Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    01-05-2021 09:11

General

  • Target

    pl.exe

  • Size

    3.2MB

  • MD5

    39aa0d91652356afdd65e3289b82b67b

  • SHA1

    de7121dfb707df0a201b7c392ae81c23d446a8fb

  • SHA256

    30cbdeeb6e9f920da716d45c2e8337c5f50de4483c760f9dfc8f232e3e9a7225

  • SHA512

    252811e664130b84f1fbac3567f6881bc48bba626a507ef2079b78a3b443b6806025abdfa20bef7e6bcb921bd6414677cfbb2790e664ad4372f2708de6b9ad8b

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://al-commandoz.com/upload/

http://antalya-belek.com/upload/

http://luxurysv.com/upload/

http://massagespijkenisse.com/upload/

http://rexgorellhondaevent.com/upload/

rc4.i32
rc4.i32

Extracted

Family

amadey

Version

2.16

C2

176.111.174.114/Hnq8vS/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 27 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • NTFS ADS 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
      PID:1880
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
      1⤵
        PID:2260
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2704
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2436
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2420
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2240
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1412
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1384
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1184
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1136
                    • C:\Users\Admin\AppData\Local\Temp\pl.exe
                      "C:\Users\Admin\AppData\Local\Temp\pl.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4048
                      • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                        "C:\Users\Admin\AppData\Local\Temp\agdsk.exe"
                        2⤵
                        • Executes dropped EXE
                        • Modifies system certificate store
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1048
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c taskkill /f /im chrome.exe
                          3⤵
                            PID:4812
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im chrome.exe
                              4⤵
                              • Kills process with taskkill
                              PID:4932
                        • C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe
                          "C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:1424
                        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                          "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1820
                          • C:\Users\Admin\AppData\Roaming\3768049.exe
                            "C:\Users\Admin\AppData\Roaming\3768049.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1596
                          • C:\Users\Admin\AppData\Roaming\5582669.exe
                            "C:\Users\Admin\AppData\Roaming\5582669.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:4424
                          • C:\Users\Admin\AppData\Roaming\4832196.exe
                            "C:\Users\Admin\AppData\Roaming\4832196.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4668
                          • C:\Users\Admin\AppData\Roaming\2153740.exe
                            "C:\Users\Admin\AppData\Roaming\2153740.exe"
                            3⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of WriteProcessMemory
                            PID:4228
                            • C:\ProgramData\Windows Host\Windows Host.exe
                              "C:\ProgramData\Windows Host\Windows Host.exe"
                              4⤵
                              • Executes dropped EXE
                              PID:4956
                        • C:\Users\Admin\AppData\Local\Temp\Files.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:2384
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:416
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              4⤵
                                PID:4868
                                • C:\Users\Admin\AppData\Local\Temp\bot.exe
                                  "C:\Users\Admin\AppData\Local\Temp\bot.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:5364
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im bot.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\bot.exe" & del C:\ProgramData\*.dll & exit
                                    6⤵
                                      PID:5780
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im bot.exe /f
                                        7⤵
                                        • Kills process with taskkill
                                        PID:5824
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        7⤵
                                        • Delays execution with timeout.exe
                                        PID:5860
                            • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                              "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                              2⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Suspicious use of WriteProcessMemory
                              PID:2460
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                3⤵
                                • Executes dropped EXE
                                PID:3408
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                3⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4748
                            • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                              "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: MapViewOfSection
                              PID:2864
                            • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                              "C:\Users\Admin\AppData\Local\Temp\wf-game.exe"
                              2⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1516
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
                                3⤵
                                • Loads dropped DLL
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2892
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                            1⤵
                            • Drops file in System32 directory
                            PID:1040
                            • C:\Users\Admin\AppData\Roaming\drrfhbr
                              C:\Users\Admin\AppData\Roaming\drrfhbr
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: MapViewOfSection
                              PID:6112
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                            1⤵
                              PID:1004
                            • \??\c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                              1⤵
                              • Suspicious use of SetThreadContext
                              • Modifies data under HKEY_USERS
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:592
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                2⤵
                                • Checks processor information in registry
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                PID:3484
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                2⤵
                                • Drops file in System32 directory
                                • Checks processor information in registry
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                PID:4704
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                              1⤵
                              • Drops file in Windows directory
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:4420
                            • C:\Windows\system32\browser_broker.exe
                              C:\Windows\system32\browser_broker.exe -Embedding
                              1⤵
                              • Modifies Internet Explorer settings
                              PID:4504
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                              1⤵
                              • Modifies registry class
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetWindowsHookEx
                              PID:4224
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              PID:2140
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:3912
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                              1⤵
                              • Modifies registry class
                              PID:1848
                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                              1⤵
                              • Modifies registry class
                              PID:5136
                            • C:\Users\Admin\AppData\Local\Temp\7891.exe
                              C:\Users\Admin\AppData\Local\Temp\7891.exe
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks processor information in registry
                              PID:5272
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c taskkill /im 7891.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7891.exe" & del C:\ProgramData\*.dll & exit
                                2⤵
                                  PID:5956
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /im 7891.exe /f
                                    3⤵
                                    • Kills process with taskkill
                                    PID:6032
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout /t 6
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:6084
                              • C:\Users\Admin\AppData\Local\Temp\89C8.exe
                                C:\Users\Admin\AppData\Local\Temp\89C8.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks processor information in registry
                                • NTFS ADS
                                PID:5480
                                • C:\ProgramData\S11H7W52F8YRM8GC.exe
                                  "C:\ProgramData\S11H7W52F8YRM8GC.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5884
                                  • C:\Users\Admin\AppData\Local\Temp\e90e419c61\blfte.exe
                                    "C:\Users\Admin\AppData\Local\Temp\e90e419c61\blfte.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:4636
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e90e419c61\
                                      4⤵
                                        PID:5356
                                        • C:\Windows\SysWOW64\reg.exe
                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e90e419c61\
                                          5⤵
                                            PID:5472
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\ProgramData\1a9f26b569d5df\cred.dll, Main
                                          4⤵
                                          • Blocklisted process makes network request
                                          • Loads dropped DLL
                                          PID:5480
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\ProgramData\1a9f26b569d5df\scr.dll, Main
                                          4⤵
                                          • Blocklisted process makes network request
                                          • Loads dropped DLL
                                          PID:5408
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im 89C8.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\89C8.exe" & del C:\ProgramData\*.dll & exit
                                      2⤵
                                        PID:5896
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /im 89C8.exe /f
                                          3⤵
                                          • Kills process with taskkill
                                          PID:5988
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /t 6
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:6064
                                    • C:\Users\Admin\AppData\Local\Temp\9497.exe
                                      C:\Users\Admin\AppData\Local\Temp\9497.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:5584
                                      • C:\Windows\SysWOW64\svchost.exe
                                        "C:\Windows\System32\svchost.exe"
                                        2⤵
                                          PID:5692
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c cmd < Piu.avi
                                          2⤵
                                            PID:5712
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd
                                              3⤵
                                                PID:5756
                                                • C:\Windows\SysWOW64\findstr.exe
                                                  findstr /V /R "^NUYpNfBsFBxTGTvnHdqdSuOnsUzMYZNWbJrVDQvoCoANuaupqscOfvjGyARTVPaGObcWQAURURNJFwsZNlMHDY$" Per.avi
                                                  4⤵
                                                    PID:5576
                                                  • C:\Users\Admin\AppData\Roaming\XXqDdcdKTXdhcWYapemnhuoBVaMpnhPgHrnEldtQNkWmRsOayvjaSerQPnIXJikFowFsnxoTY\Portarono.exe.com
                                                    Portarono.exe.com Q
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:5632
                                                    • C:\Users\Admin\AppData\Roaming\XXqDdcdKTXdhcWYapemnhuoBVaMpnhPgHrnEldtQNkWmRsOayvjaSerQPnIXJikFowFsnxoTY\Portarono.exe.com
                                                      C:\Users\Admin\AppData\Roaming\XXqDdcdKTXdhcWYapemnhuoBVaMpnhPgHrnEldtQNkWmRsOayvjaSerQPnIXJikFowFsnxoTY\Portarono.exe.com Q
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:5764
                                                      • C:\Users\Admin\AppData\Roaming\XXqDdcdKTXdhcWYapemnhuoBVaMpnhPgHrnEldtQNkWmRsOayvjaSerQPnIXJikFowFsnxoTY\Portarono.exe.com
                                                        C:\Users\Admin\AppData\Roaming\XXqDdcdKTXdhcWYapemnhuoBVaMpnhPgHrnEldtQNkWmRsOayvjaSerQPnIXJikFowFsnxoTY\Portarono.exe.com
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:6032
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 88
                                                          7⤵
                                                          • Program crash
                                                          PID:3656
                                                  • C:\Windows\SysWOW64\PING.EXE
                                                    ping 127.0.0.1 -n 30
                                                    4⤵
                                                    • Runs ping.exe
                                                    PID:5704
                                            • C:\Users\Admin\AppData\Local\Temp\A428.exe
                                              C:\Users\Admin\AppData\Local\Temp\A428.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:6120
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                2⤵
                                                  PID:5284
                                                  • C:\Users\Admin\AppData\Local\Temp\tempfl.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\tempfl.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:5464
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 1528
                                                      4⤵
                                                      • Drops file in Windows directory
                                                      • Program crash
                                                      PID:5972
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                  2⤵
                                                    PID:2544
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                    2⤵
                                                      PID:2596

