bitrat | 34eea6a07ea67c590471581473b4a17d5ac8214e1ec94464af43fb2ce7334808

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
27/05/2021, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe
Size 6KB
Sample210527-zjcdfe4pps
SHA256 34eea6a07ea67c590471581473b4a17d5ac8214e1ec94464af43fb2ce7334808
MD5 1ea80e6a35c7ebf9661d9c7fa5ae85ab
SHA1 5b0771b1886a5e77bc9fe9505a11e94d10a23d07
SHA512 bdade952c49b3a0c419cd5dac9e2b19fe830f7220f8625ef2d5accf7b28fb2298341c63e280182df31b3f9242d8a6815f708b7520ccf030a188cf2123480853a
MD5 SHA1 SHA512

Score

10^/10

bitrat glupteba metasploit raccoon redline smokeloader 2d4a0d80fe676e3f8e476f0fd0e0817b52e0eaeb 74452b5cbc58563477e4a9e149f2093398530bbd jasonnew backdoor discovery dropper infostealer loader stealer trojan upx vmprotect

Malware Config

Extracted

Family

redline

Botnet

JasonNew

87.251.71.193:80

Extracted

Family

raccoon

Botnet

2d4a0d80fe676e3f8e476f0fd0e0817b52e0eaeb

Attributes

url4cnc
https://tttttt.me/m00oonreader

rc4.plain

Extracted

Family

raccoon

Botnet

74452b5cbc58563477e4a9e149f2093398530bbd

Attributes

url4cnc
https://tttttt.me/johnyes13

rc4.plain

Extracted

Family

smokeloader

Version

2020

http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/

rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4740-211-0x00000000007E2380-mapping.dmp	family_bitrat

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1008-358-0x0000000002E80000-0x000000000378C000-memory.dmp	family_glupteba
behavioral2/memory/1008-366-0x0000000000400000-0x0000000000D26000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 11 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab8f-151.dat	family_redline
behavioral2/files/0x000100000001aba8-237.dat	family_redline
behavioral2/memory/4376-266-0x000000000041699E-mapping.dmp	family_redline
behavioral2/memory/4376-263-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral2/memory/5484-313-0x000000000041699E-mapping.dmp	family_redline
behavioral2/memory/5484-315-0x0000000004B20000-0x0000000005126000-memory.dmp	family_redline
behavioral2/files/0x000100000001aba8-238.dat	family_redline
behavioral2/files/0x000100000001ab8f-150.dat	family_redline
behavioral2/memory/5836-320-0x000000000041699E-mapping.dmp	family_redline
behavioral2/memory/6132-337-0x0000000005640000-0x0000000005C46000-memory.dmp	family_redline
behavioral2/memory/6992-356-0x0000000004D60000-0x0000000005366000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
1128	ZA12NB5IYRKIJNGFHZ8S9EEM.exe
1868	T4FR838NTJCRTT8GOWWQA6XD.exe
1008	LQL3DP5F8GDR2CWY5S9NBD13.exe
1296	QRIK8EEV5OIVBQ2MXXBHVHCB.exe
932	U29OQL3WHC28CGASO43CJ07A.exe
1604	ZPEFKCD34888CSXC7GCX7OQ7.exe
2104	BROVZZOIPHUTA8L3LP0CS4JE.exe
2588	98JPFODK9GD2XREFUZT48EB9.exe
1092	5IMSYNPHHJV0Q9DAEJU45SG3.exe
4100	KUS3KOG56KU7CUWV05VN5NZU.exe
4120	WS0YUHDMCTHD4W62D03FPF8T.exe
4180	X8D9727758H2YSKZGH4SMS0E.exe
4252	92KETTFQUHAVDEPJVKH6PEEU.exe
4368	QE9HLPGFI8AER2NM30HRRYVC.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4740-209-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/4740-229-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/files/0x000100000001aba9-213.dat	upx
behavioral2/files/0x000100000001aba9-212.dat	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4596-206-0x0000000000400000-0x00000000005DE000-memory.dmp	vmprotect
behavioral2/files/0x000100000001ab9a-204.dat	vmprotect
behavioral2/files/0x000100000001ab9a-203.dat	vmprotect

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ip-api.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\file4.exe	QRIK8EEV5OIVBQ2MXXBHVHCB.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\lij.exe	QRIK8EEV5OIVBQ2MXXBHVHCB.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	QRIK8EEV5OIVBQ2MXXBHVHCB.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	QRIK8EEV5OIVBQ2MXXBHVHCB.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	QRIK8EEV5OIVBQ2MXXBHVHCB.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\runme.exe	QRIK8EEV5OIVBQ2MXXBHVHCB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 25 IoCs

pid	pid_target	Process	procid_target
7056	4440	WerFault.exe	134
6924	2104	WerFault.exe	83
4072	2104	WerFault.exe	83
4624	4440	WerFault.exe	134
5372	2104	WerFault.exe	83
860	4440	WerFault.exe	134
7216	5160	WerFault.exe	97
7416	2104	WerFault.exe	83
7748	5160	WerFault.exe	97
7984	6112	WerFault.exe	142
7740	4440	WerFault.exe	134
6160	6112	WerFault.exe	142
6208	5160	WerFault.exe	97
8584	6112	WerFault.exe	142
8776	6292	WerFault.exe	169
8524	5160	WerFault.exe	97
4668	6292	WerFault.exe	169
6160	6112	WerFault.exe	142
812	6292	WerFault.exe	169
8796	6932	WerFault.exe	200
8664	7816	WerFault.exe	227
9644	4440	WerFault.exe	134
9816	6292	WerFault.exe	169
9924	6932	WerFault.exe	200
9264	7816	WerFault.exe	227

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
6780	PING.EXE
5824	PING.EXE
6724	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe
Token: SeDebugPrivilege	932	U29OQL3WHC28CGASO43CJ07A.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 1128	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	77
PID 3680 wrote to memory of 1128	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	77
PID 3680 wrote to memory of 1128	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	77
PID 3680 wrote to memory of 1868	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	79
PID 3680 wrote to memory of 1868	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	79
PID 3680 wrote to memory of 1868	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	79
PID 3680 wrote to memory of 1008	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	80
PID 3680 wrote to memory of 1008	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	80
PID 3680 wrote to memory of 1008	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	80
PID 3680 wrote to memory of 1296	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	81
PID 3680 wrote to memory of 932	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	78
PID 3680 wrote to memory of 1296	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	81
PID 3680 wrote to memory of 1296	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	81
PID 3680 wrote to memory of 932	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	78
PID 3680 wrote to memory of 932	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	78
PID 3680 wrote to memory of 1604	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	82
PID 3680 wrote to memory of 1604	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	82
PID 3680 wrote to memory of 2104	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	83
PID 3680 wrote to memory of 2104	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	83
PID 3680 wrote to memory of 2104	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	83
PID 3680 wrote to memory of 2588	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	84
PID 3680 wrote to memory of 2588	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	84
PID 3680 wrote to memory of 2588	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	84
PID 3680 wrote to memory of 1092	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	85
PID 3680 wrote to memory of 1092	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	85
PID 3680 wrote to memory of 1092	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	85
PID 3680 wrote to memory of 4100	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	86
PID 3680 wrote to memory of 4100	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	86
PID 3680 wrote to memory of 4100	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	86
PID 3680 wrote to memory of 4120	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	138
PID 3680 wrote to memory of 4120	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	138
PID 3680 wrote to memory of 4120	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	138
PID 3680 wrote to memory of 4180	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	137
PID 3680 wrote to memory of 4180	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	137
PID 3680 wrote to memory of 4180	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	137
PID 3680 wrote to memory of 4252	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	136
PID 3680 wrote to memory of 4252	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	136
PID 3680 wrote to memory of 4252	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	136
PID 3680 wrote to memory of 4368	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	87
PID 3680 wrote to memory of 4368	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	87
PID 3680 wrote to memory of 4368	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	87
PID 3680 wrote to memory of 4428	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	135
PID 3680 wrote to memory of 4428	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	135
PID 3680 wrote to memory of 4428	3680	1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe	135
PID 1296 wrote to memory of 4440	1296	QRIK8EEV5OIVBQ2MXXBHVHCB.exe	134
PID 1296 wrote to memory of 4440	1296	QRIK8EEV5OIVBQ2MXXBHVHCB.exe	134
PID 1296 wrote to memory of 4440	1296	QRIK8EEV5OIVBQ2MXXBHVHCB.exe	134

