	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab312388000000000200000000001066000000010000200000008e6b66e95ea528b716694ff3cbbd9d40fb6cdb8ad823e8b4bbaba3ce7bc5f36c000000000e8000000002000020000000905cd1103a896dcaaba4ca8f17df4f61c45064af2a7380e866da1fe640414cb190000000b6e5b454bc5108bbb0e49440d19721b6442d83f7b875f5c44d1d37da9c3f13d0321d1c3ffb9b696b46941c3e376666b0734b62a852589b9123ef622500627e6fc8264b96a0c39b038c9cd2f5612716aae7884a1c2f5fca4eb36dfefa3d5c1e4e5350de16502f5319ec25179ae6fe069e7d6e7cfa857c74635ad03c18888c28a55d41f606c4b67344e1ecb53ccd56b2614000000044008d0fc402f1845020bb850354f03fc83cc74b9f27b7743fe4e768afc71a2c7a988db99b39b02e9318551ac18f64cd9acb7e24de191daadb5887b6025c96d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E95F1531-9EB4-11EA-818A-DE6ED157E5B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab31238800000000020000000000106600000001000020000000bc93e1c5c71f4d68d837b468d9ef3871d015f18effdfe8aa4150ca0076cde7a4000000000e80000000020000200000005ef80d8f4150e9af1702cf38f02f7f78a738ed70d1417576030139626a746307200000009230e50956897cbcd12c17028a7cb4199061dd4a0e0a84e4b116c7f49048cf1a40000000477be4fe72f3168522c884e9c021c492abf6ed6eee7a2b03055caed385a3e40437b1da1bf7b7438b6750a821dc1db190e3bfb059ab13da0cd5eb16e2d2269f65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3001e2b6c132d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

PicturesViewer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PicturesViewer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PicturesViewer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PicturesViewer.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEping.exe

pid process

728 PING.EXE
1732 ping.exe

pid	process
728	PING.EXE
1732	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

PicturesViewer.exePicturesViewer.exeoovgku.exeoovgku.exeexplorer.exePicturesViewer.exeoovgku.exeoovgku.exegzsimndyjihsrmcsgwxdsyceehqpeq.exeoovgku.exeoovgku.exeoovgku.exeexplorer.exeexplorer.exetaskhost.exeDwm.exeDllHost.exeExplorer.EXE

pid	process
464	PicturesViewer.exe
976	PicturesViewer.exe
976	PicturesViewer.exe
1296	oovgku.exe
1596	oovgku.exe
1596	oovgku.exe
1580	explorer.exe
1580	explorer.exe
1484	PicturesViewer.exe
1676	oovgku.exe
316	oovgku.exe
316	oovgku.exe
1580	explorer.exe
1580	explorer.exe
1956	gzsimndyjihsrmcsgwxdsyceehqpeq.exe
1652	oovgku.exe
1532	oovgku.exe
1332	oovgku.exe
1332	oovgku.exe
1028	explorer.exe
1928	explorer.exe
1164	taskhost.exe
1272	Dwm.exe
784	DllHost.exe
1336	Explorer.EXE
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

oovgku.exeoovgku.exeexplorer.exe

pid process

1296 oovgku.exe
1532 oovgku.exe
1028 explorer.exe
1028 explorer.exe
1028 explorer.exe
1028 explorer.exe
1028 explorer.exe

pid	process
1296	oovgku.exe
1532	oovgku.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Explorer.EXEexplorer.exe

description	pid	process
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeManageVolumePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE

Suspicious use of FindShellTrayWindow 47 IoCs

Processes:

chrome.exeiexplore.exefirefox.exe

pid	process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
2788	iexplore.exe
2788	iexplore.exe
2868	firefox.exe
2868	firefox.exe
2868	firefox.exe