                                                  Network

                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                  Persistence

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1060

                                                  Defense Evasion

                                                  Modify Registry

                                                  3
                                                  T1112

                                                  Install Root Certificate

                                                  1
                                                  T1130

                                                  Credential Access

                                                  Credentials in Files

                                                  4
                                                  T1081

                                                  Discovery

                                                  Query Registry

                                                  4
                                                  T1012

                                                  System Information Discovery

                                                  5
                                                  T1082

                                                  Peripheral Device Discovery

                                                  1
                                                  T1120

                                                  Remote System Discovery

                                                  1
                                                  T1018

                                                  Collection

                                                  Data from Local System

                                                  4
                                                  T1005

                                                  Command and Control

                                                  Web Service

                                                  1
                                                  T1102

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Program Files\install.dat
                                                    MD5

                                                    8a085e99545331964794b4f25bf7f12f

                                                    SHA1

                                                    d79c65cab23cab7c67bdda1014f80de97aa959d0

                                                    SHA256

                                                    f7b73e192374bca7f81f1dcc6ea4e484f36559ba636331d473d300b056c135b8

                                                    SHA512

                                                    b43022a5bfe3ef4a432c4f064c685c8a7336165249e235d52651ccdc53b5d35e6d4a7f2b7dea5043de0281d0f46a4c22fc36f13d98c9ad519ff45c30db365395

                                                  • C:\Program Files\install.dll
                                                    MD5

                                                    c6a2e4e23319dec9d56f8029ef834e83

                                                    SHA1

                                                    299e80473cbe56b596a2d4d38aea0aab46826167

                                                    SHA256

                                                    6ae4bd10f8bc7f3e5856c7f3571d165787f48d23f95ccfa823a5dab74f7fd554

                                                    SHA512

                                                    2a30529c2254ff481ab099032829d1b533d8bb6fca6a766d04e3febd6dc87ba34852eb7354ffc8d0ed7f584b5bff587e2b549c4f4c9150e98a2ff6a0f751438a

                                                  • C:\ProgramData\Windows Host\Windows Host.exe
                                                    MD5

                                                    4f1ce60ce9ff7e198d1021db5ae9bac3

                                                    SHA1

                                                    66b43ccbc0ba327e513b37ee16f5b13ff9701ed9

                                                    SHA256

                                                    159dfc8de99cfaba351e898c28d7695de99c98c5f90c632065c7e11718ec83b4

                                                    SHA512

                                                    9d0570e84ff21facfaed0ef6e7670e2b6e95e64ae6a3af07b00517656be3200a85e9a078618e0022ce05f6581fc66bf6000764584e54594d8961efedd228fe91

                                                  • C:\ProgramData\Windows Host\Windows Host.exe
                                                    MD5

                                                    4f1ce60ce9ff7e198d1021db5ae9bac3

                                                    SHA1

                                                    66b43ccbc0ba327e513b37ee16f5b13ff9701ed9

                                                    SHA256

                                                    159dfc8de99cfaba351e898c28d7695de99c98c5f90c632065c7e11718ec83b4

                                                    SHA512

                                                    9d0570e84ff21facfaed0ef6e7670e2b6e95e64ae6a3af07b00517656be3200a85e9a078618e0022ce05f6581fc66bf6000764584e54594d8961efedd228fe91

                                                  • C:\ProgramData\freebl3.dll
                                                    MD5

                                                    ef2834ac4ee7d6724f255beaf527e635

                                                    SHA1

                                                    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                                                    SHA256

                                                    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                                                    SHA512

