Kaufvertrag_3103078_21052020.zip

General
Target

Kaufvertrag_648230011400_21052020.vbs

Filesize

36MB

Completed

25-05-2020 16:37

Score
10 /10
MD5

86d77e33adbd08281bde87c925026219

SHA1

62393354f0037c8f56ebc33606b43ee71de3079b

SHA256

bfca22cf77eb45df30fa08fa3995163683633919c30332d60d015eaf23544194

Malware Config

Extracted

Family qakbot
Botnet spx125
Campaign 1590138228
C2

190.75.168.108:2078

93.114.192.211:2222

47.39.76.74:443

182.56.134.44:995

24.201.79.208:2078

207.246.71.122:443

50.244.112.10:443

88.207.27.144:443

72.204.242.138:443

72.204.242.138:2078

72.204.242.138:990

76.187.8.160:443

220.135.31.140:2222

86.126.97.183:2222

86.126.112.153:995

68.49.120.179:443

101.108.125.44:443

203.101.163.187:443

197.165.212.10:443

207.255.161.8:2078

207.255.161.8:995

98.243.187.85:443

207.255.161.8:32103

108.227.161.27:995

189.140.112.184:443

172.78.87.180:443

71.205.158.156:443

72.28.255.159:995

68.39.177.147:995

73.94.229.115:443

108.58.9.238:995

1.40.42.4:443

74.33.69.208:443

66.222.88.126:995

72.204.242.138:53

24.99.180.247:443

47.152.210.233:443

24.10.42.174:443

140.82.21.191:443

72.190.101.70:443

78.188.109.130:443

211.24.72.253:443

70.124.29.226:443

71.241.247.189:443

216.201.162.158:443

24.43.22.220:993

46.214.139.81:443

49.191.9.180:995

75.183.135.48:443

47.153.115.154:995

Extracted

Family qakbot
Botnet notset
Campaign 1588850855
Credentials

Protocol: ftp

Host: 192.185.5.208

Port: 21

Username: logger@dustinkeeling.com

Password: NxdkxAp4dUsY

Protocol: ftp

Host: 162.241.218.118

Port: 21

Username: logger@misterexterior.com

Password: EcOV0DyGVgVN

Protocol: ftp

Host: 69.89.31.139

Port: 21

Username: cpanel@vivekharris-architects.com

Password: fcR7OvyLrMW6!

Protocol: ftp

Host: 169.207.67.14

Port: 21

Username: cpanel@dovetailsolar.com

Password: eQyicNLzzqPN

C2

24.110.14.40:443

96.35.170.82:2222

50.78.93.74:443

76.187.97.98:2222

202.77.4.37:443

89.38.171.30:443

66.26.160.37:443

58.108.188.231:443

67.83.54.76:2222

102.41.116.213:995

78.96.245.58:443

176.193.14.165:2222

73.1.68.242:443

96.37.113.36:443

98.22.234.245:443

76.15.41.32:443

95.77.235.132:0

24.226.137.154:443

24.99.180.247:443

24.43.22.220:995

41.228.192.103:443

96.37.137.42:443

97.78.107.14:443

70.120.149.173:443

96.41.93.96:443

207.255.94.98:443

63.230.2.205:2083

216.152.7.12:443

97.96.51.117:443

72.240.124.46:443

173.3.132.17:995

178.236.108.131:443

47.138.200.85:443

207.255.161.8:443

75.81.25.223:995

100.38.123.22:443

84.117.176.32:443

80.14.209.42:2222

67.165.206.193:995

47.153.115.154:443

104.36.135.227:443

173.173.68.41:443

86.126.50.168:21

100.40.48.96:443

47.205.231.60:443

216.201.162.158:443

108.185.108.124:443

47.202.98.230:443

68.174.15.223:443

47.17.70.45:443

Signatures 21

Filter: none

Defense Evasion
Discovery
Persistence
  • Qakbot/Qbot

    Description

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Turns off Windows Defender SpyNet reporting

    Tags

    TTPs

    Disabling Security ToolsModify Registry
  • Windows security bypass

    TTPs

    Disabling Security ToolsModify Registry
  • CryptOne packer

    Description

    Detects CryptOne packer defined in NCC blogpost.

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x00040000000131b4-0.datcryptone
    behavioral1/files/0x00040000000131b4-2.datcryptone
    behavioral1/files/0x00040000000131b4-3.datcryptone
    behavioral1/files/0x00040000000131b4-4.datcryptone
    behavioral1/files/0x00030000000131ba-6.datcryptone
    behavioral1/files/0x00030000000131ba-7.datcryptone
    behavioral1/files/0x00030000000131ba-8.datcryptone
    behavioral1/files/0x00030000000131ba-9.datcryptone
    behavioral1/files/0x00030000000131ba-10.datcryptone
    behavioral1/files/0x00040000000131b4-14.datcryptone
    behavioral1/files/0x00030000000131ba-15.datcryptone
    behavioral1/files/0x00030000000131ba-16.datcryptone
    behavioral1/files/0x00030000000131ba-17.datcryptone
    behavioral1/files/0x00130000000131bb-19.datcryptone
    behavioral1/files/0x00130000000131bb-20.datcryptone
    behavioral1/files/0x00130000000131bb-21.datcryptone
    behavioral1/files/0x00030000000131ba-22.datcryptone
    behavioral1/files/0x00030000000131ba-23.datcryptone
    behavioral1/files/0x00030000000131ba-24.datcryptone
    behavioral1/files/0x00030000000131ba-25.datcryptone
    behavioral1/files/0x00030000000131ba-26.datcryptone
    behavioral1/files/0x00030000000131ba-27.datcryptone
    behavioral1/files/0x00030000000131ba-28.datcryptone
  • Blocklisted process makes network request
    WScript.exe