C:\Users\Admin\AppData\Local\Temp\1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe
"C:\Users\Admin\AppData\Local\Temp\1EA80E6A35C7EBF9661D9C7FA5AE85AB.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\Documents\ZA12NB5IYRKIJNGFHZ8S9EEM.exe
  "C:\Users\Admin\Documents\ZA12NB5IYRKIJNGFHZ8S9EEM.exe"
  2⤵
  - Executes dropped EXE
  PID:1128
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:6428
- C:\Users\Admin\Documents\U29OQL3WHC28CGASO43CJ07A.exe
  "C:\Users\Admin\Documents\U29OQL3WHC28CGASO43CJ07A.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:4376
- C:\Users\Admin\Documents\T4FR838NTJCRTT8GOWWQA6XD.exe
  "C:\Users\Admin\Documents\T4FR838NTJCRTT8GOWWQA6XD.exe"
  2⤵
  - Executes dropped EXE
  PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Documents\T4FR838NTJCRTT8GOWWQA6XD.exe"
    3⤵
    PID:3724
- C:\Users\Admin\Documents\LQL3DP5F8GDR2CWY5S9NBD13.exe
  "C:\Users\Admin\Documents\LQL3DP5F8GDR2CWY5S9NBD13.exe"
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Users\Admin\Documents\QRIK8EEV5OIVBQ2MXXBHVHCB.exe
  "C:\Users\Admin\Documents\QRIK8EEV5OIVBQ2MXXBHVHCB.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    PID:4596
- - C:\Program Files (x86)\Company\NewProduct\lij.exe
    "C:\Program Files (x86)\Company\NewProduct\lij.exe"
    3⤵
    PID:4524
- - C:\Program Files (x86)\Company\NewProduct\file4.exe
    "C:\Program Files (x86)\Company\NewProduct\file4.exe"
    3⤵
    PID:4472
- - C:\Program Files (x86)\Company\NewProduct\runme.exe
    "C:\Program Files (x86)\Company\NewProduct\runme.exe"
    3⤵
    PID:4440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 664
      4⤵
      Program crash
      PID:7056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 672
      4⤵
      Program crash
      PID:4624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 680
      4⤵
      Program crash
      PID:860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 540
      4⤵
      Program crash
      PID:7740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1172
      4⤵
      Program crash
      PID:9644
- C:\Users\Admin\Documents\ZPEFKCD34888CSXC7GCX7OQ7.exe
  "C:\Users\Admin\Documents\ZPEFKCD34888CSXC7GCX7OQ7.exe"
  2⤵
  - Executes dropped EXE
  PID:1604
- - C:\Users\Admin\AppData\Roaming\2853702.exe
    "C:\Users\Admin\AppData\Roaming\2853702.exe"
    3⤵
    PID:5456
- - C:\Users\Admin\AppData\Roaming\8770797.exe
    "C:\Users\Admin\AppData\Roaming\8770797.exe"
    3⤵
    PID:3088
  - - C:\ProgramData\Windows Host\Windows Host.exe
      "C:\ProgramData\Windows Host\Windows Host.exe"
      4⤵
      PID:7124
- C:\Users\Admin\Documents\BROVZZOIPHUTA8L3LP0CS4JE.exe
  "C:\Users\Admin\Documents\BROVZZOIPHUTA8L3LP0CS4JE.exe"
  2⤵
  - Executes dropped EXE
  PID:2104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 656
    3⤵
    - Program crash
    PID:6924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 704
    3⤵
    - Program crash
    PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 676
    3⤵
    - Program crash
    PID:5372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 644
    3⤵
    - Program crash
    PID:7416
- C:\Users\Admin\Documents\98JPFODK9GD2XREFUZT48EB9.exe
  "C:\Users\Admin\Documents\98JPFODK9GD2XREFUZT48EB9.exe"
  2⤵
  - Executes dropped EXE
  PID:2588
- - C:\Users\Admin\Documents\98JPFODK9GD2XREFUZT48EB9.exe
    "C:\Users\Admin\Documents\98JPFODK9GD2XREFUZT48EB9.exe"
    3⤵
    PID:6856
- C:\Users\Admin\Documents\5IMSYNPHHJV0Q9DAEJU45SG3.exe
  "C:\Users\Admin\Documents\5IMSYNPHHJV0Q9DAEJU45SG3.exe"
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Users\Admin\Documents\KUS3KOG56KU7CUWV05VN5NZU.exe
  "C:\Users\Admin\Documents\KUS3KOG56KU7CUWV05VN5NZU.exe"
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Users\Admin\Documents\QE9HLPGFI8AER2NM30HRRYVC.exe
  "C:\Users\Admin\Documents\QE9HLPGFI8AER2NM30HRRYVC.exe"
  2⤵
  - Executes dropped EXE
  PID:4368
- - C:\Users\Admin\Documents\QE9HLPGFI8AER2NM30HRRYVC.EXE
    "C:\Users\Admin\Documents\QE9HLPGFI8AER2NM30HRRYVC.EXE"
    3⤵
    PID:4740
- C:\Users\Admin\Documents\VDQWKQ7R3EFO0B89X66XRPW6.exe
  "C:\Users\Admin\Documents\VDQWKQ7R3EFO0B89X66XRPW6.exe"
  2⤵
  PID:5020
- C:\Users\Admin\Documents\A9582AY7EHC3HQRB876O8QXH.exe
  "C:\Users\Admin\Documents\A9582AY7EHC3HQRB876O8QXH.exe"
  2⤵
  PID:4436
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:5468
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:6080
- C:\Users\Admin\Documents\7KHDUXV8WY26BSDJTJBH28TI.exe
  "C:\Users\Admin\Documents\7KHDUXV8WY26BSDJTJBH28TI.exe"
  2⤵
  PID:4896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:5836
- C:\Users\Admin\Documents\KYSEO0KZ4XE3ER4EKLVV8R7A.exe