                                                    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                                                  • C:\ProgramData\mozglue.dll
                                                    MD5

                                                    8f73c08a9660691143661bf7332c3c27

                                                    SHA1

                                                    37fa65dd737c50fda710fdbde89e51374d0c204a

                                                    SHA256

                                                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                    SHA512

                                                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                  • C:\ProgramData\mozglue.dll
                                                    MD5

                                                    8f73c08a9660691143661bf7332c3c27

                                                    SHA1

                                                    37fa65dd737c50fda710fdbde89e51374d0c204a

                                                    SHA256

                                                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                    SHA512

                                                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                  • C:\ProgramData\msvcp140.dll
                                                    MD5

                                                    109f0f02fd37c84bfc7508d4227d7ed5

                                                    SHA1

                                                    ef7420141bb15ac334d3964082361a460bfdb975

                                                    SHA256

                                                    334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                                                    SHA512

                                                    46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                                                  • C:\ProgramData\softokn3.dll
                                                    MD5

                                                    a2ee53de9167bf0d6c019303b7ca84e5

                                                    SHA1

                                                    2a3c737fa1157e8483815e98b666408a18c0db42

                                                    SHA256

                                                    43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

                                                    SHA512

                                                    45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

                                                  • C:\ProgramData\vcruntime140.dll
                                                    MD5

                                                    7587bf9cb4147022cd5681b015183046

                                                    SHA1

                                                    f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                                                    SHA256

                                                    c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                                                    SHA512

                                                    0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5TQ9Z63L\mozglue[1].dll
                                                    MD5

                                                    8f73c08a9660691143661bf7332c3c27

                                                    SHA1

                                                    37fa65dd737c50fda710fdbde89e51374d0c204a

                                                    SHA256

                                                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                    SHA512

                                                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDGLHSEM\freebl3[1].dll
                                                    MD5

                                                    ef2834ac4ee7d6724f255beaf527e635

                                                    SHA1

                                                    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                                                    SHA256

                                                    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                                                    SHA512

                                                    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GDGLHSEM\vcruntime140[1].dll
                                                    MD5

                                                    7587bf9cb4147022cd5681b015183046

                                                    SHA1

                                                    f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                                                    SHA256

                                                    c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                                                    SHA512

                                                    0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OVHLE5P6\softokn3[1].dll
                                                    MD5

                                                    a2ee53de9167bf0d6c019303b7ca84e5

                                                    SHA1

                                                    2a3c737fa1157e8483815e98b666408a18c0db42

                                                    SHA256

                                                    43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

                                                    SHA512

                                                    45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U0EJMF7X\sslamlssa[1].json
                                                    MD5

                                                    57716a910ec63b13929d356aea855127

                                                    SHA1

                                                    1bc0f915809b49ad0e99aec0b1ae9f02f19178c9

                                                    SHA256

                                                    abeaca186bf83832b07019a9e06c5efb32b81da1bddb27b1a51dd7c59c5bb01a

                                                    SHA512

                                                    4104d1b4564bb1373e164a8083ad55c7ef657c7d765e54a0d5cd32d85670005c15e6a66b579a7f7178562927f8073cf1d8a5cc81d83f1bd0490597af9ae2374b

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\1MILA0QW.cookie
                                                    MD5

                                                    ed511d2dac9e6f02f558599775b96f26

                                                    SHA1

                                                    d7fd432e69e7c9b24a8a7cd7e43ca22b0427a307

                                                    SHA256

                                                    19c7c6496e9dda88c05a2e9ecd09b7edbb65febd603cbcc2432f434330e56f1a

                                                    SHA512

                                                    3305dd804641deddabcbf62b06200ea98c68c5c5fb90fdcf6a44efaef41f4e8572a1026334eb2800bcb24e53edd623e592ebee23703dc3a4560b952e3bb7f4f4

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\6K5XALRH.cookie
                                                    MD5

                                                    873050c80df7bb7cb452fd667326946b

                                                    SHA1

                                                    135ab4cafc87590e072d6ab04a0034a1bbdc37c9

                                                    SHA256

                                                    35408309dfd3623dc54f67000cad3dc55d1ba1ed14edee7a1b2bbbd78f9b03bf

                                                    SHA512

                                                    d312db21ad4a4cba7a9e9788c35cfc76c2f8d2e223b4ac85607f0cce451ce4c1f9232cf10f7c152adfbfbb65af7c5cb09d4f9583349990447b929247e5194c50

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\OK8BGFJI.cookie
                                                    MD5

                                                    5e41e8a00dedcfe349de19108c14d024

                                                    SHA1

                                                    4bec6ecdc7a2b5670f380a70d1b54150bcf247d6

                                                    SHA256

                                                    c461c9e8ba36d6d373abe105e2f6350abb974fe6df43bb071181ac941eda2979

                                                    SHA512

                                                    e01d0a70ea67821a6387f6e0eb293db7bd14919358b42615011d945ba8d3f167ffaf1a7319ecb4cb101dc414eebe1f490014ffb6aba1fdd43c413b4adf5f0d6f

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                    MD5

                                                    88bbf3a38a847c38a6409fe7c4816ac7

                                                    SHA1

                                                    7985c2bccf3838b17edc3e7ee7b3d5679fc7814a

                                                    SHA256

                                                    c8beabb14fe299d581533bbdfbe03bf76dd9a3714f68d0234964de7e91b34707

                                                    SHA512

                                                    934ebf169f528392b68d55e19c027d59b79504164b32d05fc3899bd2a07bc5e5fca73a78133fc87f5afdaa1944a8c4c72dff308df6a6f50bdefdb05f64293b68

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
                                                    MD5

                                                    278f7f51813c69dac0c58f735d9a1f3c

                                                    SHA1

                                                    e9f08dd65f7a108ba34b5ad7e722a3ccd42f1a40

                                                    SHA256

                                                    334fb740d7f7c5d34e0641b5d6e7ffd74639173d2dc64dabcb79fd0a60f748df

                                                    SHA512

                                                    4ec9598b4ba6ade9cc17ec8c411437d765f100f8da6a6788130a8c45c270fd13fa7087fbafa346d9291ba955fb6ff6e001852b9250b55e0c84ba7eac17f0e084

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                    MD5

                                                    a537d5e6339e1b530438a26f62c94f44

                                                    SHA1

                                                    1518d602df7cb9e9ea0603bc59118fd88c0d1b4f

                                                    SHA256

                                                    fcd86a0a223c58a1128b4ae4bd604f2cb8395f3f123ae93ce70b2956c0bdc481

                                                    SHA512

                                                    0179eb93cc8fb2154fae43bdd52ec7634553790d55cf96a1aa3c8859915eb50b767b0e913609c94e8c39c17ebe3b414fc3c15b62ad4a5a0b2ce52ae9683d704f