    Reported IOCs

    flowpidprocess
    31016WScript.exe
  • Executes dropped EXE
    PicturesViewer.exePicturesViewer.exeoovgku.exeoovgku.exePicturesViewer.exeoovgku.exeoovgku.exegzsimndyjihsrmcsgwxdsyceehqpeq.exeoovgku.exeoovgku.exeoovgku.exe

    Reported IOCs

    pidprocess
    464PicturesViewer.exe
    976PicturesViewer.exe
    1296oovgku.exe
    1596oovgku.exe
    1484PicturesViewer.exe
    1676oovgku.exe
    316oovgku.exe
    1956gzsimndyjihsrmcsgwxdsyceehqpeq.exe
    1652oovgku.exe
    1532oovgku.exe
    1332oovgku.exe
  • Loads dropped DLL
    PicturesViewer.exePicturesViewer.exeexplorer.exe

    Reported IOCs

    pidprocess
    464PicturesViewer.exe
    464PicturesViewer.exe
    464PicturesViewer.exe
    1484PicturesViewer.exe
    1580explorer.exe
    1580explorer.exe
    1580explorer.exe
    1580explorer.exe
    1580explorer.exe
  • Adds Run key to start application
    explorer.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\zmcqct = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Wnreo\\oovgku.exe\""explorer.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Checks processor information in registry
    firefox.exefirefox.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0firefox.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signaturefirefox.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0firefox.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signaturefirefox.exe
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1584schtasks.exe
  • Modifies Internet Explorer settings
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (data)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab312388000000000200000000001066000000010000200000008e6b66e95ea528b716694ff3cbbd9d40fb6cdb8ad823e8b4bbaba3ce7bc5f36c000000000e8000000002000020000000905cd1103a896dcaaba4ca8f17df4f61c45064af2a7380e866da1fe640414cb190000000b6e5b454bc5108bbb0e49440d19721b6442d83f7b875f5c44d1d37da9c3f13d0321d1c3ffb9b696b46941c3e376666b0734b62a852589b9123ef622500627e6fc8264b96a0c39b038c9cd2f5612716aae7884a1c2f5fca4eb36dfefa3d5c1e4e5350de16502f5319ec25179ae6fe069e7d6e7cfa857c74635ad03c18888c28a55d41f606c4b67344e1ecb53ccd56b2614000000044008d0fc402f1845020bb850354f03fc83cc74b9f27b7743fe4e768afc71a2c7a988db99b39b02e9318551ac18f64cd9acb7e24de191daadb5887b6025c96d7iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbariexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoomiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E95F1531-9EB4-11EA-818A-DE6ED157E5B6} = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetupiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowseriexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliFormsiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab31238800000000020000000000106600000001000020000000bc93e1c5c71f4d68d837b468d9ef3871d015f18effdfe8aa4150ca0076cde7a4000000000e80000000020000200000005ef80d8f4150e9af1702cf38f02f7f78a738ed70d1417576030139626a746307200000009230e50956897cbcd12c17028a7cb4199061dd4a0e0a84e4b116c7f49048cf1a40000000477be4fe72f3168522c884e9c021c492abf6ed6eee7a2b03055caed385a3e40437b1da1bf7b7438b6750a821dc1db190e3bfb059ab13da0cd5eb16e2d2269f65iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMiciexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3001e2b6c132d601iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPUiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgainiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000iexplore.exe
  • Modifies data under HKEY_USERS
    PicturesViewer.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\PicturesViewer.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"PicturesViewer.exe
    Set value (int)\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"PicturesViewer.exe
  • Runs ping.exe
    PING.EXEping.exe

    TTPs

    Remote System Discovery

    Reported IOCs

    pidprocess
    728PING.EXE
    1732ping.exe
  • Suspicious behavior: EnumeratesProcesses
    PicturesViewer.exePicturesViewer.exeoovgku.exeoovgku.exeexplorer.exePicturesViewer.exeoovgku.exeoovgku.exegzsimndyjihsrmcsgwxdsyceehqpeq.exeoovgku.exeoovgku.exeoovgku.exeexplorer.exeexplorer.exetaskhost.exeDwm.exeDllHost.exeExplorer.EXE