  "C:\Users\Admin\Documents\KYSEO0KZ4XE3ER4EKLVV8R7A.exe"
  2⤵
  PID:4320
- - C:\Users\Admin\Documents\KYSEO0KZ4XE3ER4EKLVV8R7A.exe
    C:\Users\Admin\Documents\KYSEO0KZ4XE3ER4EKLVV8R7A.exe
    3⤵
    PID:6408
- C:\Users\Admin\Documents\IC9ZGEJCZ73IP5WJWCA7IO78.exe
  "C:\Users\Admin\Documents\IC9ZGEJCZ73IP5WJWCA7IO78.exe"
  2⤵
  PID:1724
- - C:\Users\Admin\AppData\Roaming\2222927.exe
    "C:\Users\Admin\AppData\Roaming\2222927.exe"
    3⤵
    PID:7752
- - C:\Users\Admin\AppData\Roaming\7749422.exe
    "C:\Users\Admin\AppData\Roaming\7749422.exe"
    3⤵
    PID:4340
- C:\Users\Admin\Documents\NJ0B3FNINZKQIINGOZV8WWV7.exe
  "C:\Users\Admin\Documents\NJ0B3FNINZKQIINGOZV8WWV7.exe"
  2⤵
  PID:5160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 656
    3⤵
    - Program crash
    PID:7216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 672
    3⤵
    - Program crash
    PID:7748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 628
    3⤵
    - Program crash
    PID:6208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 656
    3⤵
    - Program crash
    PID:8524
- C:\Users\Admin\Documents\HSEICDOGRUWLV9Z3PIKT8F2G.exe
  "C:\Users\Admin\Documents\HSEICDOGRUWLV9Z3PIKT8F2G.exe"
  2⤵
  PID:5244
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Documents\HSEICDOGRUWLV9Z3PIKT8F2G.exe"
    3⤵
    PID:5016
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:6724
- C:\Users\Admin\Documents\RYOIH9OP7EYY1OOI5W4UFN40.exe
  "C:\Users\Admin\Documents\RYOIH9OP7EYY1OOI5W4UFN40.exe"
  2⤵
  PID:5284
- C:\Users\Admin\Documents\V50EDHJE3YY7TZUUC419AXDR.exe
  "C:\Users\Admin\Documents\V50EDHJE3YY7TZUUC419AXDR.exe"
  2⤵
  PID:5380
- - C:\Windows\SysWOW64\rUNdlL32.eXe
    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
    3⤵
    PID:7564
- C:\Users\Admin\Documents\0EP0DPFWJEC9W7ZZTJ7P08HP.exe
  "C:\Users\Admin\Documents\0EP0DPFWJEC9W7ZZTJ7P08HP.exe"
  2⤵
  PID:5400
- C:\Users\Admin\Documents\JC91FS14FAM6NHITUV4ZUGBO.exe
  "C:\Users\Admin\Documents\JC91FS14FAM6NHITUV4ZUGBO.exe"
  2⤵
  PID:5528
- - C:\Users\Admin\Documents\JC91FS14FAM6NHITUV4ZUGBO.exe
    "C:\Users\Admin\Documents\JC91FS14FAM6NHITUV4ZUGBO.exe"
    3⤵
    PID:7316
- C:\Users\Admin\Documents\EBQ10X11795ODQQI4EHNT06A.exe
  "C:\Users\Admin\Documents\EBQ10X11795ODQQI4EHNT06A.exe"
  2⤵
  PID:5704
- C:\Users\Admin\Documents\JT6YK22J1HUEVTIESVC3WVKC.exe
  "C:\Users\Admin\Documents\JT6YK22J1HUEVTIESVC3WVKC.exe"
  2⤵
  PID:5760
- C:\Users\Admin\Documents\6D47YDNYI4D5IK6HUF9GBBNQ.exe
  "C:\Users\Admin\Documents\6D47YDNYI4D5IK6HUF9GBBNQ.exe"
  2⤵
  PID:5872
- - C:\Users\Admin\Documents\6D47YDNYI4D5IK6HUF9GBBNQ.exe
    C:\Users\Admin\Documents\6D47YDNYI4D5IK6HUF9GBBNQ.exe
    3⤵
    PID:6952
- C:\Users\Admin\Documents\4ZMZGBK82JN92SANSBXOWU7F.exe
  "C:\Users\Admin\Documents\4ZMZGBK82JN92SANSBXOWU7F.exe"
  2⤵
  PID:5460
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:6888
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:8816
- C:\Users\Admin\Documents\UKPY5NB362N0EO60FOJPU7AL.exe
  "C:\Users\Admin\Documents\UKPY5NB362N0EO60FOJPU7AL.exe"
  2⤵
  PID:5324
- C:\Users\Admin\Documents\2ZG5PTWDZT4HTIV2Z9DW182O.exe
  "C:\Users\Admin\Documents\2ZG5PTWDZT4HTIV2Z9DW182O.exe"
  2⤵
  PID:5204
- - C:\Users\Admin\Documents\2ZG5PTWDZT4HTIV2Z9DW182O.exe
    C:\Users\Admin\Documents\2ZG5PTWDZT4HTIV2Z9DW182O.exe
    3⤵
    PID:6528
- - C:\Users\Admin\Documents\2ZG5PTWDZT4HTIV2Z9DW182O.exe
    C:\Users\Admin\Documents\2ZG5PTWDZT4HTIV2Z9DW182O.exe
    3⤵
    PID:6520
- - C:\Users\Admin\Documents\2ZG5PTWDZT4HTIV2Z9DW182O.exe
    C:\Users\Admin\Documents\2ZG5PTWDZT4HTIV2Z9DW182O.exe
    3⤵
    PID:6512
- C:\Users\Admin\Documents\P77QN8J31S0UEAVN8FCFY992.exe
  "C:\Users\Admin\Documents\P77QN8J31S0UEAVN8FCFY992.exe"
  2⤵
  PID:5152
- C:\Users\Admin\Documents\N4WJEQZ80935ERT6OCCNNKEC.exe
  "C:\Users\Admin\Documents\N4WJEQZ80935ERT6OCCNNKEC.exe"
  2⤵
  PID:4012
- C:\Users\Admin\Documents\O4YTTH7TLX1K5Q4A26LW3GQ9.exe
  "C:\Users\Admin\Documents\O4YTTH7TLX1K5Q4A26LW3GQ9.exe"
  2⤵
  PID:5056
- C:\Users\Admin\Documents\5SFBDMVO16JIK1O8SRDFTGYR.exe
  "C:\Users\Admin\Documents\5SFBDMVO16JIK1O8SRDFTGYR.exe"
  2⤵
  PID:1720
- C:\Users\Admin\Documents\QTSYPGTHWEY2EBG49YXBVS63.exe
  "C:\Users\Admin\Documents\QTSYPGTHWEY2EBG49YXBVS63.exe"
  2⤵
  PID:5052
- C:\Users\Admin\Documents\PFSKII28XOR2DJIHC4LYFITN.exe
  "C:\Users\Admin\Documents\PFSKII28XOR2DJIHC4LYFITN.exe"
  2⤵
  PID:5036
- - C:\Users\Admin\Documents\PFSKII28XOR2DJIHC4LYFITN.exe
    C:\Users\Admin\Documents\PFSKII28XOR2DJIHC4LYFITN.exe
    3⤵
    PID:4140
- - C:\Users\Admin\Documents\PFSKII28XOR2DJIHC4LYFITN.exe
    C:\Users\Admin\Documents\PFSKII28XOR2DJIHC4LYFITN.exe