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                    MD5

                                                    1a4c85ea4078829ed69cddd0ecbdad7b

                                                    SHA1

                                                    7aee120e1d4ec1ae9c7c091bca9cb27544481af1

                                                    SHA256

                                                    b998355114902ad79aefaa8fe3bf900e111871437cf2cd151f750efdb6bb060d

                                                    SHA512

                                                    cdc588555614af9c9b6c1bff5a78204f06d7fa58007ff308c780671fc9f7198c066f0f1ae44c288fb68734cfccac91b18e0ea819879d2df9da541bf8b5297c04

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
                                                    MD5

                                                    5ca87d587477dbdde257c41755e5f070

                                                    SHA1

                                                    107cec3f562a9ce2927e1ba0494b46b3a8418085

                                                    SHA256

                                                    712f6a314327d709c9c0b90f6dbdc8297376c0c4edff2b42da58837af4ea2fa8

                                                    SHA512

                                                    a1ab68aa273e105922bc8cf39654fef0dbe854461c2b93cc5a916a0f6144bdc21cb50653c08606bb9044661e5d9544a583d727a7795fa0b11729f952f488c28a

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                    MD5

                                                    f1428a0a846cfbcc25141b0a7f2adf3a

                                                    SHA1

                                                    31fc97202d53679733bd272aaaa87f213d22bd71

                                                    SHA256

                                                    6bbef86c72d10a5ada01b13033fbaabb84277f6bb10e1f4a2250fd94a20bc3cc

                                                    SHA512

                                                    512070e11ba18a2957890c0a72edf9bb6d9cac540aca738f0488193d7695aaed74338ff4d8448035d439ab4e992e792e43bc80e4e8e55ee925d45a23af9f97c6

                                                  • C:\Users\Admin\AppData\Local\Temp\7891.exe
                                                    MD5

                                                    014d5aaf5245c06639a070626f550de7

                                                    SHA1

                                                    f0fd2c1374b53701f4257514e92654d9461830ea

                                                    SHA256

                                                    c73bd7d91be43fc105926a1ca7072ac4bd724abbf80d78005c195ba2afb14f49

                                                    SHA512

                                                    b62891168810c777e05a1e4153183cdffd206a1c8fc8c74dcd6154f198aba68755907ef2367549728976931cb552a47c7a66060ad65fa916734fb11a489d1114

                                                  • C:\Users\Admin\AppData\Local\Temp\7891.exe
                                                    MD5

                                                    014d5aaf5245c06639a070626f550de7

                                                    SHA1

                                                    f0fd2c1374b53701f4257514e92654d9461830ea

                                                    SHA256

                                                    c73bd7d91be43fc105926a1ca7072ac4bd724abbf80d78005c195ba2afb14f49

                                                    SHA512

                                                    b62891168810c777e05a1e4153183cdffd206a1c8fc8c74dcd6154f198aba68755907ef2367549728976931cb552a47c7a66060ad65fa916734fb11a489d1114

                                                  • C:\Users\Admin\AppData\Local\Temp\89C8.exe
                                                    MD5

                                                    c7ce65e0f5eac2116405b05c6b641d9f

                                                    SHA1

                                                    ca3e218bfd6cdfcd8d941a8c22c1ad369d847e21

                                                    SHA256

                                                    e279de75e8e15351744ac34ce89e93ca955a14eae29dd06af995199e391d7aac

                                                    SHA512

                                                    894f7f99918d6614537f0e285a9b26d4ccc64301aa91abdc847cd4b595d2ca63280f8a1b83d9ac9ffcbcb0ad6b5feac97ded904b4ccf91d279c5a87110b954e0

                                                  • C:\Users\Admin\AppData\Local\Temp\89C8.exe
                                                    MD5

                                                    c7ce65e0f5eac2116405b05c6b641d9f

                                                    SHA1

                                                    ca3e218bfd6cdfcd8d941a8c22c1ad369d847e21

                                                    SHA256

                                                    e279de75e8e15351744ac34ce89e93ca955a14eae29dd06af995199e391d7aac

                                                    SHA512

                                                    894f7f99918d6614537f0e285a9b26d4ccc64301aa91abdc847cd4b595d2ca63280f8a1b83d9ac9ffcbcb0ad6b5feac97ded904b4ccf91d279c5a87110b954e0

                                                  • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                    MD5

                                                    7daefd2748b3d5e086f6f89cebdddffa

                                                    SHA1

                                                    303101cc6881bddec4d7cd630a3c5aa839d4e96f

                                                    SHA256

                                                    752615ba66d54828af3d107adcb312b91e7ac946823486876639ee6585258642

                                                    SHA512

                                                    73d0b7f7ff8166e06582ef2aa1badcc0673f70f71bfd16a81abeb25e59d9b63473c8600904aa67d0f6fefb8d69a763a1ca776250eb2e0d000dde12fcbec59fbf

                                                  • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                    MD5

                                                    7daefd2748b3d5e086f6f89cebdddffa

                                                    SHA1

                                                    303101cc6881bddec4d7cd630a3c5aa839d4e96f

                                                    SHA256

                                                    752615ba66d54828af3d107adcb312b91e7ac946823486876639ee6585258642

                                                    SHA512

                                                    73d0b7f7ff8166e06582ef2aa1badcc0673f70f71bfd16a81abeb25e59d9b63473c8600904aa67d0f6fefb8d69a763a1ca776250eb2e0d000dde12fcbec59fbf

                                                  • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                    MD5

                                                    f65601c2e9651a2cfbc8e7f989b92db3

                                                    SHA1

                                                    b2acb7395021cf46e2f0e1ba391134b6a76f0645

                                                    SHA256

                                                    b50c2849cc5097a8232445ee3ef3e620d2f45da2a327ad33643ad646ed3764a6

                                                    SHA512

                                                    077a9ec11784901d7052ce44a8c374ae26e519b78701f2905ff64d260c25740beff8ec9db5dab1e88932740671db073152b50d4c3937c1f03f29540e88e95070

                                                  • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                    MD5

                                                    f65601c2e9651a2cfbc8e7f989b92db3

                                                    SHA1

                                                    b2acb7395021cf46e2f0e1ba391134b6a76f0645

                                                    SHA256

                                                    b50c2849cc5097a8232445ee3ef3e620d2f45da2a327ad33643ad646ed3764a6

                                                    SHA512

                                                    077a9ec11784901d7052ce44a8c374ae26e519b78701f2905ff64d260c25740beff8ec9db5dab1e88932740671db073152b50d4c3937c1f03f29540e88e95070