    Reported IOCs

    pidprocess
    464PicturesViewer.exe
    976PicturesViewer.exe
    976PicturesViewer.exe
    1296oovgku.exe
    1596oovgku.exe
    1596oovgku.exe
    1580explorer.exe
    1580explorer.exe
    1484PicturesViewer.exe
    1676oovgku.exe
    316oovgku.exe
    316oovgku.exe
    1580explorer.exe
    1580explorer.exe
    1956gzsimndyjihsrmcsgwxdsyceehqpeq.exe
    1652oovgku.exe
    1532oovgku.exe
    1332oovgku.exe
    1332oovgku.exe
    1028explorer.exe
    1928explorer.exe
    1164taskhost.exe
    1272Dwm.exe
    784DllHost.exe
    1336Explorer.EXE
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
    1928explorer.exe
  • Suspicious behavior: MapViewOfSection
    oovgku.exeoovgku.exeexplorer.exe

    Reported IOCs

    pidprocess
    1296oovgku.exe
    1532oovgku.exe
    1028explorer.exe
    1028explorer.exe
    1028explorer.exe
    1028explorer.exe
    1028explorer.exe
  • Suspicious use of AdjustPrivilegeToken
    Explorer.EXEexplorer.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeShutdownPrivilege1336Explorer.EXE
    Token: SeManageVolumePrivilege1532explorer.exe
    Token: SeShutdownPrivilege1336Explorer.EXE
    Token: SeShutdownPrivilege1336Explorer.EXE
    Token: SeShutdownPrivilege1336Explorer.EXE
    Token: SeShutdownPrivilege1336Explorer.EXE
    Token: SeShutdownPrivilege1336Explorer.EXE
    Token: SeShutdownPrivilege1336Explorer.EXE
  • Suspicious use of FindShellTrayWindow
    chrome.exeiexplore.exefirefox.exe

    Reported IOCs

    pidprocess
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    2788iexplore.exe
    2788iexplore.exe
    2868firefox.exe
    2868firefox.exe
    2868firefox.exe
  • Suspicious use of SendNotifyMessage
    chrome.exefirefox.exe

    Reported IOCs

    pidprocess
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    1576chrome.exe
    2868firefox.exe
    2868firefox.exe
    2868firefox.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