    3⤵
    PID:4184
- C:\Users\Admin\Documents\VPD013P3ECYZKI82TEEH2HYH.exe
  "C:\Users\Admin\Documents\VPD013P3ECYZKI82TEEH2HYH.exe"
  2⤵
  PID:5028
- C:\Users\Admin\Documents\Y3TT39L1Y321FVC47QLH5R2H.exe
  "C:\Users\Admin\Documents\Y3TT39L1Y321FVC47QLH5R2H.exe"
  2⤵
  PID:4956
- C:\Users\Admin\Documents\QBNB15NDAVCM9IAFYVIUPRN8.exe
  "C:\Users\Admin\Documents\QBNB15NDAVCM9IAFYVIUPRN8.exe"
  2⤵
  PID:4948
- C:\Users\Admin\Documents\T91D53SHBLC2VK92QY0UT04Z.exe
  "C:\Users\Admin\Documents\T91D53SHBLC2VK92QY0UT04Z.exe"
  2⤵
  PID:4884
- - C:\Users\Admin\Documents\T91D53SHBLC2VK92QY0UT04Z.exe
    C:\Users\Admin\Documents\T91D53SHBLC2VK92QY0UT04Z.exe
    3⤵
    PID:6188
- C:\Users\Admin\Documents\65DY6XC2S6PZSE4OJFR1E816.exe
  "C:\Users\Admin\Documents\65DY6XC2S6PZSE4OJFR1E816.exe"
  2⤵
  PID:4864
- C:\Users\Admin\Documents\2V7CK3Z4X0YPU7FEA5NEEK13.exe
  "C:\Users\Admin\Documents\2V7CK3Z4X0YPU7FEA5NEEK13.exe"
  2⤵
  PID:4428
- C:\Users\Admin\Documents\92KETTFQUHAVDEPJVKH6PEEU.exe
  "C:\Users\Admin\Documents\92KETTFQUHAVDEPJVKH6PEEU.exe"
  2⤵
  - Executes dropped EXE
  PID:4252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\del.bat
    3⤵
    PID:8484
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 3
      4⤵
      Runs ping.exe
      PID:6780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\29107.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\29107.exe"
    3⤵
    PID:8448
- C:\Users\Admin\Documents\X8D9727758H2YSKZGH4SMS0E.exe
  "C:\Users\Admin\Documents\X8D9727758H2YSKZGH4SMS0E.exe"
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Users\Admin\Documents\X8D9727758H2YSKZGH4SMS0E.exe
    C:\Users\Admin\Documents\X8D9727758H2YSKZGH4SMS0E.exe
    3⤵
    PID:6132
- C:\Users\Admin\Documents\WS0YUHDMCTHD4W62D03FPF8T.exe
  "C:\Users\Admin\Documents\WS0YUHDMCTHD4W62D03FPF8T.exe"
  2⤵
  - Executes dropped EXE
  PID:4120
- - C:\Users\Admin\Documents\WS0YUHDMCTHD4W62D03FPF8T.exe
    C:\Users\Admin\Documents\WS0YUHDMCTHD4W62D03FPF8T.exe
    3⤵
    PID:4752
- C:\Users\Admin\Documents\E7WA8OGJ3JVKZY0BB3868W65.exe
  "C:\Users\Admin\Documents\E7WA8OGJ3JVKZY0BB3868W65.exe"
  2⤵
  PID:5920
- - C:\Users\Admin\AppData\Roaming\2617541.exe
    "C:\Users\Admin\AppData\Roaming\2617541.exe"
    3⤵
    PID:7248
- - C:\Users\Admin\AppData\Roaming\4037691.exe
    "C:\Users\Admin\AppData\Roaming\4037691.exe"
    3⤵
    PID:2492
- C:\Users\Admin\Documents\VPUSNUWOEPRG1CREGVW56LWK.exe
  "C:\Users\Admin\Documents\VPUSNUWOEPRG1CREGVW56LWK.exe"
  2⤵
  PID:5992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:6884
- C:\Users\Admin\Documents\ZPK0MQI5ZO20RNZ3X4B8YWR6.exe
  "C:\Users\Admin\Documents\ZPK0MQI5ZO20RNZ3X4B8YWR6.exe"
  2⤵
  PID:6036
- C:\Users\Admin\Documents\P8EICQRSB0LTEQ7MA0UK69TY.exe
  "C:\Users\Admin\Documents\P8EICQRSB0LTEQ7MA0UK69TY.exe"
  2⤵
  PID:6112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 656
    3⤵
    - Program crash
    PID:7984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 672
    3⤵
    - Program crash
    PID:6160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 632
    3⤵
    - Program crash
    PID:8584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 636
    3⤵
    - Program crash
    PID:6160
- C:\Users\Admin\Documents\EFIEU7HC7OKNLA2J7JY0BFZH.exe
  "C:\Users\Admin\Documents\EFIEU7HC7OKNLA2J7JY0BFZH.exe"
  2⤵
  PID:5192
- - C:\Users\Admin\Documents\EFIEU7HC7OKNLA2J7JY0BFZH.exe
    C:\Users\Admin\Documents\EFIEU7HC7OKNLA2J7JY0BFZH.exe
    3⤵
    PID:5956
- C:\Users\Admin\Documents\6Z87CG9POQE7HN8ETIVZFTAA.exe
  "C:\Users\Admin\Documents\6Z87CG9POQE7HN8ETIVZFTAA.exe"
  2⤵
  PID:5396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Documents\6Z87CG9POQE7HN8ETIVZFTAA.exe"
    3⤵
    PID:8776
- C:\Users\Admin\Documents\8LNWK3W8PBH59JA0P48564BT.exe
  "C:\Users\Admin\Documents\8LNWK3W8PBH59JA0P48564BT.exe"
  2⤵
  PID:5328
- C:\Users\Admin\Documents\KUH2UABNY8913MEV3GRGGDFJ.exe
  "C:\Users\Admin\Documents\KUH2UABNY8913MEV3GRGGDFJ.exe"
  2⤵
  PID:5664
- - C:\Windows\SysWOW64\rUNdlL32.eXe
    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
    3⤵
    PID:6024
- C:\Users\Admin\Documents\I4JKUEEDJ4L0V4NP93GAJI7C.exe
  "C:\Users\Admin\Documents\I4JKUEEDJ4L0V4NP93GAJI7C.exe"
  2⤵
  PID:2000
- C:\Users\Admin\Documents\0NCZM4MHP7TZ002T46R8AO99.exe
  "C:\Users\Admin\Documents\0NCZM4MHP7TZ002T46R8AO99.exe"
  2⤵
  PID:4424
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:7376
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:6800
- C:\Users\Admin\Documents\2CHM6E996HUHCO0PREKXKXZI.exe
  "C:\Users\Admin\Documents\2CHM6E996HUHCO0PREKXKXZI.exe"
  2⤵
  PID:4136
- - C:\Users\Admin\Documents\2CHM6E996HUHCO0PREKXKXZI.exe