Suspicious use of SendNotifyMessage 43 IoCs

Processes:

chrome.exefirefox.exe

pid	process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
2868	firefox.exe
2868	firefox.exe
2868	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2788	iexplore.exe
2788	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2788	iexplore.exe
2788	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exePicturesViewer.exeoovgku.exetaskeng.exePicturesViewer.exe

description	pid	process	target process
PID 1016 wrote to memory of 464	1016	WScript.exe	PicturesViewer.exe
PID 1016 wrote to memory of 464	1016	WScript.exe	PicturesViewer.exe
PID 1016 wrote to memory of 464	1016	WScript.exe	PicturesViewer.exe
PID 1016 wrote to memory of 464	1016	WScript.exe	PicturesViewer.exe
PID 464 wrote to memory of 976	464	PicturesViewer.exe	PicturesViewer.exe
PID 464 wrote to memory of 976	464	PicturesViewer.exe	PicturesViewer.exe
PID 464 wrote to memory of 976	464	PicturesViewer.exe	PicturesViewer.exe
PID 464 wrote to memory of 976	464	PicturesViewer.exe	PicturesViewer.exe
PID 464 wrote to memory of 1296	464	PicturesViewer.exe	oovgku.exe
PID 464 wrote to memory of 1296	464	PicturesViewer.exe	oovgku.exe
PID 464 wrote to memory of 1296	464	PicturesViewer.exe	oovgku.exe
PID 464 wrote to memory of 1296	464	PicturesViewer.exe	oovgku.exe
PID 464 wrote to memory of 1584	464	PicturesViewer.exe	schtasks.exe
PID 464 wrote to memory of 1584	464	PicturesViewer.exe	schtasks.exe
PID 464 wrote to memory of 1584	464	PicturesViewer.exe	schtasks.exe
PID 464 wrote to memory of 1584	464	PicturesViewer.exe	schtasks.exe
PID 1296 wrote to memory of 1596	1296	oovgku.exe	oovgku.exe
PID 1296 wrote to memory of 1596	1296	oovgku.exe	oovgku.exe
PID 1296 wrote to memory of 1596	1296	oovgku.exe	oovgku.exe
PID 1296 wrote to memory of 1596	1296	oovgku.exe	oovgku.exe
PID 1296 wrote to memory of 1580	1296	oovgku.exe	explorer.exe
PID 1296 wrote to memory of 1580	1296	oovgku.exe	explorer.exe
PID 1296 wrote to memory of 1580	1296	oovgku.exe	explorer.exe
PID 1296 wrote to memory of 1580	1296	oovgku.exe	explorer.exe
PID 1296 wrote to memory of 1580	1296	oovgku.exe	explorer.exe
PID 1972 wrote to memory of 1484	1972	taskeng.exe	PicturesViewer.exe
PID 1972 wrote to memory of 1484	1972	taskeng.exe	PicturesViewer.exe
PID 1972 wrote to memory of 1484	1972	taskeng.exe	PicturesViewer.exe
PID 1972 wrote to memory of 1484	1972	taskeng.exe	PicturesViewer.exe
PID 1484 wrote to memory of 664	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 664	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 664	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 664	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1232	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1232	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1232	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1232	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1332	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1332	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1332	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1332	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 436	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 436	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 436	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 436	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1756	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1756	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1756	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1756	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1028	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1028	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1028	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1028	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1780	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1780	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1780	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1780	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 584	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 584	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 584	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 584	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1384	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1384	1484	PicturesViewer.exe	reg.exe
PID 1484 wrote to memory of 1384	1484	PicturesViewer.exe	reg.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Kaufvertrag_648230011400_21052020.vbs"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:976
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1596
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1580
      - C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe
        
        "C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe" /W
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1956
      - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe" /W
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1652
      - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1532
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1332
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1028
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        
        PID:2036
        
        C:\Windows\system32\ping.exe
        
        C:\Windows\system32\ping.exe -t 127.0.0.1
        9⤵
        Runs ping.exe
        
        PID:1732
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c "rmdir /S /Q "C:\Users\Admin\EmailStorage_DJRWGDLZ-Admin_1590430698""
        10⤵
        