    Reported IOCs

    pidprocess
    2788iexplore.exe
    2788iexplore.exe
    2192IEXPLORE.EXE
    2192IEXPLORE.EXE
    2192IEXPLORE.EXE
    2192IEXPLORE.EXE
    2788iexplore.exe
    2788iexplore.exe
    2976IEXPLORE.EXE
    2976IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    WScript.exePicturesViewer.exeoovgku.exetaskeng.exePicturesViewer.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1016 wrote to memory of 4641016WScript.exePicturesViewer.exe
    PID 1016 wrote to memory of 4641016WScript.exePicturesViewer.exe
    PID 1016 wrote to memory of 4641016WScript.exePicturesViewer.exe
    PID 1016 wrote to memory of 4641016WScript.exePicturesViewer.exe
    PID 464 wrote to memory of 976464PicturesViewer.exePicturesViewer.exe
    PID 464 wrote to memory of 976464PicturesViewer.exePicturesViewer.exe
    PID 464 wrote to memory of 976464PicturesViewer.exePicturesViewer.exe
    PID 464 wrote to memory of 976464PicturesViewer.exePicturesViewer.exe
    PID 464 wrote to memory of 1296464PicturesViewer.exeoovgku.exe
    PID 464 wrote to memory of 1296464PicturesViewer.exeoovgku.exe
    PID 464 wrote to memory of 1296464PicturesViewer.exeoovgku.exe
    PID 464 wrote to memory of 1296464PicturesViewer.exeoovgku.exe
    PID 464 wrote to memory of 1584464PicturesViewer.exeschtasks.exe
    PID 464 wrote to memory of 1584464PicturesViewer.exeschtasks.exe
    PID 464 wrote to memory of 1584464PicturesViewer.exeschtasks.exe
    PID 464 wrote to memory of 1584464PicturesViewer.exeschtasks.exe
    PID 1296 wrote to memory of 15961296oovgku.exeoovgku.exe
    PID 1296 wrote to memory of 15961296oovgku.exeoovgku.exe
    PID 1296 wrote to memory of 15961296oovgku.exeoovgku.exe
    PID 1296 wrote to memory of 15961296oovgku.exeoovgku.exe
    PID 1296 wrote to memory of 15801296oovgku.exeexplorer.exe
    PID 1296 wrote to memory of 15801296oovgku.exeexplorer.exe
    PID 1296 wrote to memory of 15801296oovgku.exeexplorer.exe
    PID 1296 wrote to memory of 15801296oovgku.exeexplorer.exe
    PID 1296 wrote to memory of 15801296oovgku.exeexplorer.exe
    PID 1972 wrote to memory of 14841972taskeng.exePicturesViewer.exe
    PID 1972 wrote to memory of 14841972taskeng.exePicturesViewer.exe
    PID 1972 wrote to memory of 14841972taskeng.exePicturesViewer.exe
    PID 1972 wrote to memory of 14841972taskeng.exePicturesViewer.exe
    PID 1484 wrote to memory of 6641484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 6641484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 6641484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 6641484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 12321484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 12321484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 12321484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 12321484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 13321484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 13321484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 13321484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 13321484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 4361484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 4361484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 4361484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 4361484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 17561484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 17561484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 17561484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 17561484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 10281484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 10281484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 10281484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 10281484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 17801484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 17801484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 17801484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 17801484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 5841484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 5841484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 5841484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 5841484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 13841484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 13841484PicturesViewer.exereg.exe
    PID 1484 wrote to memory of 13841484PicturesViewer.exereg.exe
Processes 80
  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    Suspicious behavior: EnumeratesProcesses
    PID:1164
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    Suspicious behavior: EnumeratesProcesses
    PID:1272
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:1336
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Kaufvertrag_648230011400_21052020.vbs"
      Blocklisted process makes network request
      Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
        C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        PID:464
        • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
          C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          PID:976
        • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious behavior: MapViewOfSection
          Suspicious use of WriteProcessMemory
          PID:1296
          • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
            Executes dropped EXE
            Suspicious behavior: EnumeratesProcesses
            PID:1596
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            Loads dropped DLL
            Adds Run key to start application
            Suspicious behavior: EnumeratesProcesses
            PID:1580
            • C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe
              "C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe" /W
              Executes dropped EXE
              Suspicious behavior: EnumeratesProcesses
              PID:1956
            • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe" /W
              Executes dropped EXE
              Suspicious behavior: EnumeratesProcesses
              PID:1652
            • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
              Executes dropped EXE
              Suspicious behavior: EnumeratesProcesses
              Suspicious behavior: MapViewOfSection
              PID:1532
              • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
                Executes dropped EXE
                Suspicious behavior: EnumeratesProcesses
                PID:1332
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                Suspicious behavior: EnumeratesProcesses
                Suspicious behavior: MapViewOfSection
                PID:1028
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  PID:1212
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  PID:2036
                  • C:\Windows\system32\ping.exe
                    C:\Windows\system32\ping.exe -t 127.0.0.1
                    Runs ping.exe
                    PID:1732
                    • C:\Windows\system32\cmd.exe
                      cmd.exe /c "rmdir /S /Q "C:\Users\Admin\EmailStorage_DJRWGDLZ-Admin_1590430698""
                      PID:1596
                    • C:\Windows\system32\cmd.exe
                      cmd.exe /c rmdir /S /Q "C:\Users\Admin\EmailStorage_DJRWGDLZ-Admin_1590430698"
                      PID:1380
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  Suspicious behavior: EnumeratesProcesses
                  PID:1928
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  PID:1552
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  Suspicious use of AdjustPrivilegeToken
                  PID:1532
                  • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" http://a.strandsglobal.com/redir_chrome.html
                    Suspicious use of FindShellTrayWindow
                    Suspicious use of SendNotifyMessage
                    PID:1576
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=81.0.4044.129 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7fef756bd28,0x7fef756bd38,0x7fef756bd48
                      PID:1732
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1988 --on-initialized-event-handle=372 --parent-handle=376 /prefetch:6
                      PID:1104
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1120 --ignored=" --type=renderer " /prefetch:2
                      PID:1304
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1296 /prefetch:8
                      PID:1912
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1
                      PID:1040
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
                      PID:1672
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2436 --ignored=" --type=renderer " /prefetch:8
                      PID:2040
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2524 --ignored=" --type=renderer " /prefetch:2
                      PID:1992
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=820 --ignored=" --type=renderer " /prefetch:8
                      PID:848
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
                      PID:1300
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2656 --ignored=" --type=renderer " /prefetch:8
                      PID:2316
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2768 --ignored=" --type=renderer " /prefetch:8
                      PID:2360
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2648 --ignored=" --type=renderer " /prefetch:8
                      PID:2408
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2764 --ignored=" --type=renderer " /prefetch:8
                      PID:2456
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
                      PID:2504
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
                      PID:2624
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=3892 /prefetch:8
                      PID:2608
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4012 --ignored=" --type=renderer " /prefetch:8
                      PID:2732
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3112 --ignored=" --type=renderer " /prefetch:8
                      PID:2812
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4000 --ignored=" --type=renderer " /prefetch:8
                      PID:2896
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3476 --ignored=" --type=renderer " /prefetch:8
                      PID:3040
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
                      PID:2144
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=2504 /prefetch:8
                      PID:2780
                  • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" https://en.wikipedia.org/wiki/Google_Chrome
                    PID:2528
                    • C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=81.0.4044.129 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7fef756bd28,0x7fef756bd38,0x7fef756bd48
                      PID:2564
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" http://a.strandsglobal.com/redir_ff.html
                    PID:2664
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" http://a.strandsglobal.com/redir_ff.html
                      Checks processor information in registry
                      Suspicious use of FindShellTrayWindow
                      Suspicious use of SendNotifyMessage
                      PID:2868
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.0.173046202\2017778248" -parentBuildID 20200403170909 -prefsHandle 1184 -prefMapHandle 1176 -prefsLen 1 -prefMapSize 219627 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1276 gpu
                        PID:2368
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.3.1758841169\741188648" -childID 1 -isForBrowser -prefsHandle 1740 -prefMapHandle 1736 -prefsLen 122 -prefMapSize 219627 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1752 tab
                        PID:2984
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.13.1838609176\696642752" -childID 2 -isForBrowser -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 162 -prefMapSize 219627 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 2004 tab
                        PID:2548
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.mozilla.org/en-US/firefox/new/
                    PID:2792
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.mozilla.org/en-US/firefox/new/
                      Checks processor information in registry
                      PID:2804
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" http://a.strandsglobal.com/redir_ie.html
                    Modifies Internet Explorer settings
                    Suspicious use of FindShellTrayWindow
                    Suspicious use of SetWindowsHookEx
                    PID:2788
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
                      Modifies Internet Explorer settings
                      Suspicious use of SetWindowsHookEx
                      PID:2192
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:209935 /prefetch:2
                      Modifies Internet Explorer settings
                      Suspicious use of SetWindowsHookEx
                      PID:2976
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" http://a.strandsglobal.com/redir_ie.html
                    PID:2712
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C start microsoft-edge:http://a.strandsglobal.com/redir_ie.html
                    PID:2360
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nnctjjzkc /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I nnctjjzkc" /SC ONCE /Z /ST 18:11 /ET 18:23
          Creates scheduled task(s)
          PID:1584
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {0964705B-0BED-46D5-AC7B-D7AD2C981500} S-1-5-18:NT AUTHORITY\System:Service:
    Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /I nnctjjzkc
      Executes dropped EXE
      Loads dropped DLL
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
        PID:664
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
        PID:1232
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
        PID:1332
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
        PID:436
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
        PID:1756
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
        PID:1028
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
        PID:1780
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
        PID:584
      • C:\Windows\system32\reg.exe
        C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo" /d "0"
        PID:1384
      • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        PID:1676
        • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          PID:316
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe"
        PID:1080
        • C:\Windows\system32\PING.EXE
          ping.exe -n 6 127.0.0.1
          Runs ping.exe
          PID:728
      • C:\Windows\system32\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /DELETE /F /TN nnctjjzkc
        PID:1524
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    Suspicious behavior: EnumeratesProcesses
    PID:784
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    PID:3028
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "12828557171773602869-1471060997-430253134-1596381525-18238905301354321910-1607829069"
    PID:2492
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04