    "C:\Users\Admin\Documents\2CHM6E996HUHCO0PREKXKXZI.exe"
    3⤵
    PID:8044
- C:\Users\Admin\Documents\GCR6ELYFN9KJ7WI7FJ39RP2R.exe
  "C:\Users\Admin\Documents\GCR6ELYFN9KJ7WI7FJ39RP2R.exe"
  2⤵
  PID:5896
- C:\Users\Admin\Documents\BXGN18BLND6KWAKL7U3TGUQP.exe
  "C:\Users\Admin\Documents\BXGN18BLND6KWAKL7U3TGUQP.exe"
  2⤵
  PID:5320
- C:\Users\Admin\Documents\L5N60R80KACFV8KH73DGPTQ9.exe
  "C:\Users\Admin\Documents\L5N60R80KACFV8KH73DGPTQ9.exe"
  2⤵
  PID:4204
- - C:\Users\Admin\AppData\Roaming\4115686.exe
    "C:\Users\Admin\AppData\Roaming\4115686.exe"
    3⤵
    PID:8208
- - C:\Users\Admin\AppData\Roaming\3375417.exe
    "C:\Users\Admin\AppData\Roaming\3375417.exe"
    3⤵
    PID:9368
- C:\Users\Admin\Documents\38004GCRG0GYRFGBO17XZBNL.exe
  "C:\Users\Admin\Documents\38004GCRG0GYRFGBO17XZBNL.exe"
  2⤵
  PID:6156
- - C:\Users\Admin\Documents\38004GCRG0GYRFGBO17XZBNL.exe
    C:\Users\Admin\Documents\38004GCRG0GYRFGBO17XZBNL.exe
    3⤵
    PID:7516
- - C:\Users\Admin\Documents\38004GCRG0GYRFGBO17XZBNL.exe
    C:\Users\Admin\Documents\38004GCRG0GYRFGBO17XZBNL.exe
    3⤵
    PID:7508
- C:\Users\Admin\Documents\C1VZSE12UOO92F0Y2QOQDAQP.exe
  "C:\Users\Admin\Documents\C1VZSE12UOO92F0Y2QOQDAQP.exe"
  2⤵
  PID:6228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:6044
- C:\Users\Admin\Documents\RZ068G51OO386IHFIJVGULP1.exe
  "C:\Users\Admin\Documents\RZ068G51OO386IHFIJVGULP1.exe"
  2⤵
  PID:6384
- C:\Users\Admin\Documents\III4PJ5FK83T25WOS1W0AP0N.exe
  "C:\Users\Admin\Documents\III4PJ5FK83T25WOS1W0AP0N.exe"
  2⤵
  PID:6344
- - C:\Users\Admin\Documents\III4PJ5FK83T25WOS1W0AP0N.exe
    C:\Users\Admin\Documents\III4PJ5FK83T25WOS1W0AP0N.exe
    3⤵
    PID:7784
- C:\Users\Admin\Documents\COO9F95CLFI2O54NTWUNM12T.exe
  "C:\Users\Admin\Documents\COO9F95CLFI2O54NTWUNM12T.exe"
  2⤵
  PID:6292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 652
    3⤵
    - Program crash
    PID:8776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 680
    3⤵
    - Program crash
    PID:4668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 684
    3⤵
    - Program crash
    PID:812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6292 -s 740
    3⤵
    - Program crash
    PID:9816
- C:\Users\Admin\Documents\AF5UEBT3S4PHW8PJSR77DZXR.exe
  "C:\Users\Admin\Documents\AF5UEBT3S4PHW8PJSR77DZXR.exe"
  2⤵
  PID:6588
- C:\Users\Admin\Documents\EUQ76KLDW86VG4GUL8O6VOQM.exe
  "C:\Users\Admin\Documents\EUQ76KLDW86VG4GUL8O6VOQM.exe"
  2⤵
  PID:6732
- C:\Users\Admin\Documents\LMVFL05ZDEKYN008NWC2OV9Z.exe
  "C:\Users\Admin\Documents\LMVFL05ZDEKYN008NWC2OV9Z.exe"
  2⤵
  PID:6808
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:7100
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:9860
- C:\Users\Admin\Documents\BGNJ32K3FJJACP81R0RQLI43.exe
  "C:\Users\Admin\Documents\BGNJ32K3FJJACP81R0RQLI43.exe"
  2⤵
  PID:6868
- C:\Users\Admin\Documents\XI7UNXUKSNQUUV6HTMVXB3DY.exe
  "C:\Users\Admin\Documents\XI7UNXUKSNQUUV6HTMVXB3DY.exe"
  2⤵
  PID:6680
- C:\Users\Admin\Documents\OHW70BPLW4161BWCKCSQCLVY.exe
  "C:\Users\Admin\Documents\OHW70BPLW4161BWCKCSQCLVY.exe"
  2⤵
  PID:6504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Documents\OHW70BPLW4161BWCKCSQCLVY.exe"
    3⤵
    PID:9744
- C:\Users\Admin\Documents\WXKO0LKZM5DENW6K3QSDRZ67.exe
  "C:\Users\Admin\Documents\WXKO0LKZM5DENW6K3QSDRZ67.exe"
  2⤵
  PID:6956
- - C:\Users\Admin\Documents\WXKO0LKZM5DENW6K3QSDRZ67.exe
    "C:\Users\Admin\Documents\WXKO0LKZM5DENW6K3QSDRZ67.exe"
    3⤵
    PID:8880
- C:\Users\Admin\Documents\XLKXETO3MTXFS6C49TXGM4O5.exe
  "C:\Users\Admin\Documents\XLKXETO3MTXFS6C49TXGM4O5.exe"
  2⤵
  PID:6992
- C:\Users\Admin\Documents\4HW4Z0L61M0PAWV3RJ239117.exe
  "C:\Users\Admin\Documents\4HW4Z0L61M0PAWV3RJ239117.exe"
  2⤵
  PID:7076
- C:\Users\Admin\Documents\OYE7CZV37P377UDVI0NGFW3M.exe
  "C:\Users\Admin\Documents\OYE7CZV37P377UDVI0NGFW3M.exe"
  2⤵
  PID:6188
- - C:\Users\Admin\AppData\Roaming\3505618.exe
    "C:\Users\Admin\AppData\Roaming\3505618.exe"
    3⤵
    PID:8252
- - C:\Users\Admin\AppData\Roaming\8923688.exe
    "C:\Users\Admin\AppData\Roaming\8923688.exe"
    3⤵
    PID:9444
- C:\Users\Admin\Documents\84YCBU5CPYQBVN4B06SV3Y57.exe
  "C:\Users\Admin\Documents\84YCBU5CPYQBVN4B06SV3Y57.exe"
  2⤵
  PID:2380
- C:\Users\Admin\Documents\SW6E929LG0BRPW7XN0VO99PS.exe
  "C:\Users\Admin\Documents\SW6E929LG0BRPW7XN0VO99PS.exe"
  2⤵
  PID:4940
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:6580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:9068
- C:\Users\Admin\Documents\EGBDGW3EH1NBFTXVJZIJX7N8.exe
  "C:\Users\Admin\Documents\EGBDGW3EH1NBFTXVJZIJX7N8.exe"
  2⤵
  PID:7032
- - C:\Users\Admin\Documents\EGBDGW3EH1NBFTXVJZIJX7N8.exe