        PID:1596
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c rmdir /S /Q "C:\Users\Admin\EmailStorage_DJRWGDLZ-Admin_1590430698"
        10⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1928
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" http://a.strandsglobal.com/redir_chrome.html
        9⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1576
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=81.0.4044.129 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7fef756bd28,0x7fef756bd38,0x7fef756bd48
        10⤵
        
        PID:1732
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1988 --on-initialized-event-handle=372 --parent-handle=376 /prefetch:6
        10⤵
        
        PID:1104
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1120 --ignored=" --type=renderer " /prefetch:2
        10⤵
        
        PID:1304
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1296 /prefetch:8
        10⤵
        
        PID:1912
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1
        10⤵
        
        PID:1040
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
        10⤵
        
        PID:1672
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2436 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2040
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2524 --ignored=" --type=renderer " /prefetch:2
        10⤵
        
        PID:1992
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=820 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:848
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
        10⤵
        
        PID:1300
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2656 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2316
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2768 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2360
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2648 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2408
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2764 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2456
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
        10⤵
        
        PID:2504
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
        10⤵
        
        PID:2624
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=3892 /prefetch:8
        10⤵
        
        PID:2608
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4012 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2732
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3112 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2812
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4000 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2896
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3476 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:3040
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
        10⤵
        
        PID:2144
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=2504 /prefetch:8
        10⤵
        
        PID:2780
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" https://en.wikipedia.org/wiki/Google_Chrome
        9⤵
        
        PID:2528
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=81.0.4044.129 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7fef756bd28,0x7fef756bd38,0x7fef756bd48
        10⤵
        
        PID:2564
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" http://a.strandsglobal.com/redir_ff.html
        9⤵
        
        PID:2664
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" http://a.strandsglobal.com/redir_ff.html
        10⤵
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2868
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.0.173046202\2017778248" -parentBuildID 20200403170909 -prefsHandle 1184 -prefMapHandle 1176 -prefsLen 1 -prefMapSize 219627 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1276 gpu
        11⤵
        
        PID:2368
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.3.1758841169\741188648" -childID 1 -isForBrowser -prefsHandle 1740 -prefMapHandle 1736 -prefsLen 122 -prefMapSize 219627 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1752 tab
        11⤵
        
        PID:2984
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.13.1838609176\696642752" -childID 2 -isForBrowser -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 162 -prefMapSize 219627 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 2004 tab
        11⤵
        
        PID:2548
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.mozilla.org/en-US/firefox/new/
        9⤵
        
        PID:2792
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.mozilla.org/en-US/firefox/new/
        10⤵
        Checks processor information in registry
        
        PID:2804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://a.strandsglobal.com/redir_ie.html
        9⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:209935 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://a.strandsglobal.com/redir_ie.html
        9⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C start microsoft-edge:http://a.strandsglobal.com/redir_ie.html
        9⤵
        
        PID:2360
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nnctjjzkc /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I nnctjjzkc" /SC ONCE /Z /ST 18:11 /ET 18:23
      4⤵
      Creates scheduled task(s)
      PID:1584

C:\Windows\system32\taskeng.exe
taskeng.exe {0964705B-0BED-46D5-AC7B-D7AD2C981500} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
  C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /I nnctjjzkc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:664
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
    3⤵
    PID:1232
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:1332
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
    3⤵
    PID:436
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:1756
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
    3⤵
    PID:1028
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:1780
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
    3⤵
    PID:584
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo" /d "0"
    3⤵
    PID:1384
- - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:316
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe"
    3⤵
    PID:1080
  - - C:\Windows\system32\PING.EXE
      ping.exe -n 6 127.0.0.1
      4⤵
      Runs ping.exe
      PID:728
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /DELETE /F /TN nnctjjzkc
    3⤵
    PID:1524

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3028

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12828557171773602869-1471060997-430253134-1596381525-18238905301354321910-1607829069"
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04