                      MD5

                      a6add99e7adc77406e7689f8b80e4fa2

                      SHA1

                      7a479b73c4e02ef8ed443549980bf347d8c1eb71

                      SHA256

                      36dcf30f83fce3f1e4ae5948b638104959be0b45eb741bde1b36f7987afe2d35

                      SHA512

                      9446ccd278569bd6de8dbd98cfc50c5b22cd27d9191927580ef93450abdc2c950e246a99c8c265ad708f800d2fb45b14b19f9bb2697f077c840f45e32624b431

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04

                      MD5

                      e1268d863f2b72b0307ac552be6733f7

                      SHA1

                      c3bc7899cdb4e6f9761d2cb7323d29faf982407d

                      SHA256

                      c27051a60230241f5bfa8c60d1951f8309486e3ac3b865a7cec83defa2e0ef7b

                      SHA512

                      4d80e06352051485bbff5e494f99c63c7d9abf7c2fe11d8dbc740565bbb18e232dc4d0d4d8661985f423d294fe1523ba70ca3d1690bc437271936b753a522e17

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      MD5

                      fddc8b916274e00fbd1ba369a284e2a8

                      SHA1

                      54e20db0026dd6b8e4de684277b39fbea521f27a

                      SHA256

                      74b0bcf5007a8f57cdb0307db99a035708a1f29b03b8ff16be61da84e8d634dd

                      SHA512

                      74d6cc368680d33cfd610b27d22e6b4622c8fa3393120d0ea899b67ff52cdc22b25e476b6995380b9f994a24592b78d2a0ea0c5e072ba1ffc27ec3c3c7813c69

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      MD5

                      fddc8b916274e00fbd1ba369a284e2a8

                      SHA1

                      54e20db0026dd6b8e4de684277b39fbea521f27a

                      SHA256

                      74b0bcf5007a8f57cdb0307db99a035708a1f29b03b8ff16be61da84e8d634dd

                      SHA512

                      74d6cc368680d33cfd610b27d22e6b4622c8fa3393120d0ea899b67ff52cdc22b25e476b6995380b9f994a24592b78d2a0ea0c5e072ba1ffc27ec3c3c7813c69

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      MD5

                      7f11184832e5ae3a79262973d3308b1f

                      SHA1

                      4174c9fbb8322f2a97bbf14558ecd1c55acf14c5

                      SHA256

                      6dfae415e2c750b3e3f9287eb08abd316ca6f4b418e7fd12b5f55a8f42cd09da

                      SHA512

                      a4ac2f909c1a4c41c317d29cf77d830441c8d30bf7838ecf17959ff85afc78cb7f043e2c8e8f0c4f358afc2a014ac55607acfa5dbb41fe24aded01e7137e7a58

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      MD5

                      66c5a59ffe4f42e21dcb0275e4526cb1

                      SHA1

                      f74c25aa225d369c48e952d14332fac015270ed7

                      SHA256

                      5591d12bba029eb75eb1281d9e129e1e0a257293338ad730dd3e29a562686f6a

                      SHA512

                      6342959fbd07b3cd5b34b4f4860bcc22bb705b89783dffb81d61e11392099ea9d7bfc652e90a99c462365030dcb2c281f4d9bc2f5893d0de20dff916e6fc9561

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                      MD5

                      952959297e0e226ef68279e836afd2eb

                      SHA1

                      2ba8060130b738ef8e1c049066b117e918e922c3

                      SHA256

                      31d275339198458a43d371096ac29929767ce55db4a8b4b3b746aac0be33d973

                      SHA512

                      3358dba544d874cb04b0ff11988a16aadce354a75d9e9c85d4de817d67957f8be101203ae5afc1fb8f20adfb44fcf863bf4cfa337c566508a96ee3a3712ab7fe

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G6PZ2T8A\redir_ie[1].htm

                      MD5

                      7333e66ff3acc3216d168801903f388f

                      SHA1

                      be1214886897a929ac09239494d99a082a763e45

                      SHA256

                      54032aab22cd297d5915b12777e2676c7d4c359c63c77b37a80d3cc8c0137ebf

                      SHA512

                      cc2ce9534045b4c9a38491d8f905c46e0c06d9068e67c8d8022c5a08a174c2245aee467d86d06bb71b3d68941747785c9ef70746f188b48e7fb5320975650766

                    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FX9OQE3D.txt

                      MD5

                      cc884f3e86535ed1bab46bdb3ed395e8

                      SHA1

                      e9bc6f497bb34c260b77f39d0fb7f56750c4f133

                      SHA256

                      abc1a57f6ad96c4f17bdbaadb1b2b1c05f88fa85f234002821d37974f22c3136

                      SHA512

                      9778d695f336a10659f4db0486a1c2830613919e16b0639af35342bd35c6105101e82b998a74ac508791135bcd9c13f7b6c20177bb6d5d7fd4185a32bea9bb34

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FZCNWO0D.txt

                      MD5

                      a1a8653e7a58dc0c24dba1b77e66d8e6

                      SHA1

                      b9ec05bea76cbf7b2f5d57995bbdda3ab51a9b49

                      SHA256

                      9aac2251218271ce39631b01b682e3935925890b736e0b18b627963d4f3bd8c7

                      SHA512

                      d93d05e5428bfa544fe9a5b362167e25d4a73ee4b33c12e89871e0b4eb6b7bf1b58a052a2b4482a6cffd464eaed36b575c0f7fadd32cb618915209a6bf5b566a

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MZMJTIKY.txt

                      MD5

                      dd5edb9fbcc6daa34b552a8285311203

                      SHA1

                      ab90663990213e123cc021c2fde38a926c451319

                      SHA256

                      916b92258fc27453f1b184b8f8a67fc1d1a946ac2e96d4bc807b70079df32de5

                      SHA512

                      953e26c2e9975ef0199bcd9d45ca560214e910fd96285e62a8b795768104028209548c4f189ec2d3d3a38458f337ad6272455294494174e05335f78cfacf6b60

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZYLHVNFW.txt

                      MD5

                      bfc29738f3780a976cb3642504866c98

                      SHA1

                      71d2d105f379101d328a09d3ec7fe4020086ea22

                      SHA256

                      78ce9bb526aef7fac2b5cb93b13ca03b377d46b937ef38c967edd5c4e4d93076

                      SHA512

                      6578ef811868bea5b62b7c89e0120a77d77a844a87449305d2a5786be034b3a6e8123515015b88ecf31298429e3b7f5522496a59393137b925b309ffe374c157

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\gzdpgjwp.obd

                      MD5

                      50722a9d6a19a9e9a8402f6b20e7c973

                      SHA1

                      2ce5428452546a9df2b28c395d5d64b90778d1b1

                      SHA256

                      eacc8ee1085c450b8bbfc0382b3529b62fecc9aae2b8d037db40eb410e674716

                      SHA512

                      e511bfbe24a0914e7487db996a4bf2858257ea4e7b0557e9c7678b7199495795fec987040fccce9a76b2879bf1e9b0b1205d385537771fd78ee2236688c7b577