    C:\Users\Admin\Documents\EGBDGW3EH1NBFTXVJZIJX7N8.exe
    3⤵
    PID:8556
- C:\Users\Admin\Documents\AXLP5FQJMJD7HPDM81XHIYYO.exe
  "C:\Users\Admin\Documents\AXLP5FQJMJD7HPDM81XHIYYO.exe"
  2⤵
  PID:392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Documents\AXLP5FQJMJD7HPDM81XHIYYO.exe"
    3⤵
    PID:6988
- C:\Users\Admin\Documents\GGVJNV11429HBT2MU0RIEC94.exe
  "C:\Users\Admin\Documents\GGVJNV11429HBT2MU0RIEC94.exe"
  2⤵
  PID:5208
- - C:\Users\Admin\Documents\GGVJNV11429HBT2MU0RIEC94.exe
    C:\Users\Admin\Documents\GGVJNV11429HBT2MU0RIEC94.exe
    3⤵
    PID:8468
- C:\Users\Admin\Documents\5MPIEISJ91549WZ47YH3OWAG.exe
  "C:\Users\Admin\Documents\5MPIEISJ91549WZ47YH3OWAG.exe"
  2⤵
  PID:6932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6932 -s 656
    3⤵
    - Program crash
    PID:8796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6932 -s 680
    3⤵
    - Program crash
    PID:9924
- C:\Users\Admin\Documents\W6L5JFZM87OJV24V06EENTAU.exe
  "C:\Users\Admin\Documents\W6L5JFZM87OJV24V06EENTAU.exe"
  2⤵
  PID:5300
- - C:\Windows\SysWOW64\rUNdlL32.eXe
    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
    3⤵
    PID:6616
- C:\Users\Admin\Documents\8R0W8WVTGO56XQ06K7VYJKP3.exe
  "C:\Users\Admin\Documents\8R0W8WVTGO56XQ06K7VYJKP3.exe"
  2⤵
  PID:6924
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:9424
- C:\Users\Admin\Documents\NPQ66U166BUDT3EJF3Q4ZQSR.exe
  "C:\Users\Admin\Documents\NPQ66U166BUDT3EJF3Q4ZQSR.exe"
  2⤵
  PID:6220
- C:\Users\Admin\Documents\BVUYO0SH2DCTLNIBKEY5PZO3.exe
  "C:\Users\Admin\Documents\BVUYO0SH2DCTLNIBKEY5PZO3.exe"
  2⤵
  PID:5004
- C:\Users\Admin\Documents\NGU31S4YC7JTGZXWW99V6WNQ.exe
  "C:\Users\Admin\Documents\NGU31S4YC7JTGZXWW99V6WNQ.exe"
  2⤵
  PID:6244
- - C:\Users\Admin\Documents\NGU31S4YC7JTGZXWW99V6WNQ.exe
    "C:\Users\Admin\Documents\NGU31S4YC7JTGZXWW99V6WNQ.exe"
    3⤵
    PID:9940
- C:\Users\Admin\Documents\JDFSVJQD50NXIUMF8DD51NGD.exe
  "C:\Users\Admin\Documents\JDFSVJQD50NXIUMF8DD51NGD.exe"
  2⤵
  PID:4828
- C:\Users\Admin\Documents\3MSQ3UD778SZ98EOH5BVUVDQ.exe
  "C:\Users\Admin\Documents\3MSQ3UD778SZ98EOH5BVUVDQ.exe"
  2⤵
  PID:6752
- C:\Users\Admin\Documents\F4H0Q6V02EAO9N4R3LVIG7WY.exe
  "C:\Users\Admin\Documents\F4H0Q6V02EAO9N4R3LVIG7WY.exe"
  2⤵
  PID:5828
- C:\Users\Admin\Documents\4UOAU16HJCK9NNQBM27580P3.exe
  "C:\Users\Admin\Documents\4UOAU16HJCK9NNQBM27580P3.exe"
  2⤵
  PID:7176
- - C:\Users\Admin\Documents\4UOAU16HJCK9NNQBM27580P3.exe
    "C:\Users\Admin\Documents\4UOAU16HJCK9NNQBM27580P3.exe"
    3⤵
    PID:10056
- C:\Users\Admin\Documents\BU1IA4JHHT56RVGAI2F6C4DQ.exe
  "C:\Users\Admin\Documents\BU1IA4JHHT56RVGAI2F6C4DQ.exe"
  2⤵
  PID:7264
- C:\Users\Admin\Documents\4U5OA10EFU89AXHO3D13SUT1.exe
  "C:\Users\Admin\Documents\4U5OA10EFU89AXHO3D13SUT1.exe"
  2⤵
  PID:7352
- - C:\Users\Admin\AppData\Roaming\6297437.exe
    "C:\Users\Admin\AppData\Roaming\6297437.exe"
    3⤵
    PID:9320
- - C:\Users\Admin\AppData\Roaming\8479188.exe
    "C:\Users\Admin\AppData\Roaming\8479188.exe"
    3⤵
    PID:3968
- C:\Users\Admin\Documents\V6WFVT1GQLNP95HQ3107WGAU.exe
  "C:\Users\Admin\Documents\V6WFVT1GQLNP95HQ3107WGAU.exe"
  2⤵
  PID:7404
- C:\Users\Admin\Documents\V0D9DK8KAE2EEUTW32SYJ1P7.exe
  "C:\Users\Admin\Documents\V0D9DK8KAE2EEUTW32SYJ1P7.exe"
  2⤵
  PID:7488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:1664
- C:\Users\Admin\Documents\HEE4XML4LFD2JHQO9MICBYGB.exe
  "C:\Users\Admin\Documents\HEE4XML4LFD2JHQO9MICBYGB.exe"
  2⤵
  PID:7648
- - C:\Users\Admin\Documents\HEE4XML4LFD2JHQO9MICBYGB.exe
    C:\Users\Admin\Documents\HEE4XML4LFD2JHQO9MICBYGB.exe
    3⤵
    PID:3432
- C:\Users\Admin\Documents\5LA03WEP5BT4P1DGNDP5DCLI.exe
  "C:\Users\Admin\Documents\5LA03WEP5BT4P1DGNDP5DCLI.exe"
  2⤵
  PID:7700
- - C:\Users\Admin\Documents\5LA03WEP5BT4P1DGNDP5DCLI.exe
    C:\Users\Admin\Documents\5LA03WEP5BT4P1DGNDP5DCLI.exe
    3⤵
    PID:5784
- C:\Users\Admin\Documents\WA504JHT8CFLAER0LK2SY16Y.exe
  "C:\Users\Admin\Documents\WA504JHT8CFLAER0LK2SY16Y.exe"
  2⤵
  PID:7816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7816 -s 656
    3⤵
    - Program crash
    PID:8664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7816 -s 680
    3⤵
    - Program crash
    PID:9264
- C:\Users\Admin\Documents\VYLLF6NNPFTLYD8ZUA1PEQSW.exe
  "C:\Users\Admin\Documents\VYLLF6NNPFTLYD8ZUA1PEQSW.exe"
  2⤵
  PID:7952
- - C:\Windows\SysWOW64\rUNdlL32.eXe
    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
    3⤵
    PID:9948
- C:\Users\Admin\Documents\I28NSOR5EHFF75NBY255VFCI.exe
  "C:\Users\Admin\Documents\I28NSOR5EHFF75NBY255VFCI.exe"
  2⤵
  PID:8008