                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                                                    MD5

                                                    5f4b9f9fd1783af38e2f8ddd73dbdf58

                                                    SHA1

                                                    baf058e4210d072965129ea8efd5316ccdc509ba

                                                    SHA256

                                                    29b4b58af00038e81865234f959923c5b085bb92b91e71dabd749d5411b9736c

                                                    SHA512

                                                    98bf7610fd580d653a76bd0f13f7ef494986de5dae97d4284b737f0244e3f71877dc708029261ce48a247affd8201e16650117a018fab08deaa09f2c34e10825

                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                                                    MD5

                                                    5f4b9f9fd1783af38e2f8ddd73dbdf58

                                                    SHA1

                                                    baf058e4210d072965129ea8efd5316ccdc509ba

                                                    SHA256

                                                    29b4b58af00038e81865234f959923c5b085bb92b91e71dabd749d5411b9736c

                                                    SHA512

                                                    98bf7610fd580d653a76bd0f13f7ef494986de5dae97d4284b737f0244e3f71877dc708029261ce48a247affd8201e16650117a018fab08deaa09f2c34e10825

                                                  • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                                                    MD5

                                                    b5f2d87b45462e684b0c85956cb2698f

                                                    SHA1

                                                    b1e226897d9092de2b3846418a833cd17ac5ec61

                                                    SHA256

                                                    0668e3bfbcd42f4eae4b8632dc07d72ff00ae77505707f048aa73365ea0dee3e

                                                    SHA512

                                                    d22fa0813d66841ef9a8135d828e9ca4993c3d854dc644c02b4af2b334a2032aa92db117b133dc93e8f3237e1f7417c12608b1e24137047569b75b06928fddd6

                                                  • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                                                    MD5

                                                    b5f2d87b45462e684b0c85956cb2698f

                                                    SHA1

                                                    b1e226897d9092de2b3846418a833cd17ac5ec61

                                                    SHA256

                                                    0668e3bfbcd42f4eae4b8632dc07d72ff00ae77505707f048aa73365ea0dee3e

                                                    SHA512

                                                    d22fa0813d66841ef9a8135d828e9ca4993c3d854dc644c02b4af2b334a2032aa92db117b133dc93e8f3237e1f7417c12608b1e24137047569b75b06928fddd6

                                                  • C:\Users\Admin\AppData\Local\Temp\bot.exe
                                                    MD5

                                                    6d982fa4f9b078255c1167e9889cea9b

                                                    SHA1

                                                    f94ec84e94f2db1467acd0c09af3e6d218182f64

                                                    SHA256

                                                    08f265523a5b4db4009f35c57c6f71dca1d0f6a8d00880d1853879158e98d5f0

                                                    SHA512

                                                    184b7171147a3782f13b472544ab9f553fc6dde07bff248feed8dce620763df15e738467da8b98c57b8d82208c4918fdec74bc334e8550d22d0e1975b8a96fe5

                                                  • C:\Users\Admin\AppData\Local\Temp\bot.exe
                                                    MD5

                                                    6d982fa4f9b078255c1167e9889cea9b

                                                    SHA1

                                                    f94ec84e94f2db1467acd0c09af3e6d218182f64

                                                    SHA256

                                                    08f265523a5b4db4009f35c57c6f71dca1d0f6a8d00880d1853879158e98d5f0

                                                    SHA512

                                                    184b7171147a3782f13b472544ab9f553fc6dde07bff248feed8dce620763df15e738467da8b98c57b8d82208c4918fdec74bc334e8550d22d0e1975b8a96fe5

                                                  • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                    MD5

                                                    b7161c0845a64ff6d7345b67ff97f3b0

                                                    SHA1

                                                    d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                    SHA256

                                                    fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                    SHA512

                                                    98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                  • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                    MD5

                                                    b7161c0845a64ff6d7345b67ff97f3b0

                                                    SHA1

                                                    d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                    SHA256

                                                    fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                    SHA512

                                                    98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                    MD5

                                                    7fee8223d6e4f82d6cd115a28f0b6d58

                                                    SHA1

                                                    1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                    SHA256

                                                    a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                    SHA512

                                                    3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                    MD5

                                                    7fee8223d6e4f82d6cd115a28f0b6d58

                                                    SHA1

                                                    1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                    SHA256

                                                    a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                    SHA512

                                                    3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                    MD5

                                                    a6279ec92ff948760ce53bba817d6a77

                                                    SHA1

                                                    5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                    SHA256

                                                    8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                    SHA512

                                                    213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                    MD5

                                                    a6279ec92ff948760ce53bba817d6a77

                                                    SHA1

                                                    5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                    SHA256

                                                    8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                    SHA512

                                                    213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                  • C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe
                                                    MD5

                                                    bbdb7bead525d96d5dde3751b4a46bc3

                                                    SHA1

                                                    1842704eef89eaa94135bc056656bdbfc6bce1d3

                                                    SHA256

                                                    acdff264d4464aeb08ef1cc0150ee8c5980fd43df04d63a38bd09aaa09faf51b

                                                    SHA512

                                                    d75adcd1a935961f9134f8d2bd9c7d07c82290554608958dee22d8027a54745cdbacaeb11f832887340160922fbf8f7d3ec52d4d32a1189e09f9905d357b34fe

                                                  • C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe
                                                    MD5

                                                    bbdb7bead525d96d5dde3751b4a46bc3

                                                    SHA1

                                                    1842704eef89eaa94135bc056656bdbfc6bce1d3

                                                    SHA256

                                                    acdff264d4464aeb08ef1cc0150ee8c5980fd43df04d63a38bd09aaa09faf51b

                                                    SHA512

                                                    d75adcd1a935961f9134f8d2bd9c7d07c82290554608958dee22d8027a54745cdbacaeb11f832887340160922fbf8f7d3ec52d4d32a1189e09f9905d357b34fe

                                                  • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                    MD5

                                                    5df8495952e628a51af71a6cdfb595af

                                                    SHA1

                                                    a10059a9c1ab910082cd2f60308ec4687b768a0f

                                                    SHA256

                                                    928da15e69c2b598abf9977a0dbf7b14b6a9609f68d7363f8494501cd237211c

                                                    SHA512

                                                    1edb1efb87b1e2463e35fa3b99f199c096bb33733fbaf5fd390c30691cda500a26b4ce92e9dbd300fdf4c294624167ed9d0cc8437246a05fbfd8592350b3b475