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.dat

                      MD5

                      f1c3a3368446e2e809a304d4729cf7ee

                      SHA1

                      15fcd7ea6cbf665f98a9b423e75fe643cfd3c984

                      SHA256

                      775dff9157f459c27ccc8b6030e7b63aabc4ebaa822be088e63a30c714724a7c

                      SHA512

                      72d2b3c6391b774e2692467895b0b43eb176345777e1c612af360c1dcc026b67e46b047bad88d06fbc4d4bedffd66fd298af5e7eb94dcbe8648c1ff22f1fb16c

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.dat

                      MD5

                      176e2cc247be6665c6c8889796706c2b

                      SHA1

                      07e5fccd4a34c413cefcd7e9bd8a0f33020dfb77

                      SHA256

                      9b913e94487ea271ba9eed1a6cdd5c75136ecfa2eaf02b16b69fe31d7063281d

                      SHA512

                      0ef2d273c97fa00df11dc343304aa81f6b961ca97ec5f9b411d58ed542003f72cc15619196705f0e4c1ce345147be83e024d80845461fab011c2348a32f531b2

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.dat

                      MD5

                      88478a7b6c759fe21edd26a2cf8284af

                      SHA1

                      205fcba2b428b2facdec8d10a03c2c834d8de1a0

                      SHA256

                      73387baeb30381bf1ae60bfe45852d80a790ff0cce49f18ac497cc6b67b89563

                      SHA512

                      723cf9feec53d26029eea41133fadd205869ec63f9fa4de75c1b4ece5863058d2b3601ae2466c5a5457aee9a1f841cd2af86dd83b751d86ae2f8e29be6da30c6

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.dat

                      MD5

                      a5cc1aa12ea1079839050cec92d8988a

                      SHA1

                      e92b2208fd148896e1ca4a7995e7110e320d9bde

                      SHA256

                      7689f4c0430f1715ca2c1e5e08bd87e1a3ea7002d2d663d04df980ee423d1a30

                      SHA512

                      f1adce3a348ceb4675827d014cb2831962cfe0fd8a2848ffa908ad6271fb54e83154a5ea76d320ac5dea2f6a831b03da6c633db5f9778fb258f2dcfb4116e4b4

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • C:\Users\Admin\EmailStorage_DJRWGDLZ-Admin_1590430698\COLLEC~1.TXT

                      MD5

                      aa3fa4543d8e5cf587c3cfcaab317195

                      SHA1

                      3da3536c655e0821433b91676745d174e8bb652c

                      SHA256

                      c2897dc3ce0219722f44513150461212b1d972af3944bae304b0a67481320330

                      SHA512

                      50299bbdc6c2503e2d59a26e6ebbc9e69b465a96103c2553ea70a75a04ade329ef9c8e229a35673222d6e2d24ca4ae79a4e9b313b89d628d4a733b3b06043684

                    • C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • \??\PIPE\samr

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\pipe\crashpad_1576_YBPJDMVDDKFFLPDH

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \Users\Admin\AppData\Local\Temp\PicturesViewer.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • \Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • \Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • \Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • \Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • \Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • \Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe

                      MD5

                      c8f1fdd8dd3724f89cef6d9ea9ec85fd

                      SHA1

                      30d5e006337e17b512ff5ed878cc1beb1664abb0

                      SHA256

                      7ceaaa2ae96ba6400a09c96ae63a472a6b54535833a8eb5a9bba1afa7645c571

                      SHA512

                      0dce8b7705707318f8c227e9a9fcf363884b20374c05f233217042f1272ca0921ea637ca435de56f618463cf00cd234cc006de47ac62112047425add28ea1a73

                    • \Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • \Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe

                      MD5

                      04bbc495cee780ecc40678cff2f3b8fa

                      SHA1

                      86073b457548fc5936bc9a41755248e421376ba5

                      SHA256

                      6a24293a7541b6cc3e689071ae0a65b322f00b007cd167340fa0c545a990bff8

                      SHA512

                      b51a0f044325d423638d4211e6fe35182361e40272e49440fa0080a9ddbb1d4b417e784842dc6365998f92a27d6cc55589c0d72c184ce1c79e3af7d75d426c7e

                    • memory/316-18-0x0000000002200000-0x0000000002211000-memory.dmp

                    • memory/784-917-0x00000000023C0000-0x00000000023C8000-memory.dmp

                    • memory/784-912-0x0000000002200000-0x0000000002208000-memory.dmp

                    • memory/784-1103-0x00000000023E0000-0x00000000023E8000-memory.dmp

                    • memory/784-915-0x00000000021D0000-0x00000000021D8000-memory.dmp

                    • memory/784-914-0x0000000002500000-0x0000000002508000-memory.dmp

                    • memory/848-164-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/976-5-0x0000000002300000-0x0000000002311000-memory.dmp

                    • memory/1016-1-0x0000000003090000-0x0000000003094000-memory.dmp

                    • memory/1028-38-0x0000000002A10000-0x0000000002A42000-memory.dmp

                    • memory/1028-41-0x0000000000D40000-0x0000000000D72000-memory.dmp

                    • memory/1028-36-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

                    • memory/1028-34-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

                    • memory/1028-33-0x00000000029B0000-0x00000000029E2000-memory.dmp

                    • memory/1040-103-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/1296-12-0x0000000000390000-0x00000000003CA000-memory.dmp