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:9524
- C:\Users\Admin\Documents\LC7YAQTEFZDM8A4AXYHR832Y.exe
  "C:\Users\Admin\Documents\LC7YAQTEFZDM8A4AXYHR832Y.exe"
  2⤵
  PID:8072
- C:\Users\Admin\Documents\85I68UJSKJBKYHUSYBVH8PU3.exe
  "C:\Users\Admin\Documents\85I68UJSKJBKYHUSYBVH8PU3.exe"
  2⤵
  PID:8144
- C:\Users\Admin\Documents\WZ1MUXBC00BPQ34YXA9H2BDY.exe
  "C:\Users\Admin\Documents\WZ1MUXBC00BPQ34YXA9H2BDY.exe"
  2⤵
  PID:8172
- C:\Users\Admin\Documents\3T474U6VWDOZPEDGQTEH1T9P.exe
  "C:\Users\Admin\Documents\3T474U6VWDOZPEDGQTEH1T9P.exe"
  2⤵
  PID:7232
- C:\Users\Admin\Documents\PQT1P5ZSKOCP0MXZNQYV35DU.exe
  "C:\Users\Admin\Documents\PQT1P5ZSKOCP0MXZNQYV35DU.exe"
  2⤵
  PID:7432
- - C:\Users\Admin\Documents\PQT1P5ZSKOCP0MXZNQYV35DU.exe
    "C:\Users\Admin\Documents\PQT1P5ZSKOCP0MXZNQYV35DU.exe"
    3⤵
    PID:2156
- C:\Users\Admin\Documents\YMLGMU4391TZSK1T0ZTJXL6G.exe
  "C:\Users\Admin\Documents\YMLGMU4391TZSK1T0ZTJXL6G.exe"
  2⤵
  PID:7760
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Documents\YMLGMU4391TZSK1T0ZTJXL6G.exe"
    3⤵
    PID:9236
- C:\Users\Admin\Documents\7P1PKMBJTORNBEF0O5OABYPE.exe
  "C:\Users\Admin\Documents\7P1PKMBJTORNBEF0O5OABYPE.exe"
  2⤵
  PID:7708
- C:\Users\Admin\Documents\5P4L5NWUN94AEJI8M35M4KYI.exe
  "C:\Users\Admin\Documents\5P4L5NWUN94AEJI8M35M4KYI.exe"
  2⤵
  PID:6400
- - C:\Users\Admin\AppData\Roaming\7806709.exe
    "C:\Users\Admin\AppData\Roaming\7806709.exe"
    3⤵
    PID:9996
- C:\Users\Admin\Documents\WPXI2DJV1W96FXDLQVAQ0NQW.exe
  "C:\Users\Admin\Documents\WPXI2DJV1W96FXDLQVAQ0NQW.exe"
  2⤵
  PID:7812
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:9276
- C:\Users\Admin\Documents\OZT7JV7GMDLBOJP5N7E51RAE.exe
  "C:\Users\Admin\Documents\OZT7JV7GMDLBOJP5N7E51RAE.exe"
  2⤵
  PID:8120
- - C:\Users\Admin\Documents\OZT7JV7GMDLBOJP5N7E51RAE.exe
    C:\Users\Admin\Documents\OZT7JV7GMDLBOJP5N7E51RAE.exe
    3⤵
    PID:7504
- C:\Users\Admin\Documents\2ZVZEFNJ9B4DULLFY3UCMC6H.exe
  "C:\Users\Admin\Documents\2ZVZEFNJ9B4DULLFY3UCMC6H.exe"
  2⤵
  PID:8248
- - C:\Users\Admin\Documents\2ZVZEFNJ9B4DULLFY3UCMC6H.exe
    C:\Users\Admin\Documents\2ZVZEFNJ9B4DULLFY3UCMC6H.exe
    3⤵
    PID:6848
- C:\Users\Admin\Documents\FED3JU56ZPEU9HBHZCBMPMLC.exe
  "C:\Users\Admin\Documents\FED3JU56ZPEU9HBHZCBMPMLC.exe"
  2⤵
  PID:8324
- C:\Users\Admin\Documents\V8G7772Z2OUACUAOG7NEG1FR.exe
  "C:\Users\Admin\Documents\V8G7772Z2OUACUAOG7NEG1FR.exe"
  2⤵
  PID:8368
- C:\Users\Admin\Documents\L8H8QCSI9XT5R0OG26ACKFWE.exe
  "C:\Users\Admin\Documents\L8H8QCSI9XT5R0OG26ACKFWE.exe"
  2⤵
  PID:8420
- C:\Users\Admin\Documents\CXGR9G542ZEUUSYJW1HBNZAI.exe
  "C:\Users\Admin\Documents\CXGR9G542ZEUUSYJW1HBNZAI.exe"
  2⤵
  PID:8616
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    PID:9912
- C:\Users\Admin\Documents\8VS18U31IIHNNK3VFNRY2PHE.exe
  "C:\Users\Admin\Documents\8VS18U31IIHNNK3VFNRY2PHE.exe"
  2⤵
  PID:8764
- C:\Users\Admin\Documents\0T853D1MX7TNYD5H6NLMKL6M.exe
  "C:\Users\Admin\Documents\0T853D1MX7TNYD5H6NLMKL6M.exe"
  2⤵
  PID:8828
- C:\Users\Admin\Documents\8V5AHLQTONBPW78EQ50P1Q6B.exe
  "C:\Users\Admin\Documents\8V5AHLQTONBPW78EQ50P1Q6B.exe"
  2⤵
  PID:8892
- C:\Users\Admin\Documents\RK2PD53OXV7HH1ELR99LCQU8.exe
  "C:\Users\Admin\Documents\RK2PD53OXV7HH1ELR99LCQU8.exe"
  2⤵
  PID:8952
- - C:\Users\Admin\Documents\RK2PD53OXV7HH1ELR99LCQU8.exe
    "C:\Users\Admin\Documents\RK2PD53OXV7HH1ELR99LCQU8.exe"
    3⤵
    PID:8228
- C:\Users\Admin\Documents\PG6PUQVSY4S7TAPTTW2BA06Y.exe
  "C:\Users\Admin\Documents\PG6PUQVSY4S7TAPTTW2BA06Y.exe"
  2⤵
  PID:9008
- C:\Users\Admin\Documents\2NNJBT122AHKO791WO2UXAEE.exe
  "C:\Users\Admin\Documents\2NNJBT122AHKO791WO2UXAEE.exe"
  2⤵
  PID:8516
- C:\Users\Admin\Documents\NPS18CPA5VXBRMQ01FT9WAIL.exe
  "C:\Users\Admin\Documents\NPS18CPA5VXBRMQ01FT9WAIL.exe"
  2⤵
  PID:8824
- C:\Users\Admin\Documents\TP1PXT7YKHZGR4BD5RIZATUF.exe
  "C:\Users\Admin\Documents\TP1PXT7YKHZGR4BD5RIZATUF.exe"
  2⤵
  PID:6556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
    3⤵
    PID:9556
- C:\Users\Admin\Documents\IEIEJNKYQB7Y04ZPAM8CHLTW.exe
  "C:\Users\Admin\Documents\IEIEJNKYQB7Y04ZPAM8CHLTW.exe"
  2⤵
  PID:9684
- C:\Users\Admin\Documents\V96O4AP2OI5A369IM4V4BYKN.exe
  "C:\Users\Admin\Documents\V96O4AP2OI5A369IM4V4BYKN.exe"
  2⤵
  PID:3752
- C:\Users\Admin\Documents\S6JJD4B7YTL16CVM2Z3684PH.exe
  "C:\Users\Admin\Documents\S6JJD4B7YTL16CVM2Z3684PH.exe"
  2⤵
  PID:6880
- C:\Users\Admin\Documents\469TEZTNGGX5JZECFSEVEYZD.exe
  "C:\Users\Admin\Documents\469TEZTNGGX5JZECFSEVEYZD.exe"
  2⤵
  PID:10116
- C:\Users\Admin\Documents\LOEHHJS9244K3GCL4AQI20JY.exe
  "C:\Users\Admin\Documents\LOEHHJS9244K3GCL4AQI20JY.exe"
  2⤵
  PID:10004