                                                  • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                    MD5

                                                    5df8495952e628a51af71a6cdfb595af

                                                    SHA1

                                                    a10059a9c1ab910082cd2f60308ec4687b768a0f

                                                    SHA256

                                                    928da15e69c2b598abf9977a0dbf7b14b6a9609f68d7363f8494501cd237211c

                                                    SHA512

                                                    1edb1efb87b1e2463e35fa3b99f199c096bb33733fbaf5fd390c30691cda500a26b4ce92e9dbd300fdf4c294624167ed9d0cc8437246a05fbfd8592350b3b475

                                                  • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                    MD5

                                                    8cbde3982249e20a6f564eb414f06fe4

                                                    SHA1

                                                    6d040b6c0f9d10b07f0b63797aa7bfabf0703925

                                                    SHA256

                                                    4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

                                                    SHA512

                                                    d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

                                                  • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                    MD5

                                                    8cbde3982249e20a6f564eb414f06fe4

                                                    SHA1

                                                    6d040b6c0f9d10b07f0b63797aa7bfabf0703925

                                                    SHA256

                                                    4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

                                                    SHA512

                                                    d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

                                                  • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                                                    MD5

                                                    7f78f9f8164d677e0dad9370d4d47b69

                                                    SHA1

                                                    e35f641b75b4bdc78f4b1de6f622b24646126ac0

                                                    SHA256

                                                    d5d5d7db7298d69d843d062b823a3a0f3cdf2df4817ea0e50a13a1f0846a726d

                                                    SHA512

                                                    9b458ba36aaebbe47547a50ca1376db9e2e72e448b256a4d961cda550ff6d1cbea0c6a1a4d50e1d7d0f0189ea302d4bbdde17be8c0255ebf68d2313651edbe29

                                                  • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                                                    MD5

                                                    7f78f9f8164d677e0dad9370d4d47b69

                                                    SHA1

                                                    e35f641b75b4bdc78f4b1de6f622b24646126ac0

                                                    SHA256

                                                    d5d5d7db7298d69d843d062b823a3a0f3cdf2df4817ea0e50a13a1f0846a726d

                                                    SHA512

                                                    9b458ba36aaebbe47547a50ca1376db9e2e72e448b256a4d961cda550ff6d1cbea0c6a1a4d50e1d7d0f0189ea302d4bbdde17be8c0255ebf68d2313651edbe29

                                                  • C:\Users\Admin\AppData\Roaming\2153740.exe
                                                    MD5

                                                    4f1ce60ce9ff7e198d1021db5ae9bac3

                                                    SHA1

                                                    66b43ccbc0ba327e513b37ee16f5b13ff9701ed9

                                                    SHA256

                                                    159dfc8de99cfaba351e898c28d7695de99c98c5f90c632065c7e11718ec83b4

                                                    SHA512

                                                    9d0570e84ff21facfaed0ef6e7670e2b6e95e64ae6a3af07b00517656be3200a85e9a078618e0022ce05f6581fc66bf6000764584e54594d8961efedd228fe91

                                                  • C:\Users\Admin\AppData\Roaming\2153740.exe
                                                    MD5

                                                    4f1ce60ce9ff7e198d1021db5ae9bac3

                                                    SHA1

                                                    66b43ccbc0ba327e513b37ee16f5b13ff9701ed9

                                                    SHA256

                                                    159dfc8de99cfaba351e898c28d7695de99c98c5f90c632065c7e11718ec83b4

                                                    SHA512

                                                    9d0570e84ff21facfaed0ef6e7670e2b6e95e64ae6a3af07b00517656be3200a85e9a078618e0022ce05f6581fc66bf6000764584e54594d8961efedd228fe91

                                                  • C:\Users\Admin\AppData\Roaming\3768049.exe
                                                    MD5

                                                    34af0e2c9f5fe6bef1be88d0bbdd2e82

                                                    SHA1

                                                    6b5e474d47c86aa857893ac2e3c1d25ba74d4896

                                                    SHA256

                                                    e548966b75968011db129dfa457a9aed787d53a80634949361294d16ff6cdc83

                                                    SHA512

                                                    f7da1c16d7c8dad13616c312135bf1191ccedf61b8a911599f9f30f367c67ba7318600f5e0ca58a950a329b1b1ce59f70d2875dad0006e3746c326fb3119c985

                                                  • C:\Users\Admin\AppData\Roaming\3768049.exe
                                                    MD5

                                                    34af0e2c9f5fe6bef1be88d0bbdd2e82

                                                    SHA1

                                                    6b5e474d47c86aa857893ac2e3c1d25ba74d4896

                                                    SHA256

                                                    e548966b75968011db129dfa457a9aed787d53a80634949361294d16ff6cdc83

                                                    SHA512

                                                    f7da1c16d7c8dad13616c312135bf1191ccedf61b8a911599f9f30f367c67ba7318600f5e0ca58a950a329b1b1ce59f70d2875dad0006e3746c326fb3119c985

                                                  • C:\Users\Admin\AppData\Roaming\4832196.exe
                                                    MD5

                                                    522258c2050646672c56c70318fe9bb4

                                                    SHA1

                                                    ac0da5bd72a7421b5a9e957a7ec7fbaa659fa261

                                                    SHA256

                                                    ae9118697fbd8288f795bd933e588bc6f80127da08e5596f73c0d540df0634f7

                                                    SHA512

                                                    871eff66baea2c578c7b5d7097f717211b456e0368c440f4ae9f2a4ba9ccc31c653d32b16ffb20d9ed7c7bc82cdad9091ceadf391e57171b5473c2abbd1008ea

                                                  • C:\Users\Admin\AppData\Roaming\4832196.exe
                                                    MD5

                                                    522258c2050646672c56c70318fe9bb4

                                                    SHA1

                                                    ac0da5bd72a7421b5a9e957a7ec7fbaa659fa261

                                                    SHA256

                                                    ae9118697fbd8288f795bd933e588bc6f80127da08e5596f73c0d540df0634f7

                                                    SHA512

                                                    871eff66baea2c578c7b5d7097f717211b456e0368c440f4ae9f2a4ba9ccc31c653d32b16ffb20d9ed7c7bc82cdad9091ceadf391e57171b5473c2abbd1008ea

                                                  • C:\Users\Admin\AppData\Roaming\5582669.exe
                                                    MD5

                                                    a02ce57ca3b97509180f68a2e04273cb

                                                    SHA1

                                                    f5539f4f80eb554c0172a2b2568f5fc17c39756e

                                                    SHA256

                                                    65eeddff651ff9162b04780efd9fe3cb85ea43e57e586afaa5817af44d4c54b5

                                                    SHA512

                                                    ea9fd89c38c3e382a38dba60cebacfb8fb5dd0dea877068aa0b11804ecb2a26c7bd05fc076daa32c4eb8db084730de5880305495a17cae77af344063d54d903e

                                                  • C:\Users\Admin\AppData\Roaming\5582669.exe
                                                    MD5

                                                    a02ce57ca3b97509180f68a2e04273cb

                                                    SHA1

                                                    f5539f4f80eb554c0172a2b2568f5fc17c39756e

                                                    SHA256

                                                    65eeddff651ff9162b04780efd9fe3cb85ea43e57e586afaa5817af44d4c54b5

                                                    SHA512

                                                    ea9fd89c38c3e382a38dba60cebacfb8fb5dd0dea877068aa0b11804ecb2a26c7bd05fc076daa32c4eb8db084730de5880305495a17cae77af344063d54d903e

                                                  • \Program Files\install.dll
                                                    MD5

                                                    c6a2e4e23319dec9d56f8029ef834e83

                                                    SHA1

                                                    299e80473cbe56b596a2d4d38aea0aab46826167

                                                    SHA256

                                                    6ae4bd10f8bc7f3e5856c7f3571d165787f48d23f95ccfa823a5dab74f7fd554

                                                    SHA512

                                                    2a30529c2254ff481ab099032829d1b533d8bb6fca6a766d04e3febd6dc87ba34852eb7354ffc8d0ed7f584b5bff587e2b549c4f4c9150e98a2ff6a0f751438a

                                                  • \ProgramData\mozglue.dll
                                                    MD5

                                                    8f73c08a9660691143661bf7332c3c27

                                                    SHA1

                                                    37fa65dd737c50fda710fdbde89e51374d0c204a

                                                    SHA256

                                                    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                    SHA512

                                                    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                  • \ProgramData\nss3.dll
                                                    MD5

                                                    bfac4e3c5908856ba17d41edcd455a51

                                                    SHA1

                                                    8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                    SHA256

                                                    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                    SHA512

                                                    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                                  • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                    MD5

                                                    50741b3f2d7debf5d2bed63d88404029

                                                    SHA1

                                                    56210388a627b926162b36967045be06ffb1aad3

                                                    SHA256

                                                    f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                    SHA512

                                                    fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                  • memory/416-167-0x0000000004D30000-0x0000000004D31000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/416-153-0x0000000005260000-0x0000000005261000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/416-151-0x0000000000430000-0x0000000000431000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/416-234-0x0000000004D60000-0x000000000525E000-memory.dmp
                                                    Filesize

                                                    5.0MB

                                                  • memory/416-156-0x0000000004D60000-0x0000000004D61000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/416-144-0x0000000000000000-mapping.dmp
                                                  • memory/592-220-0x000002A8E23E0000-0x000002A8E2450000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/1004-255-0x000001986D340000-0x000001986D3B0000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/1040-197-0x000002103AE70000-0x000002103AEE0000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/1048-116-0x0000000000000000-mapping.dmp
                                                  • memory/1136-189-0x000002097ADB0000-0x000002097ADFB000-memory.dmp
                                                    Filesize

                                                    300KB

                                                  • memory/1136-190-0x000002097BC70000-0x000002097BCE0000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/1184-227-0x000002756A980000-0x000002756A9F0000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/1384-238-0x0000018544A40000-0x0000018544AB0000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/1412-210-0x0000015A777A0000-0x0000015A77810000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/1424-117-0x0000000000000000-mapping.dmp
                                                  • memory/1516-120-0x0000000000000000-mapping.dmp
                                                  • memory/1596-181-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1596-199-0x00000000052F0000-0x000000000531B000-memory.dmp
                                                    Filesize

                                                    172KB

                                                  • memory/1596-196-0x0000000005360000-0x0000000005361000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1596-173-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1596-170-0x0000000000000000-mapping.dmp
                                                  • memory/1596-204-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1820-132-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1820-140-0x00000000015F0000-0x00000000015F1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1820-142-0x0000000001600000-0x000000000161A000-memory.dmp
                                                    Filesize

                                                    104KB

                                                  • memory/1820-123-0x0000000000000000-mapping.dmp
                                                  • memory/1820-143-0x0000000001630000-0x0000000001631000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1820-150-0x000000001BC10000-0x000000001BC12000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/1880-222-0x0000028AA8230000-0x0000028AA82A0000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/2240-184-0x000001BCA83B0000-0x000001BCA8420000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/2260-258-0x000001D032B90000-0x000001D032C00000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/2384-128-0x0000000000000000-mapping.dmp
                                                  • memory/2420-244-0x000002CB13240000-0x000002CB132B0000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/2436-250-0x000001B2E9200000-0x000001B2E9270000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/2460-129-0x0000000000000000-mapping.dmp
                                                  • memory/2492-352-0x0000000001470000-0x0000000001485000-memory.dmp
                                                    Filesize

                                                    84KB

                                                  • memory/2492-268-0x00000000014E0000-0x00000000014F5000-memory.dmp
                                                    Filesize

                                                    84KB

                                                  • memory/2704-251-0x0000025033C90000-0x0000025033D00000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/2864-179-0x0000000000400000-0x0000000000448000-memory.dmp
                                                    Filesize

                                                    288KB

                                                  • memory/2864-133-0x0000000000000000-mapping.dmp
                                                  • memory/2864-178-0x00000000004A0000-0x00000000004A9000-memory.dmp
                                                    Filesize

                                                    36KB

                                                  • memory/2892-182-0x0000000002E27000-0x0000000002F28000-memory.dmp
                                                    Filesize

                                                    1.0MB

                                                  • memory/2892-155-0x0000000000000000-mapping.dmp
                                                  • memory/2892-198-0x0000000004840000-0x000000000489C000-memory.dmp
                                                    Filesize

                                                    368KB

                                                  • memory/3408-147-0x0000000000000000-mapping.dmp
                                                  • memory/3484-163-0x00007FF7038B4060-mapping.dmp
                                                  • memory/3484-256-0x0000013422950000-0x00000134229C0000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/4228-191-0x00000000005B0000-0x00000000005B1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4228-207-0x0000000002670000-0x000000000267D000-memory.dmp
                                                    Filesize

                                                    52KB

                                                  • memory/4228-183-0x0000000000000000-mapping.dmp
                                                  • memory/4228-200-0x0000000002660000-0x0000000002661000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4228-219-0x000000000A270000-0x000000000A271000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4424-229-0x0000000005230000-0x0000000005231000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4424-213-0x00000000008E0000-0x00000000008E1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4424-221-0x00000000057E0000-0x00000000057E1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4424-224-0x00000000051D0000-0x00000000051D1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4424-205-0x0000000000000000-mapping.dmp
                                                  • memory/4424-245-0x00000000051C0000-0x00000000051C1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4424-237-0x0000000005270000-0x0000000005271000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4424-253-0x0000000005410000-0x0000000005411000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4636-338-0x0000000000400000-0x0000000002BB5000-memory.dmp
                                                    Filesize

                                                    39.7MB

                                                  • memory/4636-333-0x0000000000000000-mapping.dmp
                                                  • memory/4636-337-0x0000000002BC0000-0x0000000002C6E000-memory.dmp
                                                    Filesize

                                                    696KB

                                                  • memory/4668-230-0x0000000000000000-mapping.dmp
                                                  • memory/4668-263-0x0000000004E70000-0x0000000004E71000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4668-239-0x0000000000750000-0x0000000000751000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4668-249-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4704-277-0x0000018942100000-0x0000018942201000-memory.dmp
                                                    Filesize

                                                    1.0MB

                                                  • memory/4704-274-0x000001893FC00000-0x000001893FC70000-memory.dmp
                                                    Filesize

                                                    448KB

                                                  • memory/4704-273-0x000001893F940000-0x000001893F98B000-memory.dmp
                                                    Filesize

                                                    300KB

                                                  • memory/4704-270-0x00007FF7038B4060-mapping.dmp
                                                  • memory/4748-265-0x0000000000000000-mapping.dmp
                                                  • memory/4812-271-0x0000000000000000-mapping.dmp
                                                  • memory/4868-275-0x00000000004171F2-mapping.dmp
                                                  • memory/4868-276-0x0000000004ED0000-0x00000000054D6000-memory.dmp
                                                    Filesize

                                                    6.0MB

                                                  • memory/4932-272-0x0000000000000000-mapping.dmp
                                                  • memory/4956-260-0x0000000000000000-mapping.dmp
                                                  • memory/4956-264-0x0000000005620000-0x0000000005621000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/5272-278-0x0000000000000000-mapping.dmp
                                                  • memory/5272-291-0x0000000000400000-0x0000000000895000-memory.dmp
                                                    Filesize

                                                    4.6MB

                                                  • memory/5272-290-0x0000000002500000-0x0000000002597000-memory.dmp
                                                    Filesize

                                                    604KB

                                                  • memory/5284-332-0x0000000005370000-0x0000000005976000-memory.dmp
                                                    Filesize

                                                    6.0MB

                                                  • memory/5284-330-0x0000000000416392-mapping.dmp
                                                  • memory/5356-336-0x0000000000000000-mapping.dmp
                                                  • memory/5364-297-0x0000000000400000-0x000000000089B000-memory.dmp
                                                    Filesize

                                                    4.6MB

                                                  • memory/5364-296-0x00000000024D0000-0x0000000002567000-memory.dmp
                                                    Filesize

                                                    604KB

                                                  • memory/5364-287-0x0000000000000000-mapping.dmp
                                                  • memory/5408-347-0x0000000000000000-mapping.dmp
                                                  • memory/5464-344-0x0000000000000000-mapping.dmp
                                                  • memory/5464-345-0x0000000005280000-0x000000000577E000-memory.dmp
                                                    Filesize

                                                    5.0MB

                                                  • memory/5472-339-0x0000000000000000-mapping.dmp
                                                  • memory/5480-346-0x0000000000000000-mapping.dmp
                                                  • memory/5480-293-0x0000000000000000-mapping.dmp
                                                  • memory/5480-315-0x0000000000400000-0x000000000089B000-memory.dmp
                                                    Filesize

                                                    4.6MB

                                                  • memory/5480-314-0x0000000002530000-0x00000000025C7000-memory.dmp
                                                    Filesize

                                                    604KB

                                                  • memory/5576-340-0x0000000000000000-mapping.dmp
                                                  • memory/5584-313-0x0000000000000000-mapping.dmp
                                                  • memory/5632-341-0x0000000000000000-mapping.dmp
                                                  • memory/5692-316-0x0000000000000000-mapping.dmp
                                                  • memory/5704-342-0x0000000000000000-mapping.dmp
                                                  • memory/5712-317-0x0000000000000000-mapping.dmp
                                                  • memory/5756-318-0x0000000000000000-mapping.dmp
                                                  • memory/5764-348-0x0000000001120000-0x000000000126A000-memory.dmp
                                                    Filesize

                                                    1.3MB

                                                  • memory/5764-343-0x0000000000000000-mapping.dmp
                                                  • memory/5780-319-0x0000000000000000-mapping.dmp
                                                  • memory/5824-320-0x0000000000000000-mapping.dmp
                                                  • memory/5860-321-0x0000000000000000-mapping.dmp
                                                  • memory/5884-334-0x0000000004700000-0x0000000004731000-memory.dmp
                                                    Filesize

                                                    196KB

                                                  • memory/5884-322-0x0000000000000000-mapping.dmp
                                                  • memory/5884-335-0x0000000000400000-0x0000000002BB5000-memory.dmp
                                                    Filesize

                                                    39.7MB

                                                  • memory/5896-323-0x0000000000000000-mapping.dmp
                                                  • memory/5956-324-0x0000000000000000-mapping.dmp
                                                  • memory/5988-325-0x0000000000000000-mapping.dmp
                                                  • memory/6032-326-0x0000000000000000-mapping.dmp
                                                  • memory/6064-327-0x0000000000000000-mapping.dmp
                                                  • memory/6084-328-0x0000000000000000-mapping.dmp
                                                  • memory/6112-349-0x0000000000000000-mapping.dmp
                                                  • memory/6112-351-0x0000000000400000-0x0000000000448000-memory.dmp
                                                    Filesize

                                                    288KB

                                                  • memory/6112-350-0x00000000004B0000-0x00000000005FA000-memory.dmp
                                                    Filesize

                                                    1.3MB

                                                  • memory/6120-331-0x0000000004F10000-0x000000000540E000-memory.dmp
                                                    Filesize

                                                    5.0MB

                                                  • memory/6120-329-0x0000000000000000-mapping.dmp