                    • memory/1300-344-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-188-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-197-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-189-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-190-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-191-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-192-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-193-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-194-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-195-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-196-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-167-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/1300-187-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-186-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-199-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-185-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-184-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-183-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-182-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-181-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-180-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-179-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-178-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-177-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-176-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-175-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-174-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-173-0x0000000009F10000-0x0000000009F21000-memory.dmp

                    • memory/1300-198-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-172-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-216-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-215-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-201-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-213-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-212-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-211-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-210-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-209-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-208-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-207-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-206-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-205-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-204-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-203-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-202-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-214-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-200-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1300-171-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1304-98-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/1304-97-0x0000000000060000-0x0000000000061000-memory.dmp

                    • memory/1304-100-0x0000000077800000-0x0000000077801000-memory.dmp

                    • memory/1332-29-0x0000000002340000-0x0000000002351000-memory.dmp

                    • memory/1532-42-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

                    • memory/1532-48-0x0000000000AF0000-0x0000000000B00000-memory.dmp

                    • memory/1532-30-0x0000000000370000-0x00000000003AA000-memory.dmp

                    • memory/1532-78-0x0000000000B50000-0x0000000000B60000-memory.dmp

                    • memory/1532-80-0x0000000000B50000-0x0000000000B70000-memory.dmp

                    • memory/1532-82-0x00000000029C0000-0x0000000002A40000-memory.dmp

                    • memory/1532-83-0x0000000000C60000-0x0000000000C80000-memory.dmp

                    • memory/1532-54-0x0000000000BB0000-0x0000000000C10000-memory.dmp

                    • memory/1532-60-0x0000000000AF0000-0x0000000000B50000-memory.dmp

                    • memory/1576-236-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-234-0x000000001CDD0000-0x000000001CDF3000-memory.dmp

                    • memory/1576-237-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-233-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-232-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-231-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-229-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-228-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-226-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-225-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-224-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-223-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-222-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-221-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-220-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-218-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1576-235-0x0000000020650000-0x0000000020661000-memory.dmp

                    • memory/1596-11-0x00000000022E0000-0x00000000022F1000-memory.dmp

                    • memory/1672-124-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-157-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-156-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-155-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-154-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-153-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-152-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-151-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-150-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-149-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-148-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-147-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-146-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-145-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-144-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-143-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-142-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-141-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-140-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-139-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-138-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-137-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-136-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-129-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-134-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-133-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-132-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-131-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-130-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-125-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-128-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-127-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-158-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-106-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/1672-123-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-113-0x000005E900040000-0x000005E900041000-memory.dmp

                    • memory/1672-115-0x00000000080F0000-0x0000000008101000-memory.dmp

                    • memory/1672-126-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-116-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-117-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-118-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-119-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-120-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-121-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-122-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1672-135-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/1992-161-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2040-111-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2144-706-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-694-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-693-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-692-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-691-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-690-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-689-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-688-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-687-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-686-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-685-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-684-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-683-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-682-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-681-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-680-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-679-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-678-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-677-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-676-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-675-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-674-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-673-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-672-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-671-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-695-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-669-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-668-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-667-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-666-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-665-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-664-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-663-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-662-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-709-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-660-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-659-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-658-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-657-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-656-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-655-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-654-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-653-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-652-0x0000000009BE0000-0x0000000009BF1000-memory.dmp

                    • memory/2144-651-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-643-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2144-661-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2144-670-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2316-239-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2360-242-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2408-245-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2456-248-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2504-305-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-251-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2504-260-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-261-0x0000000009F40000-0x0000000009F51000-memory.dmp

                    • memory/2504-263-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-264-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-265-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-266-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-267-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-268-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-269-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-270-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-271-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-272-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-273-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-274-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-275-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-276-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-277-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-279-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-280-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-281-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-282-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-283-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-284-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-285-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-286-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-287-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-288-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-289-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-290-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-291-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-293-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-294-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-304-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-295-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-296-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-297-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-298-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-299-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-300-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-301-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-302-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-303-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-292-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2504-278-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-310-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-311-0x0000000009E40000-0x0000000009E51000-memory.dmp

                    • memory/2624-312-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-313-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-314-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-315-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-316-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-317-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-318-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-319-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-323-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-321-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-325-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-326-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-327-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-357-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-356-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-355-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-354-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-353-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-352-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-351-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-350-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-349-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-348-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-328-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-324-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-320-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-343-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-342-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-341-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-340-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-339-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-338-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-337-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-336-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-335-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-334-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-333-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-332-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-331-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-330-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-329-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-347-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2624-257-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2624-322-0x0000000000080000-0x00000000000800B0-memory.dmp

                    • memory/2732-612-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2792-616-0x0000000000060000-0x0000000000070000-memory.dmp

                    • memory/2812-617-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/2896-621-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

                    • memory/3040-633-0x000000013FA00FC0-0x000000013FA01110-memory.dmp