MD5
a6add99e7adc77406e7689f8b80e4fa2

SHA1
7a479b73c4e02ef8ed443549980bf347d8c1eb71

SHA256
36dcf30f83fce3f1e4ae5948b638104959be0b45eb741bde1b36f7987afe2d35

SHA512
9446ccd278569bd6de8dbd98cfc50c5b22cd27d9191927580ef93450abdc2c950e246a99c8c265ad708f800d2fb45b14b19f9bb2697f077c840f45e32624b431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04

MD5
e1268d863f2b72b0307ac552be6733f7

SHA1
c3bc7899cdb4e6f9761d2cb7323d29faf982407d

SHA256
c27051a60230241f5bfa8c60d1951f8309486e3ac3b865a7cec83defa2e0ef7b

SHA512
4d80e06352051485bbff5e494f99c63c7d9abf7c2fe11d8dbc740565bbb18e232dc4d0d4d8661985f423d294fe1523ba70ca3d1690bc437271936b753a522e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
fddc8b916274e00fbd1ba369a284e2a8

SHA1
54e20db0026dd6b8e4de684277b39fbea521f27a

SHA256
74b0bcf5007a8f57cdb0307db99a035708a1f29b03b8ff16be61da84e8d634dd

SHA512
74d6cc368680d33cfd610b27d22e6b4622c8fa3393120d0ea899b67ff52cdc22b25e476b6995380b9f994a24592b78d2a0ea0c5e072ba1ffc27ec3c3c7813c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
fddc8b916274e00fbd1ba369a284e2a8

SHA1
54e20db0026dd6b8e4de684277b39fbea521f27a

SHA256
74b0bcf5007a8f57cdb0307db99a035708a1f29b03b8ff16be61da84e8d634dd

SHA512
74d6cc368680d33cfd610b27d22e6b4622c8fa3393120d0ea899b67ff52cdc22b25e476b6995380b9f994a24592b78d2a0ea0c5e072ba1ffc27ec3c3c7813c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
7f11184832e5ae3a79262973d3308b1f

SHA1
4174c9fbb8322f2a97bbf14558ecd1c55acf14c5

SHA256
6dfae415e2c750b3e3f9287eb08abd316ca6f4b418e7fd12b5f55a8f42cd09da

SHA512
a4ac2f909c1a4c41c317d29cf77d830441c8d30bf7838ecf17959ff85afc78cb7f043e2c8e8f0c4f358afc2a014ac55607acfa5dbb41fe24aded01e7137e7a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
66c5a59ffe4f42e21dcb0275e4526cb1

SHA1
f74c25aa225d369c48e952d14332fac015270ed7

SHA256
5591d12bba029eb75eb1281d9e129e1e0a257293338ad730dd3e29a562686f6a

SHA512
6342959fbd07b3cd5b34b4f4860bcc22bb705b89783dffb81d61e11392099ea9d7bfc652e90a99c462365030dcb2c281f4d9bc2f5893d0de20dff916e6fc9561

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
952959297e0e226ef68279e836afd2eb

SHA1
2ba8060130b738ef8e1c049066b117e918e922c3

SHA256
31d275339198458a43d371096ac29929767ce55db4a8b4b3b746aac0be33d973

SHA512
3358dba544d874cb04b0ff11988a16aadce354a75d9e9c85d4de817d67957f8be101203ae5afc1fb8f20adfb44fcf863bf4cfa337c566508a96ee3a3712ab7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G6PZ2T8A\redir_ie[1].htm

MD5
7333e66ff3acc3216d168801903f388f

SHA1
be1214886897a929ac09239494d99a082a763e45

SHA256
54032aab22cd297d5915b12777e2676c7d4c359c63c77b37a80d3cc8c0137ebf

SHA512
cc2ce9534045b4c9a38491d8f905c46e0c06d9068e67c8d8022c5a08a174c2245aee467d86d06bb71b3d68941747785c9ef70746f188b48e7fb5320975650766

Download Submit
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FX9OQE3D.txt

MD5
cc884f3e86535ed1bab46bdb3ed395e8

SHA1
e9bc6f497bb34c260b77f39d0fb7f56750c4f133

SHA256
abc1a57f6ad96c4f17bdbaadb1b2b1c05f88fa85f234002821d37974f22c3136

SHA512
9778d695f336a10659f4db0486a1c2830613919e16b0639af35342bd35c6105101e82b998a74ac508791135bcd9c13f7b6c20177bb6d5d7fd4185a32bea9bb34

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FZCNWO0D.txt

MD5
a1a8653e7a58dc0c24dba1b77e66d8e6

SHA1
b9ec05bea76cbf7b2f5d57995bbdda3ab51a9b49

SHA256
9aac2251218271ce39631b01b682e3935925890b736e0b18b627963d4f3bd8c7

SHA512
d93d05e5428bfa544fe9a5b362167e25d4a73ee4b33c12e89871e0b4eb6b7bf1b58a052a2b4482a6cffd464eaed36b575c0f7fadd32cb618915209a6bf5b566a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MZMJTIKY.txt

MD5
dd5edb9fbcc6daa34b552a8285311203

SHA1
ab90663990213e123cc021c2fde38a926c451319

SHA256
916b92258fc27453f1b184b8f8a67fc1d1a946ac2e96d4bc807b70079df32de5

SHA512
953e26c2e9975ef0199bcd9d45ca560214e910fd96285e62a8b795768104028209548c4f189ec2d3d3a38458f337ad6272455294494174e05335f78cfacf6b60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZYLHVNFW.txt

MD5
bfc29738f3780a976cb3642504866c98

SHA1
71d2d105f379101d328a09d3ec7fe4020086ea22

SHA256
78ce9bb526aef7fac2b5cb93b13ca03b377d46b937ef38c967edd5c4e4d93076

SHA512
6578ef811868bea5b62b7c89e0120a77d77a844a87449305d2a5786be034b3a6e8123515015b88ecf31298429e3b7f5522496a59393137b925b309ffe374c157

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\gzdpgjwp.obd

MD5
50722a9d6a19a9e9a8402f6b20e7c973

SHA1
2ce5428452546a9df2b28c395d5d64b90778d1b1

SHA256
eacc8ee1085c450b8bbfc0382b3529b62fecc9aae2b8d037db40eb410e674716

SHA512
e511bfbe24a0914e7487db996a4bf2858257ea4e7b0557e9c7678b7199495795fec987040fccce9a76b2879bf1e9b0b1205d385537771fd78ee2236688c7b577

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.dat

MD5
f1c3a3368446e2e809a304d4729cf7ee

SHA1
15fcd7ea6cbf665f98a9b423e75fe643cfd3c984

SHA256
775dff9157f459c27ccc8b6030e7b63aabc4ebaa822be088e63a30c714724a7c

SHA512
72d2b3c6391b774e2692467895b0b43eb176345777e1c612af360c1dcc026b67e46b047bad88d06fbc4d4bedffd66fd298af5e7eb94dcbe8648c1ff22f1fb16c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.dat

MD5
176e2cc247be6665c6c8889796706c2b

SHA1
07e5fccd4a34c413cefcd7e9bd8a0f33020dfb77

SHA256
9b913e94487ea271ba9eed1a6cdd5c75136ecfa2eaf02b16b69fe31d7063281d

SHA512
0ef2d273c97fa00df11dc343304aa81f6b961ca97ec5f9b411d58ed542003f72cc15619196705f0e4c1ce345147be83e024d80845461fab011c2348a32f531b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.dat

MD5
88478a7b6c759fe21edd26a2cf8284af

SHA1
205fcba2b428b2facdec8d10a03c2c834d8de1a0

SHA256
73387baeb30381bf1ae60bfe45852d80a790ff0cce49f18ac497cc6b67b89563

SHA512
723cf9feec53d26029eea41133fadd205869ec63f9fa4de75c1b4ece5863058d2b3601ae2466c5a5457aee9a1f841cd2af86dd83b751d86ae2f8e29be6da30c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.dat

MD5
a5cc1aa12ea1079839050cec92d8988a

SHA1
e92b2208fd148896e1ca4a7995e7110e320d9bde

SHA256
7689f4c0430f1715ca2c1e5e08bd87e1a3ea7002d2d663d04df980ee423d1a30

SHA512
f1adce3a348ceb4675827d014cb2831962cfe0fd8a2848ffa908ad6271fb54e83154a5ea76d320ac5dea2f6a831b03da6c633db5f9778fb258f2dcfb4116e4b4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
C:\Users\Admin\EmailStorage_DJRWGDLZ-Admin_1590430698\COLLEC~1.TXT

MD5
aa3fa4543d8e5cf587c3cfcaab317195

SHA1
3da3536c655e0821433b91676745d174e8bb652c

SHA256
c2897dc3ce0219722f44513150461212b1d972af3944bae304b0a67481320330

SHA512
50299bbdc6c2503e2d59a26e6ebbc9e69b465a96103c2553ea70a75a04ade329ef9c8e229a35673222d6e2d24ca4ae79a4e9b313b89d628d4a733b3b06043684

Download Submit
C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_1576_YBPJDMVDDKFFLPDH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

MD5
c8f1fdd8dd3724f89cef6d9ea9ec85fd

SHA1
30d5e006337e17b512ff5ed878cc1beb1664abb0

SHA256
7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

SHA512
0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

Download Submit
\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe

MD5
04bbc495cee780ecc40678cff2f3b8fa

SHA1
86073b457548fc5936bc9a41755248e421376ba5

SHA256
6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

SHA512
b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

Download Submit
memory/316-18-0x0000000002200000-0x0000000002211000-memory.dmp

Filesize
68KB

Download
memory/784-917-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/784-1103-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/784-915-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/784-914-0x0000000002500000-0x0000000002508000-memory.dmp

Filesize
32KB

Download
memory/784-912-0x0000000002200000-0x0000000002208000-memory.dmp

Filesize
32KB

Download
memory/848-164-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/976-5-0x0000000002300000-0x0000000002311000-memory.dmp

Filesize
68KB

Download
memory/1016-1-0x0000000003090000-0x0000000003094000-memory.dmp

Filesize
16KB

Download
memory/1028-33-0x00000000029B0000-0x00000000029E2000-memory.dmp

Filesize
200KB

Download
memory/1028-41-0x0000000000D40000-0x0000000000D72000-memory.dmp

Filesize
200KB

Download
memory/1028-34-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

Filesize
200KB

Download
memory/1028-36-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

Filesize
200KB

Download
memory/1028-38-0x0000000002A10000-0x0000000002A42000-memory.dmp

Filesize
200KB

Download
memory/1040-103-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/1296-12-0x0000000000390000-0x00000000003CA000-memory.dmp

Filesize
232KB

Download
memory/1300-181-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-183-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-202-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-201-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-200-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-199-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-198-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-197-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-196-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-195-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-203-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-210-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-194-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-193-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-192-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-209-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-190-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-189-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-188-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-187-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-186-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-185-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-184-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-182-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-180-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-179-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-178-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-177-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-176-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-175-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-174-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-173-0x0000000009F10000-0x0000000009F21000-memory.dmp

Filesize
68KB

Download
memory/1300-216-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-208-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-214-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-213-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-212-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-211-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-344-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-191-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-215-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-207-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-206-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-205-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-204-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-172-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-167-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/1300-171-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1304-97-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1304-100-0x0000000077800000-0x0000000077801000-memory.dmp

Filesize
4KB

Download
memory/1304-98-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/1332-29-0x0000000002340000-0x0000000002351000-memory.dmp

Filesize
68KB

Download
memory/1532-42-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Filesize
64KB

Download
memory/1532-82-0x00000000029C0000-0x0000000002A40000-memory.dmp

Filesize
512KB

Download
memory/1532-83-0x0000000000C60000-0x0000000000C80000-memory.dmp

Filesize
128KB

Download
memory/1532-80-0x0000000000B50000-0x0000000000B70000-memory.dmp

Filesize
128KB

Download
memory/1532-60-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Filesize
384KB

Download
memory/1532-54-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/1532-30-0x0000000000370000-0x00000000003AA000-memory.dmp

Filesize
232KB

Download
memory/1532-78-0x0000000000B50000-0x0000000000B60000-memory.dmp

Filesize
64KB

Download
memory/1532-48-0x0000000000AF0000-0x0000000000B00000-memory.dmp

Filesize
64KB

Download
memory/1576-224-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-225-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-222-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-232-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-233-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-234-0x000000001CDD0000-0x000000001CDF3000-memory.dmp

Filesize
140KB

Download
memory/1576-235-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-236-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-237-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-226-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-228-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-223-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-231-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-221-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-220-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-229-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-218-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1596-11-0x00000000022E0000-0x00000000022F1000-memory.dmp

Filesize
68KB

Download
memory/1672-139-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-124-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-158-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-157-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-156-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-155-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-154-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-153-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-152-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-151-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-150-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-149-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-148-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-147-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-146-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-145-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-144-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-143-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-142-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-141-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-140-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-138-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-137-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-136-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-135-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-134-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-133-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-132-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-131-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-130-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-129-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-128-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-125-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-126-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-123-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-122-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-106-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/1672-127-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-121-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-113-0x000005E900040000-0x000005E900041000-memory.dmp

Filesize
4KB

Download
memory/1672-115-0x00000000080F0000-0x0000000008101000-memory.dmp

Filesize
68KB

Download
memory/1672-116-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-117-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-118-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-119-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-120-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1992-161-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2040-111-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2144-677-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-709-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-643-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2144-675-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-676-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-706-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-695-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-694-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-693-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-692-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-691-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-690-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-689-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-688-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-687-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-686-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-685-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-684-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-683-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-682-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-681-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-680-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-679-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-678-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-652-0x0000000009BE0000-0x0000000009BF1000-memory.dmp

Filesize
68KB

Download
memory/2144-651-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-653-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-674-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-673-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-672-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-671-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-670-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-669-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-668-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-667-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-666-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-665-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-664-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-663-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-662-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-661-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-660-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-659-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-658-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-657-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-656-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-655-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-654-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2316-239-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2360-242-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2408-245-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2456-248-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2504-272-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-305-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-251-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2504-260-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-261-0x0000000009F40000-0x0000000009F51000-memory.dmp

Filesize
68KB

Download
memory/2504-263-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-264-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-265-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-266-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-267-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-268-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-269-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-270-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-271-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-273-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-274-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-275-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-276-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-277-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-278-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-279-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-280-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-281-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-282-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-283-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-284-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-285-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-286-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-287-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-288-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-289-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-290-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-291-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-292-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-293-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-294-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-295-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-296-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-297-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-298-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-299-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-300-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-301-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-302-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-303-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-304-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-353-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-354-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-312-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-311-0x0000000009E40000-0x0000000009E51000-memory.dmp

Filesize
68KB

Download
memory/2624-310-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-314-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-315-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-316-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-317-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-318-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-319-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-320-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-321-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-322-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-323-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-324-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-325-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-328-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-257-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2624-329-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-330-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-331-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-357-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-356-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-355-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-313-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-327-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-352-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-351-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-350-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-349-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-348-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-347-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-326-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-343-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-342-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-341-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-340-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-339-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-338-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-337-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-336-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-335-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-334-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-333-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-332-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2732-612-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2792-616-0x0000000000060000-0x0000000000070000-memory.dmp

Filesize
64KB

Download
memory/2812-617-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2896-621-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/3040-633-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download