C:\Users\Admin\Documents\QTSYPGTHWEY2EBG49YXBVS63.EXE
"C:\Users\Admin\Documents\QTSYPGTHWEY2EBG49YXBVS63.EXE"
1⤵
PID:2684

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
1⤵
- Runs ping.exe
PID:5824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
1⤵
PID:5484

C:\Users\Admin\Documents\UKPY5NB362N0EO60FOJPU7AL.EXE
"C:\Users\Admin\Documents\UKPY5NB362N0EO60FOJPU7AL.EXE"
1⤵
PID:5436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-176-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/932-141-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/1008-358-0x0000000002E80000-0x000000000378C000-memory.dmp

Download

memory/1008-366-0x0000000000400000-0x0000000000D26000-memory.dmp

Download

memory/1092-348-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/1092-347-0x00000000020F0000-0x0000000002181000-memory.dmp

Download

memory/1604-135-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/1604-205-0x000000001B3D0000-0x000000001B3D2000-memory.dmp

Download

memory/1604-147-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download

memory/1604-167-0x0000000000F10000-0x0000000000F30000-memory.dmp

Download

memory/1604-180-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/1724-303-0x000000001B4A0000-0x000000001B4A2000-memory.dmp

Download

memory/2104-346-0x0000000000570000-0x00000000006BA000-memory.dmp

Download

memory/2104-351-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2380-367-0x0000000004A40000-0x0000000005046000-memory.dmp

Download

memory/2588-350-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/3040-359-0x00000000013A0000-0x00000000013B7000-memory.dmp

Download

memory/3088-335-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/3680-114-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download

memory/3680-116-0x00000000011B0000-0x00000000011B2000-memory.dmp

Download

memory/4100-170-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/4100-182-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/4100-153-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download

memory/4100-181-0x00000000056E0000-0x0000000005CE6000-memory.dmp

Download

memory/4100-210-0x0000000005A80000-0x0000000005A81000-memory.dmp

Download

memory/4100-163-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/4100-159-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Download

memory/4120-172-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/4120-192-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/4120-200-0x00000000057F0000-0x00000000057F1000-memory.dmp

Download

memory/4120-184-0x0000000005650000-0x000000000569F000-memory.dmp

Download

memory/4120-218-0x00000000059D0000-0x00000000059D1000-memory.dmp

Download

memory/4120-162-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download

memory/4120-188-0x0000000005600000-0x0000000005AFE000-memory.dmp

Download

memory/4120-169-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/4140-340-0x0000000005050000-0x0000000005656000-memory.dmp

Download

memory/4180-207-0x0000000004D30000-0x000000000522E000-memory.dmp

Download

memory/4180-171-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/4204-343-0x000000001B7A0000-0x000000001B7A2000-memory.dmp

Download

memory/4252-355-0x0000000000460000-0x00000000005AA000-memory.dmp

Download

memory/4252-357-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/4320-302-0x00000000050D0000-0x00000000055CE000-memory.dmp

Download

memory/4376-289-0x0000000004BC0000-0x00000000051C6000-memory.dmp

Download

memory/4376-263-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4440-354-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/4440-353-0x0000000002080000-0x00000000020B0000-memory.dmp

Download

memory/4472-198-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/4472-202-0x0000000000570000-0x00000000006BA000-memory.dmp

Download

memory/4596-206-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/4740-229-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/4740-209-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/4752-336-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/4864-256-0x0000000005690000-0x0000000005691000-memory.dmp

Download

memory/4884-287-0x00000000053F0000-0x0000000005482000-memory.dmp

Download

memory/4896-296-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/4940-365-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download

memory/4948-277-0x0000000004EF0000-0x00000000054F6000-memory.dmp

Download

memory/5036-291-0x00000000057A0000-0x0000000005C9E000-memory.dmp

Download

memory/5152-305-0x0000000004BA0000-0x00000000051A6000-memory.dmp

Download

memory/5192-333-0x0000000004FE0000-0x00000000054DE000-memory.dmp

Download

memory/5204-308-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/5208-363-0x0000000005450000-0x000000000594E000-memory.dmp

Download

memory/5456-334-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/5484-315-0x0000000004B20000-0x0000000005126000-memory.dmp

Download

memory/5760-323-0x0000000004F40000-0x0000000005546000-memory.dmp

Download

memory/5836-326-0x0000000004BB0000-0x00000000051B6000-memory.dmp

Download

memory/5872-328-0x0000000005490000-0x000000000598E000-memory.dmp

Download

memory/5896-338-0x00000000054C0000-0x0000000005AC6000-memory.dmp

Download

memory/5920-331-0x000000001B740000-0x000000001B742000-memory.dmp

Download

memory/5956-368-0x0000000005210000-0x0000000005816000-memory.dmp

Download

memory/5992-325-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/6132-337-0x0000000005640000-0x0000000005C46000-memory.dmp

Download

memory/6156-341-0x00000000053E0000-0x00000000058DE000-memory.dmp

Download

memory/6188-364-0x000000001B190000-0x000000001B192000-memory.dmp

Download

memory/6188-339-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/6228-342-0x0000000004900000-0x0000000004901000-memory.dmp

Download

memory/6344-345-0x00000000055A0000-0x0000000005A9E000-memory.dmp

Download

memory/6408-344-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/6528-349-0x0000000004DA0000-0x00000000053A6000-memory.dmp

Download

memory/6856-352-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/6884-362-0x0000000004D50000-0x0000000005356000-memory.dmp

Download

memory/6952-369-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/6992-356-0x0000000004D60000-0x0000000005366000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads