Analysis

  • max time kernel
    301s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    11-06-2021 02:17

General

  • Target

    5677b9d1528c45370a17cd4b68fc443862d4304ef1bca005c369c8c1d9158a62.exe

  • Size

    3.8MB

  • MD5

    0280fb07ef705ee4bcf30994004271ed

  • SHA1

    b86810d0898b6a85712c3b8c86e24bb1f7b2271b

  • SHA256

    5677b9d1528c45370a17cd4b68fc443862d4304ef1bca005c369c8c1d9158a62

  • SHA512

    338ab8adf9d215ca7a87cd2e12d98c3e8626348f321c05f01ffd1f6688e8e8a75eab64272593187799fad35a2c13b330b1cf2389deffcad17812122d13709945

Malware Config

Extracted

Family

redline

Botnet

10_6_bl

C2

bynthori.xyz:80

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

39.3

Botnet

915

C2

https://bandakere.tumblr.com

Attributes
  • profile_id

    915

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 5 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Vidar Stealer 2 IoCs
  • Blocklisted process makes network request 64 IoCs
  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 64 IoCs
  • VMProtect packed file 10 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 20 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • autoit_exe 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies data under HKEY_USERS 33 IoCs
  • Modifies registry class 41 IoCs
  • Modifies system certificate store 2 TTPs 19 IoCs
  • NTFS ADS 3 IoCs
  • Script User-Agent 16 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:468
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:872
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2920
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1064
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2220
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 7D4D4371ED9FA5C41871A738F8E191DC C
          3⤵
            PID:2376
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding DBA4C412BAB68942468195F427229929
            3⤵
            • Blocklisted process makes network request
            PID:2076
            • C:\Windows\SysWOW64\taskkill.exe
              "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
              4⤵
              • Kills process with taskkill
              PID:2648
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 33575ED459340ED0B1ADCFCBB988986E M Global\MSI0000
            3⤵
              PID:3288
        • C:\Users\Admin\AppData\Local\Temp\5677b9d1528c45370a17cd4b68fc443862d4304ef1bca005c369c8c1d9158a62.exe
          "C:\Users\Admin\AppData\Local\Temp\5677b9d1528c45370a17cd4b68fc443862d4304ef1bca005c369c8c1d9158a62.exe"
          1⤵
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious use of WriteProcessMemory
          PID:1032
          • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
            "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
            2⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1196
            • C:\Users\Admin\AppData\Roaming\6702594.exe
              "C:\Users\Admin\AppData\Roaming\6702594.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1604
            • C:\Users\Admin\AppData\Roaming\8682782.exe
              "C:\Users\Admin\AppData\Roaming\8682782.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              PID:2036
              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                4⤵
                • Executes dropped EXE
                PID:2568
            • C:\Users\Admin\AppData\Roaming\7068473.exe
              "C:\Users\Admin\AppData\Roaming\7068473.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:1708
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                4⤵
                  PID:2780
              • C:\Users\Admin\AppData\Roaming\7434351.exe
                "C:\Users\Admin\AppData\Roaming\7434351.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1120
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 1684
                  4⤵
                  • Loads dropped DLL
                  • Program crash
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2444
            • C:\Users\Admin\AppData\Local\Temp\Files.exe
              "C:\Users\Admin\AppData\Local\Temp\Files.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1988
            • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
              "C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1592
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 192
                3⤵
                • Loads dropped DLL
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2088
            • C:\Users\Admin\AppData\Local\Temp\Install.exe
              "C:\Users\Admin\AppData\Local\Temp\Install.exe"
              2⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:1980
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c taskkill /f /im chrome.exe
                3⤵
                  PID:2960
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    4⤵
                    • Kills process with taskkill
                    PID:3036
              • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2124
                • C:\Windows\SysWOW64\rUNdlL32.eXe
                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                  3⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2748
              • C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe
                "C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2256
                • C:\Users\Admin\AppData\Local\Temp\is-B90D0.tmp\IDWCH1.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-B90D0.tmp\IDWCH1.tmp" /SL5="$10204,506086,422400,C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2488
                  • C:\Users\Admin\AppData\Local\Temp\is-CC6LH.tmp\è8__________________67.exe
                    "C:\Users\Admin\AppData\Local\Temp\is-CC6LH.tmp\è8__________________67.exe" /S /UID=124
                    4⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Program Files directory
                    • Modifies system certificate store
                    PID:3048
                    • C:\Program Files\Google\DVHRPUDBBT\IDownload.exe
                      "C:\Program Files\Google\DVHRPUDBBT\IDownload.exe" /VERYSILENT
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2620
                      • C:\Users\Admin\AppData\Local\Temp\is-MIUJ4.tmp\IDownload.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-MIUJ4.tmp\IDownload.tmp" /SL5="$401FE,994212,425984,C:\Program Files\Google\DVHRPUDBBT\IDownload.exe" /VERYSILENT
                        6⤵
                        • Executes dropped EXE
                        PID:1560
                    • C:\Users\Admin\AppData\Local\Temp\b6-5faad-bc8-a768e-bd73c19b741e5\Rylehaemici.exe
                      "C:\Users\Admin\AppData\Local\Temp\b6-5faad-bc8-a768e-bd73c19b741e5\Rylehaemici.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:2652
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                        6⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:2816
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
                          7⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:260
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:865285 /prefetch:2
                          7⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:3764
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:668690 /prefetch:2
                          7⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:2032
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
                        6⤵
                          PID:3724
                      • C:\Users\Admin\AppData\Local\Temp\cc-355e4-d1c-b36ae-1223f2238eb0a\Mofucyshani.exe
                        "C:\Users\Admin\AppData\Local\Temp\cc-355e4-d1c-b36ae-1223f2238eb0a\Mofucyshani.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:2272
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\toatve31.1p5\001.exe & exit
                          6⤵
                            PID:2544
                            • C:\Users\Admin\AppData\Local\Temp\toatve31.1p5\001.exe
                              C:\Users\Admin\AppData\Local\Temp\toatve31.1p5\001.exe
                              7⤵
                              • Executes dropped EXE
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              PID:1768
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ablrertg.flj\GcleanerEU.exe /eufive & exit
                            6⤵
                              PID:2052
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ywn2jeam.moj\installer.exe /qn CAMPAIGN="654" & exit
                              6⤵
                                PID:1308
                                • C:\Users\Admin\AppData\Local\Temp\ywn2jeam.moj\installer.exe
                                  C:\Users\Admin\AppData\Local\Temp\ywn2jeam.moj\installer.exe /qn CAMPAIGN="654"
                                  7⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Enumerates connected drives
                                  • Modifies system certificate store
                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                  • Suspicious use of FindShellTrayWindow
                                  PID:2720
                                  • C:\Windows\SysWOW64\msiexec.exe
                                    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ywn2jeam.moj\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ywn2jeam.moj\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1623125554 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                    8⤵
                                      PID:1948
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pbd2tsuo.fia\gaoou.exe & exit
                                  6⤵
                                    PID:2096
                                    • C:\Users\Admin\AppData\Local\Temp\pbd2tsuo.fia\gaoou.exe
                                      C:\Users\Admin\AppData\Local\Temp\pbd2tsuo.fia\gaoou.exe
                                      7⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                      PID:2988
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        8⤵
                                        • Executes dropped EXE
                                        PID:3004
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        8⤵
                                        • Executes dropped EXE
                                        PID:2648
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tbxhqp1q.bxf\Setup3310.exe /Verysilent /subid=623 & exit
                                    6⤵
                                      PID:2512
                                      • C:\Users\Admin\AppData\Local\Temp\tbxhqp1q.bxf\Setup3310.exe
                                        C:\Users\Admin\AppData\Local\Temp\tbxhqp1q.bxf\Setup3310.exe /Verysilent /subid=623
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                        PID:2396
                                        • C:\Users\Admin\AppData\Local\Temp\is-5HUUV.tmp\Setup3310.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-5HUUV.tmp\Setup3310.tmp" /SL5="$102D2,138429,56832,C:\Users\Admin\AppData\Local\Temp\tbxhqp1q.bxf\Setup3310.exe" /Verysilent /subid=623
                                          8⤵
                                          • Executes dropped EXE
                                          • Modifies system certificate store
                                          • Suspicious use of FindShellTrayWindow
                                          PID:2740
                                          • C:\Users\Admin\AppData\Local\Temp\is-VNBDI.tmp\Setup.exe
                                            "C:\Users\Admin\AppData\Local\Temp\is-VNBDI.tmp\Setup.exe" /Verysilent
                                            9⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            PID:1288
                                            • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                              "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                              10⤵
                                              • Executes dropped EXE
                                              PID:2360
                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                11⤵
                                                • Executes dropped EXE
                                                PID:628
                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                11⤵
                                                • Executes dropped EXE
                                                PID:3112
                                            • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                              "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                              10⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              PID:2400
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                11⤵
                                                  PID:3824
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /im RunWW.exe /f
                                                    12⤵
                                                    • Kills process with taskkill
                                                    PID:3848
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout /t 6
                                                    12⤵
                                                    • Delays execution with timeout.exe
                                                    PID:3908
                                              • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                10⤵
                                                • Executes dropped EXE
                                                PID:2492
                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                  11⤵
                                                  • Modifies registry class
                                                  PID:1252
                                              • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                10⤵
                                                • Executes dropped EXE
                                                PID:2276
                                                • C:\Users\Admin\AppData\Local\Temp\is-84JH6.tmp\lylal220.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-84JH6.tmp\lylal220.tmp" /SL5="$203DE,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                  11⤵
                                                  • Executes dropped EXE
                                                  PID:2192
                                                  • C:\Users\Admin\AppData\Local\Temp\is-FOG36.tmp\56FT____________________.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\is-FOG36.tmp\56FT____________________.exe" /S /UID=lylal220
                                                    12⤵
                                                    • Drops file in Drivers directory
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Drops file in Program Files directory
                                                    PID:1816
                                                    • C:\Program Files\Reference Assemblies\GLPSWZOAED\irecord.exe
                                                      "C:\Program Files\Reference Assemblies\GLPSWZOAED\irecord.exe" /VERYSILENT
                                                      13⤵
                                                      • Executes dropped EXE
                                                      PID:1596
                                                      • C:\Users\Admin\AppData\Local\Temp\is-KF7HA.tmp\irecord.tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\is-KF7HA.tmp\irecord.tmp" /SL5="$602C6,6139911,56832,C:\Program Files\Reference Assemblies\GLPSWZOAED\irecord.exe" /VERYSILENT
                                                        14⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        PID:3144
                                                        • C:\Program Files (x86)\recording\i-record.exe
                                                          "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                          15⤵
                                                          • Executes dropped EXE
                                                          PID:3268
                                                    • C:\Users\Admin\AppData\Local\Temp\86-ec95b-2fc-7f6a3-b9a82220fcc45\Vatylejawe.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\86-ec95b-2fc-7f6a3-b9a82220fcc45\Vatylejawe.exe"
                                                      13⤵
                                                      • Executes dropped EXE
                                                      PID:3164
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                        14⤵
                                                          PID:3044
                                                      • C:\Users\Admin\AppData\Local\Temp\e0-639b2-17d-00587-ff7a5b9d9e0f3\Tefolaesaeqo.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\e0-639b2-17d-00587-ff7a5b9d9e0f3\Tefolaesaeqo.exe"
                                                        13⤵
                                                        • Executes dropped EXE
                                                        PID:3340
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qqr44bqh.s0f\001.exe & exit
                                                          14⤵
                                                            PID:3224
                                                            • C:\Users\Admin\AppData\Local\Temp\qqr44bqh.s0f\001.exe
                                                              C:\Users\Admin\AppData\Local\Temp\qqr44bqh.s0f\001.exe
                                                              15⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                              PID:4056
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xj20h0nx.iqs\GcleanerEU.exe /eufive & exit
                                                            14⤵
                                                              PID:3860
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v3no2qk1.ts1\installer.exe /qn CAMPAIGN="654" & exit
                                                              14⤵
                                                                PID:3940
                                                                • C:\Users\Admin\AppData\Local\Temp\v3no2qk1.ts1\installer.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\v3no2qk1.ts1\installer.exe /qn CAMPAIGN="654"
                                                                  15⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                  PID:2036
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n1lfnabs.xmx\gaoou.exe & exit
                                                                14⤵
                                                                  PID:1412
                                                                  • C:\Users\Admin\AppData\Local\Temp\n1lfnabs.xmx\gaoou.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\n1lfnabs.xmx\gaoou.exe
                                                                    15⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                    PID:3120
                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                      16⤵
                                                                      • Executes dropped EXE
                                                                      PID:3528
                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                      16⤵
                                                                      • Executes dropped EXE
                                                                      PID:1396
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tzujva3.npm\Setup3310.exe /Verysilent /subid=623 & exit
                                                                  14⤵
                                                                    PID:2520
                                                                    • C:\Users\Admin\AppData\Local\Temp\2tzujva3.npm\Setup3310.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2tzujva3.npm\Setup3310.exe /Verysilent /subid=623
                                                                      15⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                      PID:2956
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-03B6M.tmp\Setup3310.tmp
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-03B6M.tmp\Setup3310.tmp" /SL5="$10504,138429,56832,C:\Users\Admin\AppData\Local\Temp\2tzujva3.npm\Setup3310.exe" /Verysilent /subid=623
                                                                        16⤵
                                                                        • Executes dropped EXE
                                                                        PID:3216
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-UFRE9.tmp\Setup.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-UFRE9.tmp\Setup.exe" /Verysilent
                                                                          17⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          PID:1720
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ucqt5eq3.4zo\google-game.exe & exit
                                                                    14⤵
                                                                      PID:4092
                                                                      • C:\Users\Admin\AppData\Local\Temp\ucqt5eq3.4zo\google-game.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\ucqt5eq3.4zo\google-game.exe
                                                                        15⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                        PID:3140
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\afhknnxy.eeb\005.exe & exit
                                                                      14⤵
                                                                        PID:3112
                                                                        • C:\Users\Admin\AppData\Local\Temp\afhknnxy.eeb\005.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\afhknnxy.eeb\005.exe
                                                                          15⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                          PID:1800
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3isvf22j.2iu\GcleanerWW.exe /mixone & exit
                                                                        14⤵
                                                                          PID:2184
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tktzobit.3an\702564a0.exe & exit
                                                                          14⤵
                                                                            PID:3832
                                                                            • C:\Users\Admin\AppData\Local\Temp\tktzobit.3an\702564a0.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\tktzobit.3an\702564a0.exe
                                                                              15⤵
                                                                              • Executes dropped EXE
                                                                              • Checks SCSI registry key(s)
                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              PID:900
                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                    10⤵
                                                                    • Executes dropped EXE
                                                                    PID:2664
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-KRFSD.tmp\LabPicV3.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-KRFSD.tmp\LabPicV3.tmp" /SL5="$103E2,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                      11⤵
                                                                      • Executes dropped EXE
                                                                      PID:1648
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-CHGID.tmp\_____________.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-CHGID.tmp\_____________.exe" /S /UID=lab214
                                                                        12⤵
                                                                        • Drops file in Drivers directory
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Drops file in Program Files directory
                                                                        PID:1820
                                                                        • C:\Program Files\Java\HIYAFDCHPQ\prolab.exe
                                                                          "C:\Program Files\Java\HIYAFDCHPQ\prolab.exe" /VERYSILENT
                                                                          13⤵
                                                                          • Executes dropped EXE
                                                                          PID:3384
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-T5SP4.tmp\prolab.tmp
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-T5SP4.tmp\prolab.tmp" /SL5="$502CE,575243,216576,C:\Program Files\Java\HIYAFDCHPQ\prolab.exe" /VERYSILENT
                                                                            14⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            PID:3392
                                                                        • C:\Users\Admin\AppData\Local\Temp\ca-63186-422-38a8b-93e8b435f2e30\Cumaexypama.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\ca-63186-422-38a8b-93e8b435f2e30\Cumaexypama.exe"
                                                                          13⤵
                                                                          • Executes dropped EXE
                                                                          PID:3420
                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                            14⤵
                                                                              PID:3732
                                                                          • C:\Users\Admin\AppData\Local\Temp\49-ebe52-a4e-0488c-fac5a3b374bcd\Qylobumato.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\49-ebe52-a4e-0488c-fac5a3b374bcd\Qylobumato.exe"
                                                                            13⤵
                                                                            • Executes dropped EXE
                                                                            PID:3504
                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\Cube_WW.exe
                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\Cube_WW.exe"
                                                                      10⤵
                                                                      • Executes dropped EXE
                                                                      PID:2964
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e0ksoqvv.ihf\google-game.exe & exit
                                                              6⤵
                                                                PID:1196
                                                                • C:\Users\Admin\AppData\Local\Temp\e0ksoqvv.ihf\google-game.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\e0ksoqvv.ihf\google-game.exe
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                  PID:3060
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qnsoc3lr.cck\005.exe & exit
                                                                6⤵
                                                                  PID:2380
                                                                  • C:\Users\Admin\AppData\Local\Temp\qnsoc3lr.cck\005.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\qnsoc3lr.cck\005.exe
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                    PID:2584
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xund1k5f.end\GcleanerWW.exe /mixone & exit
                                                                  6⤵
                                                                    PID:2532
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1fsisbr4.0sz\702564a0.exe & exit
                                                                    6⤵
                                                                      PID:4044
                                                                      • C:\Users\Admin\AppData\Local\Temp\1fsisbr4.0sz\702564a0.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\1fsisbr4.0sz\702564a0.exe
                                                                        7⤵
                                                                        • Executes dropped EXE
                                                                        • Checks SCSI registry key(s)
                                                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        PID:4072
                                                            • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Adds Run key to start application
                                                              PID:2340
                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:2556
                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2180
                                                            • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks SCSI registry key(s)
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: MapViewOfSection
                                                              PID:2384
                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1688
                                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
                                                              2⤵
                                                              • Modifies Internet Explorer settings
                                                              • NTFS ADS
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:760
                                                          • C:\Users\Admin\AppData\Local\Temp\D02B.exe
                                                            C:\Users\Admin\AppData\Local\Temp\D02B.exe
                                                            1⤵
                                                            • Suspicious use of SetThreadContext
                                                            PID:3188
                                                            • C:\Users\Admin\AppData\Local\Temp\D02B.exe
                                                              C:\Users\Admin\AppData\Local\Temp\D02B.exe
                                                              2⤵
                                                              • Adds Run key to start application
                                                              PID:304
                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                icacls "C:\Users\Admin\AppData\Local\b5f17702-66cf-4d01-93f2-19dd820b3b74" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                3⤵
                                                                • Modifies file permissions
                                                                PID:2076
                                                              • C:\Users\Admin\AppData\Local\Temp\D02B.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\D02B.exe" --Admin IsNotAutoStart IsNotTask
                                                                3⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:2432
                                                                • C:\Users\Admin\AppData\Local\Temp\D02B.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\D02B.exe" --Admin IsNotAutoStart IsNotTask
                                                                  4⤵
                                                                    PID:792
                                                                    • C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\updatewin1.exe
                                                                      "C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\updatewin1.exe"
                                                                      5⤵
                                                                        PID:3080
                                                                        • C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\updatewin1.exe
                                                                          "C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\updatewin1.exe" --Admin
                                                                          6⤵
                                                                            PID:3864
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
                                                                              7⤵
                                                                                PID:3868
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"
                                                                                7⤵
                                                                                  PID:2452
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps1
                                                                                    8⤵
                                                                                      PID:2788
                                                                                  • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                                    "C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all
                                                                                    7⤵
                                                                                    • Deletes Windows Defender Definitions
                                                                                    PID:2324
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
                                                                                    7⤵
                                                                                      PID:1864
                                                                                • C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\updatewin2.exe
                                                                                  "C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\updatewin2.exe"
                                                                                  5⤵
                                                                                  • Drops file in Drivers directory
                                                                                  PID:2320
                                                                                • C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\5.exe
                                                                                  "C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\5.exe"
                                                                                  5⤵
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:2872
                                                                                  • C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\5.exe
                                                                                    "C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\5.exe"
                                                                                    6⤵
                                                                                    • Checks processor information in registry
                                                                                    PID:3872
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\fa509869-3c95-4a2b-8a32-a3df41195778\5.exe" & del C:\ProgramData\*.dll & exit
                                                                                      7⤵
                                                                                        PID:700
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill /im 5.exe /f
                                                                                          8⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:3704
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout /t 6
                                                                                          8⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:3560
                                                                          • C:\Users\Admin\AppData\Local\Temp\752.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\752.exe
                                                                            1⤵
                                                                              PID:2516

                                                                            Network

                                                                            MITRE ATT&CK Matrix ATT&CK v6

                                                                            Execution

                                                                            Command-Line Interface

                                                                            1
                                                                            T1059

                                                                            Persistence

                                                                            Modify Existing Service

                                                                            1
                                                                            T1031

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1060

                                                                            Defense Evasion

                                                                            Impair Defenses

                                                                            1
                                                                            T1562

                                                                            Modify Registry

                                                                            4
                                                                            T1112

                                                                            Disabling Security Tools

                                                                            1
                                                                            T1089

                                                                            File Permissions Modification

                                                                            1
                                                                            T1222

                                                                            Install Root Certificate

                                                                            1
                                                                            T1130

                                                                            Credential Access

                                                                            Credentials in Files

                                                                            3
                                                                            T1081

                                                                            Discovery

                                                                            Software Discovery

                                                                            1
                                                                            T1518

                                                                            Query Registry

                                                                            4
                                                                            T1012

                                                                            System Information Discovery

                                                                            5
                                                                            T1082

                                                                            Peripheral Device Discovery

                                                                            2
                                                                            T1120

                                                                            Collection

                                                                            Data from Local System

                                                                            3
                                                                            T1005

                                                                            Command and Control

                                                                            Web Service

                                                                            1
                                                                            T1102

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                              MD5

                                                                              6045baccf49e1eba0e674945311a06e6

                                                                              SHA1

                                                                              379c6234849eecede26fad192c2ee59e0f0221cb

                                                                              SHA256

                                                                              65830a65cb913bee83258e4ac3e140faf131e7eb084d39f7020c7acc825b0a58

                                                                              SHA512

                                                                              da32af6a730884e73956e4eb6bff61a1326b3ef8ba0a213b5b4aad6de4fbd471b3550b6ac2110f1d0b2091e33c70d44e498f897376f8e1998b1d2afac789abeb

                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                              MD5

                                                                              4c58933c0a3d912eb329518931c28f3f

                                                                              SHA1

                                                                              5bfb2ba7377556e713263fa7c0435e24670341d1

                                                                              SHA256

                                                                              8ec596aed018638e24656ef1084375e0b7dd44b6b99dcccc20fee59465c078a8

                                                                              SHA512

                                                                              2c0f5c5e9ca0948514125264b6868cfddfaab14dd71a764d667a2c8663e4c6dc280ce86c3b7f75bad1bf423fbc639d247e08d742adb6ad4e6e9cd462b9d4f6f3

                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                              MD5

                                                                              f76b067cc1d7311609e1027ec7246c02

                                                                              SHA1

                                                                              bf9fd1a92ec5336cf8c6dae5a8ef08f46456db28

                                                                              SHA256

                                                                              cf89251aec2013a26bbfdd257471b1621b208a278dacac6ce9cb58cfc5546383

                                                                              SHA512

                                                                              774192a9fe07a8f2a35f842cd2acfa490ae17c54e527352598d2248b045c5a7810c3f6f13e75d874a757261c4061d59c4d5b2c013c14cc93497c33457b7c8c49

                                                                            • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                                              MD5

                                                                              9a9d304d3dd34143dd6badd11cd83401

                                                                              SHA1

                                                                              5f46c8944561d710c34ef803d18ddc7c29e96cc9

                                                                              SHA256

                                                                              76111e57855df9b201053648c1f7eaf68ac01c60ec1caaab4cd20c4633a1e99b

                                                                              SHA512

                                                                              b9abd29025a493c22de577d8549e2797b97d37bcb7ed940d46960a568ef508d3188f52af73900d384f81c4318e164b47b9f42454c55ae392726a77f38352c42d

                                                                            • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                                              MD5

                                                                              9a9d304d3dd34143dd6badd11cd83401

                                                                              SHA1

                                                                              5f46c8944561d710c34ef803d18ddc7c29e96cc9

                                                                              SHA256

                                                                              76111e57855df9b201053648c1f7eaf68ac01c60ec1caaab4cd20c4633a1e99b

                                                                              SHA512

                                                                              b9abd29025a493c22de577d8549e2797b97d37bcb7ed940d46960a568ef508d3188f52af73900d384f81c4318e164b47b9f42454c55ae392726a77f38352c42d

                                                                            • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe
                                                                              MD5

                                                                              8356744bdb06ed38348f451fd91ac34a

                                                                              SHA1

                                                                              512b22a76932a80652eb16dfadd690344582d4d9

                                                                              SHA256

                                                                              11fde3c052cc436dae10fa4c0b1821406d091cebb227a832a4f4c4101f21ffb4

                                                                              SHA512

                                                                              2dd6d06fc9613e7feb147d8f631ae62d9b83555a79349b6d2a161ff21253f478e06534c1eb685cfadc604010f75f6235ca2dd06bee165936999bc38e7e2069f8

                                                                            • C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe
                                                                              MD5

                                                                              8356744bdb06ed38348f451fd91ac34a

                                                                              SHA1

                                                                              512b22a76932a80652eb16dfadd690344582d4d9

                                                                              SHA256

                                                                              11fde3c052cc436dae10fa4c0b1821406d091cebb227a832a4f4c4101f21ffb4

                                                                              SHA512

                                                                              2dd6d06fc9613e7feb147d8f631ae62d9b83555a79349b6d2a161ff21253f478e06534c1eb685cfadc604010f75f6235ca2dd06bee165936999bc38e7e2069f8

                                                                            • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                              MD5

                                                                              3e648a55b7add96eee6663a766cd1ce1

                                                                              SHA1

                                                                              5fbca3f597d061e944a51776188fe9761f6bb0a7

                                                                              SHA256

                                                                              4e322d00fdf7a75002ba41823e54c684cc133798342ee110f583c667589678e0

                                                                              SHA512

                                                                              669207d637b18ae4a035ecedfcac1f1629f01755cac1a27a347d287a3421cd81cc8ccaaa4dc39e3069248ea84424b5519cf595169dea4e7459cbbcf702a511bc

                                                                            • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                              MD5

                                                                              9942af4949587dfd3682c125a583e184

                                                                              SHA1

                                                                              6fc54d693025f2a47f938cbc529809f605c52cc7

                                                                              SHA256

                                                                              0d4ce43a12fcd1e992bb4757d9cc544419d4408172658e7982e91d8c891db9b4

                                                                              SHA512

                                                                              facdbb40cf6071b4ab74af1cd7290e2e96d8d4f74bf5a5c6cf2b64955b43354fbb370f860f45ce647e79472435c4037b447f965c887ae5e4f276d1dcbc1fb52c

                                                                            • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                              MD5

                                                                              9942af4949587dfd3682c125a583e184

                                                                              SHA1

                                                                              6fc54d693025f2a47f938cbc529809f605c52cc7

                                                                              SHA256

                                                                              0d4ce43a12fcd1e992bb4757d9cc544419d4408172658e7982e91d8c891db9b4

                                                                              SHA512

                                                                              facdbb40cf6071b4ab74af1cd7290e2e96d8d4f74bf5a5c6cf2b64955b43354fbb370f860f45ce647e79472435c4037b447f965c887ae5e4f276d1dcbc1fb52c

                                                                            • C:\Users\Admin\AppData\Local\Temp\Samk.url
                                                                              MD5

                                                                              3e02b06ed8f0cc9b6ac6a40aa3ebc728

                                                                              SHA1

                                                                              fb038ee5203be9736cbf55c78e4c0888185012ad

                                                                              SHA256

                                                                              c0cbd06f9659d71c08912f27e0499f32ed929785d5c5dc1fc46d07199f5a24ea

                                                                              SHA512

                                                                              44cbbaee576f978deaa5d8bd9e54560e4aa972dfdd6b68389e783e838e36f0903565b0e978cf8f4f20c8b231d3879d3552ebb7a8c4e89e36692291c7c3ffcf00

                                                                            • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                              MD5

                                                                              57aed740aecdf6174b1fccad324f9d8d

                                                                              SHA1

                                                                              5809263fee371041afc3cffbb6edb000e324c5af

                                                                              SHA256

                                                                              e8f2db9b0b7a0dd3abf09ee4aa176b1a7a0dc9d2fd2cf963ed6c91cb5357d850

                                                                              SHA512

                                                                              f76ed5aef2d37af84b0b60707bc867172e35dd50ba04b8348cd51786c00fb50571ced744fce2b4c0d478c9d633964e2706279a1f0d9c13f1038c878c356f5f27

                                                                            • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                              MD5

                                                                              ecec67e025fcd37f5d6069b5ff5105ed

                                                                              SHA1

                                                                              9a5a0bed2212f47071ad27b28fe407746ecfad18

                                                                              SHA256

                                                                              51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

                                                                              SHA512

                                                                              a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

                                                                            • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                              MD5

                                                                              ecec67e025fcd37f5d6069b5ff5105ed

                                                                              SHA1

                                                                              9a5a0bed2212f47071ad27b28fe407746ecfad18

                                                                              SHA256

                                                                              51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

                                                                              SHA512

                                                                              a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

                                                                            • C:\Users\Admin\AppData\Roaming\6702594.exe
                                                                              MD5

                                                                              c6829d9105138978634156895c4736ed

                                                                              SHA1

                                                                              f244fbc67b11983ce2aa471f2f0f57f55272940e

                                                                              SHA256

                                                                              974907ea9c0d863c58c3fa0d57baf1b1395a0ad29ead2b49615ea410d607a46a

                                                                              SHA512

                                                                              eb2f4787777f9ff7b018b9d782b92d31eadaa6cc14c61f4bba9ddb80391c81640baaf9bf38da6855d3ac3ec6e7c3f81df2da03c4792e360a35dec3e3769d6540

                                                                            • C:\Users\Admin\AppData\Roaming\6702594.exe
                                                                              MD5

                                                                              c6829d9105138978634156895c4736ed

                                                                              SHA1

                                                                              f244fbc67b11983ce2aa471f2f0f57f55272940e

                                                                              SHA256

                                                                              974907ea9c0d863c58c3fa0d57baf1b1395a0ad29ead2b49615ea410d607a46a

                                                                              SHA512

                                                                              eb2f4787777f9ff7b018b9d782b92d31eadaa6cc14c61f4bba9ddb80391c81640baaf9bf38da6855d3ac3ec6e7c3f81df2da03c4792e360a35dec3e3769d6540

                                                                            • C:\Users\Admin\AppData\Roaming\7068473.exe
                                                                              MD5

                                                                              74e9c5c12b83da257900424308e8be03

                                                                              SHA1

                                                                              d0cad3f79f6fed61df45c9bfdbab754e41094953

                                                                              SHA256

                                                                              0d6a71276d654664c8f317225e7dbf0a66d3ee594a109dc7733cf785dfd75349

                                                                              SHA512

                                                                              58b54c979f3309e7fe81ba6b8e1a8e2041b39ff2bb8eb164713af801ba37182f54797ad415b6b82f2013fb7ff058a5d38d7c0e131f930b830e8fb32121d52b68

                                                                            • C:\Users\Admin\AppData\Roaming\7068473.exe
                                                                              MD5

                                                                              74e9c5c12b83da257900424308e8be03

                                                                              SHA1

                                                                              d0cad3f79f6fed61df45c9bfdbab754e41094953

                                                                              SHA256

                                                                              0d6a71276d654664c8f317225e7dbf0a66d3ee594a109dc7733cf785dfd75349

                                                                              SHA512

                                                                              58b54c979f3309e7fe81ba6b8e1a8e2041b39ff2bb8eb164713af801ba37182f54797ad415b6b82f2013fb7ff058a5d38d7c0e131f930b830e8fb32121d52b68

                                                                            • C:\Users\Admin\AppData\Roaming\7434351.exe
                                                                              MD5

                                                                              76f416778dfd0f70545c0703cb281e35

                                                                              SHA1

                                                                              80caa41101d0fc328270a33225c9ad0d3909cf51

                                                                              SHA256

                                                                              1ed2f92444fb32987dc40898160b95448a277745df7e0600244d32039b1004ae

                                                                              SHA512

                                                                              581137cf9a4c9c6e2be2baf312114495e8fc8e1887a6a7073bc65094cf85b76625fee3dcde2efa336d3107d2607c693b64bdfe9c1da973aae5d9fe6ab00472ca

                                                                            • C:\Users\Admin\AppData\Roaming\7434351.exe
                                                                              MD5

                                                                              76f416778dfd0f70545c0703cb281e35

                                                                              SHA1

                                                                              80caa41101d0fc328270a33225c9ad0d3909cf51

                                                                              SHA256

                                                                              1ed2f92444fb32987dc40898160b95448a277745df7e0600244d32039b1004ae

                                                                              SHA512

                                                                              581137cf9a4c9c6e2be2baf312114495e8fc8e1887a6a7073bc65094cf85b76625fee3dcde2efa336d3107d2607c693b64bdfe9c1da973aae5d9fe6ab00472ca

                                                                            • C:\Users\Admin\AppData\Roaming\8682782.exe
                                                                              MD5

                                                                              bcc25c08b993d97de75b279b19a8f644

                                                                              SHA1

                                                                              9ad3d93428e52022f3822d4bf86a0b49dd9c7b02

                                                                              SHA256

                                                                              6ed857fe106b8c6c34fd36f6db3c6da4ff587943486fe385a4738ee42d70812c

                                                                              SHA512

                                                                              f2e947de4269e08f1da57972e0c2face5167cf274d82098a516867528fe49aaa4cc890b9deb467ff09186aad2e56bea07e04049994860d31d9dca2fbac6bbd44

                                                                            • C:\Users\Admin\AppData\Roaming\8682782.exe
                                                                              MD5

                                                                              bcc25c08b993d97de75b279b19a8f644

                                                                              SHA1

                                                                              9ad3d93428e52022f3822d4bf86a0b49dd9c7b02

                                                                              SHA256

                                                                              6ed857fe106b8c6c34fd36f6db3c6da4ff587943486fe385a4738ee42d70812c

                                                                              SHA512

                                                                              f2e947de4269e08f1da57972e0c2face5167cf274d82098a516867528fe49aaa4cc890b9deb467ff09186aad2e56bea07e04049994860d31d9dca2fbac6bbd44

                                                                            • \Users\Admin\AppData\Local\Temp\Files.exe
                                                                              MD5

                                                                              9a9d304d3dd34143dd6badd11cd83401

                                                                              SHA1

                                                                              5f46c8944561d710c34ef803d18ddc7c29e96cc9

                                                                              SHA256

                                                                              76111e57855df9b201053648c1f7eaf68ac01c60ec1caaab4cd20c4633a1e99b

                                                                              SHA512

                                                                              b9abd29025a493c22de577d8549e2797b97d37bcb7ed940d46960a568ef508d3188f52af73900d384f81c4318e164b47b9f42454c55ae392726a77f38352c42d

                                                                            • \Users\Admin\AppData\Local\Temp\Files.exe
                                                                              MD5

                                                                              9a9d304d3dd34143dd6badd11cd83401

                                                                              SHA1

                                                                              5f46c8944561d710c34ef803d18ddc7c29e96cc9

                                                                              SHA256

                                                                              76111e57855df9b201053648c1f7eaf68ac01c60ec1caaab4cd20c4633a1e99b

                                                                              SHA512

                                                                              b9abd29025a493c22de577d8549e2797b97d37bcb7ed940d46960a568ef508d3188f52af73900d384f81c4318e164b47b9f42454c55ae392726a77f38352c42d

                                                                            • \Users\Admin\AppData\Local\Temp\Files.exe
                                                                              MD5

                                                                              9a9d304d3dd34143dd6badd11cd83401

                                                                              SHA1

                                                                              5f46c8944561d710c34ef803d18ddc7c29e96cc9

                                                                              SHA256

                                                                              76111e57855df9b201053648c1f7eaf68ac01c60ec1caaab4cd20c4633a1e99b

                                                                              SHA512

                                                                              b9abd29025a493c22de577d8549e2797b97d37bcb7ed940d46960a568ef508d3188f52af73900d384f81c4318e164b47b9f42454c55ae392726a77f38352c42d

                                                                            • \Users\Admin\AppData\Local\Temp\Files.exe
                                                                              MD5

                                                                              9a9d304d3dd34143dd6badd11cd83401

                                                                              SHA1

                                                                              5f46c8944561d710c34ef803d18ddc7c29e96cc9

                                                                              SHA256

                                                                              76111e57855df9b201053648c1f7eaf68ac01c60ec1caaab4cd20c4633a1e99b

                                                                              SHA512

                                                                              b9abd29025a493c22de577d8549e2797b97d37bcb7ed940d46960a568ef508d3188f52af73900d384f81c4318e164b47b9f42454c55ae392726a77f38352c42d

                                                                            • \Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • \Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • \Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • \Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • \Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • \Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • \Users\Admin\AppData\Local\Temp\Folder.exe
                                                                              MD5

                                                                              3370bac8fe4a77f5f61b211e9948fe01

                                                                              SHA1

                                                                              218973df368a3df0da81eb13bce69d9d951c856b

                                                                              SHA256

                                                                              6c502b940675de500ab71b2631df2f51bde8d7ee1d7667159acd25df5e0bb3aa

                                                                              SHA512

                                                                              876cd48a59c884f1a1b11559f09293cd941f09a71173f59401908c4449456f04c83e1ea77a907c0b6b93bf12db15b57587a22aade41940a07a3dd85f5048be23

                                                                            • \Users\Admin\AppData\Local\Temp\IDWCH1.exe
                                                                              MD5

                                                                              8356744bdb06ed38348f451fd91ac34a

                                                                              SHA1

                                                                              512b22a76932a80652eb16dfadd690344582d4d9

                                                                              SHA256

                                                                              11fde3c052cc436dae10fa4c0b1821406d091cebb227a832a4f4c4101f21ffb4

                                                                              SHA512

                                                                              2dd6d06fc9613e7feb147d8f631ae62d9b83555a79349b6d2a161ff21253f478e06534c1eb685cfadc604010f75f6235ca2dd06bee165936999bc38e7e2069f8

                                                                            • \Users\Admin\AppData\Local\Temp\IDWCH1.exe
                                                                              MD5

                                                                              8356744bdb06ed38348f451fd91ac34a

                                                                              SHA1

                                                                              512b22a76932a80652eb16dfadd690344582d4d9

                                                                              SHA256

                                                                              11fde3c052cc436dae10fa4c0b1821406d091cebb227a832a4f4c4101f21ffb4

                                                                              SHA512

                                                                              2dd6d06fc9613e7feb147d8f631ae62d9b83555a79349b6d2a161ff21253f478e06534c1eb685cfadc604010f75f6235ca2dd06bee165936999bc38e7e2069f8

                                                                            • \Users\Admin\AppData\Local\Temp\IDWCH1.exe
                                                                              MD5

                                                                              8356744bdb06ed38348f451fd91ac34a

                                                                              SHA1

                                                                              512b22a76932a80652eb16dfadd690344582d4d9

                                                                              SHA256

                                                                              11fde3c052cc436dae10fa4c0b1821406d091cebb227a832a4f4c4101f21ffb4

                                                                              SHA512

                                                                              2dd6d06fc9613e7feb147d8f631ae62d9b83555a79349b6d2a161ff21253f478e06534c1eb685cfadc604010f75f6235ca2dd06bee165936999bc38e7e2069f8

                                                                            • \Users\Admin\AppData\Local\Temp\IDWCH1.exe
                                                                              MD5

                                                                              8356744bdb06ed38348f451fd91ac34a

                                                                              SHA1

                                                                              512b22a76932a80652eb16dfadd690344582d4d9

                                                                              SHA256

                                                                              11fde3c052cc436dae10fa4c0b1821406d091cebb227a832a4f4c4101f21ffb4

                                                                              SHA512

                                                                              2dd6d06fc9613e7feb147d8f631ae62d9b83555a79349b6d2a161ff21253f478e06534c1eb685cfadc604010f75f6235ca2dd06bee165936999bc38e7e2069f8

                                                                            • \Users\Admin\AppData\Local\Temp\Install.exe
                                                                              MD5

                                                                              3e648a55b7add96eee6663a766cd1ce1

                                                                              SHA1

                                                                              5fbca3f597d061e944a51776188fe9761f6bb0a7

                                                                              SHA256

                                                                              4e322d00fdf7a75002ba41823e54c684cc133798342ee110f583c667589678e0

                                                                              SHA512

                                                                              669207d637b18ae4a035ecedfcac1f1629f01755cac1a27a347d287a3421cd81cc8ccaaa4dc39e3069248ea84424b5519cf595169dea4e7459cbbcf702a511bc

                                                                            • \Users\Admin\AppData\Local\Temp\Install.exe
                                                                              MD5

                                                                              3e648a55b7add96eee6663a766cd1ce1

                                                                              SHA1

                                                                              5fbca3f597d061e944a51776188fe9761f6bb0a7

                                                                              SHA256

                                                                              4e322d00fdf7a75002ba41823e54c684cc133798342ee110f583c667589678e0

                                                                              SHA512

                                                                              669207d637b18ae4a035ecedfcac1f1629f01755cac1a27a347d287a3421cd81cc8ccaaa4dc39e3069248ea84424b5519cf595169dea4e7459cbbcf702a511bc

                                                                            • \Users\Admin\AppData\Local\Temp\Install.exe
                                                                              MD5

                                                                              3e648a55b7add96eee6663a766cd1ce1

                                                                              SHA1

                                                                              5fbca3f597d061e944a51776188fe9761f6bb0a7

                                                                              SHA256

                                                                              4e322d00fdf7a75002ba41823e54c684cc133798342ee110f583c667589678e0

                                                                              SHA512

                                                                              669207d637b18ae4a035ecedfcac1f1629f01755cac1a27a347d287a3421cd81cc8ccaaa4dc39e3069248ea84424b5519cf595169dea4e7459cbbcf702a511bc

                                                                            • \Users\Admin\AppData\Local\Temp\Install.exe
                                                                              MD5

                                                                              3e648a55b7add96eee6663a766cd1ce1

                                                                              SHA1

                                                                              5fbca3f597d061e944a51776188fe9761f6bb0a7

                                                                              SHA256

                                                                              4e322d00fdf7a75002ba41823e54c684cc133798342ee110f583c667589678e0

                                                                              SHA512

                                                                              669207d637b18ae4a035ecedfcac1f1629f01755cac1a27a347d287a3421cd81cc8ccaaa4dc39e3069248ea84424b5519cf595169dea4e7459cbbcf702a511bc

                                                                            • \Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                              MD5

                                                                              9942af4949587dfd3682c125a583e184

                                                                              SHA1

                                                                              6fc54d693025f2a47f938cbc529809f605c52cc7

                                                                              SHA256

                                                                              0d4ce43a12fcd1e992bb4757d9cc544419d4408172658e7982e91d8c891db9b4

                                                                              SHA512

                                                                              facdbb40cf6071b4ab74af1cd7290e2e96d8d4f74bf5a5c6cf2b64955b43354fbb370f860f45ce647e79472435c4037b447f965c887ae5e4f276d1dcbc1fb52c

                                                                            • \Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                              MD5

                                                                              9942af4949587dfd3682c125a583e184

                                                                              SHA1

                                                                              6fc54d693025f2a47f938cbc529809f605c52cc7

                                                                              SHA256

                                                                              0d4ce43a12fcd1e992bb4757d9cc544419d4408172658e7982e91d8c891db9b4

                                                                              SHA512

                                                                              facdbb40cf6071b4ab74af1cd7290e2e96d8d4f74bf5a5c6cf2b64955b43354fbb370f860f45ce647e79472435c4037b447f965c887ae5e4f276d1dcbc1fb52c

                                                                            • \Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                              MD5

                                                                              9942af4949587dfd3682c125a583e184

                                                                              SHA1

                                                                              6fc54d693025f2a47f938cbc529809f605c52cc7

                                                                              SHA256

                                                                              0d4ce43a12fcd1e992bb4757d9cc544419d4408172658e7982e91d8c891db9b4

                                                                              SHA512

                                                                              facdbb40cf6071b4ab74af1cd7290e2e96d8d4f74bf5a5c6cf2b64955b43354fbb370f860f45ce647e79472435c4037b447f965c887ae5e4f276d1dcbc1fb52c

                                                                            • \Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                              MD5

                                                                              9942af4949587dfd3682c125a583e184

                                                                              SHA1

                                                                              6fc54d693025f2a47f938cbc529809f605c52cc7

                                                                              SHA256

                                                                              0d4ce43a12fcd1e992bb4757d9cc544419d4408172658e7982e91d8c891db9b4

                                                                              SHA512

                                                                              facdbb40cf6071b4ab74af1cd7290e2e96d8d4f74bf5a5c6cf2b64955b43354fbb370f860f45ce647e79472435c4037b447f965c887ae5e4f276d1dcbc1fb52c

                                                                            • \Users\Admin\AppData\Local\Temp\is-B90D0.tmp\IDWCH1.tmp
                                                                              MD5

                                                                              b6cee06d96499009bc0fddd23dc935aa

                                                                              SHA1

                                                                              ffaef1baa4456b6e10bb40c2612dba7b18743d01

                                                                              SHA256

                                                                              9553aee4cfe474165afa02a4f89455aaba3e27fe03bfda46ec85ec7c6f01574f

                                                                              SHA512

                                                                              b710767c8802981495368f0b4e0dd87a4b04833b974e6b82605c92a8303b1cf5525634b3c34a1e251193c73c59579aa15704260c3898a2d49f641770b2d95b4f

                                                                            • \Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • \Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • \Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • \Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • \Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • \Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • \Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                                                              MD5

                                                                              d7a9570e39d7d37c96c2aa839eac241c

                                                                              SHA1

                                                                              68613f933a78eac123bfe1e349e80545d24666ac

                                                                              SHA256

                                                                              fafff6b6a2fd0bdbee1d87fb66bff69586ef1f5a61306dfc43c75b11950675fd

                                                                              SHA512

                                                                              0dac193a4d5837076ec04ede106b755e4fff211466af45e68ea21e6e4faf3ab78ec63410d3a98a02b69f48009469353278c099a60c6a6eae5197c2309d7f16a0

                                                                            • \Users\Admin\AppData\Local\Temp\pub2.exe
                                                                              MD5

                                                                              57aed740aecdf6174b1fccad324f9d8d

                                                                              SHA1

                                                                              5809263fee371041afc3cffbb6edb000e324c5af

                                                                              SHA256

                                                                              e8f2db9b0b7a0dd3abf09ee4aa176b1a7a0dc9d2fd2cf963ed6c91cb5357d850

                                                                              SHA512

                                                                              f76ed5aef2d37af84b0b60707bc867172e35dd50ba04b8348cd51786c00fb50571ced744fce2b4c0d478c9d633964e2706279a1f0d9c13f1038c878c356f5f27

                                                                            • \Users\Admin\AppData\Local\Temp\pub2.exe
                                                                              MD5

                                                                              57aed740aecdf6174b1fccad324f9d8d

                                                                              SHA1

                                                                              5809263fee371041afc3cffbb6edb000e324c5af

                                                                              SHA256

                                                                              e8f2db9b0b7a0dd3abf09ee4aa176b1a7a0dc9d2fd2cf963ed6c91cb5357d850

                                                                              SHA512

                                                                              f76ed5aef2d37af84b0b60707bc867172e35dd50ba04b8348cd51786c00fb50571ced744fce2b4c0d478c9d633964e2706279a1f0d9c13f1038c878c356f5f27

                                                                            • \Users\Admin\AppData\Local\Temp\pub2.exe
                                                                              MD5

                                                                              57aed740aecdf6174b1fccad324f9d8d

                                                                              SHA1

                                                                              5809263fee371041afc3cffbb6edb000e324c5af

                                                                              SHA256

                                                                              e8f2db9b0b7a0dd3abf09ee4aa176b1a7a0dc9d2fd2cf963ed6c91cb5357d850

                                                                              SHA512

                                                                              f76ed5aef2d37af84b0b60707bc867172e35dd50ba04b8348cd51786c00fb50571ced744fce2b4c0d478c9d633964e2706279a1f0d9c13f1038c878c356f5f27

                                                                            • \Users\Admin\AppData\Local\Temp\pub2.exe
                                                                              MD5

                                                                              57aed740aecdf6174b1fccad324f9d8d

                                                                              SHA1

                                                                              5809263fee371041afc3cffbb6edb000e324c5af

                                                                              SHA256

                                                                              e8f2db9b0b7a0dd3abf09ee4aa176b1a7a0dc9d2fd2cf963ed6c91cb5357d850

                                                                              SHA512

                                                                              f76ed5aef2d37af84b0b60707bc867172e35dd50ba04b8348cd51786c00fb50571ced744fce2b4c0d478c9d633964e2706279a1f0d9c13f1038c878c356f5f27

                                                                            • \Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                              MD5

                                                                              ecec67e025fcd37f5d6069b5ff5105ed

                                                                              SHA1

                                                                              9a5a0bed2212f47071ad27b28fe407746ecfad18

                                                                              SHA256

                                                                              51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

                                                                              SHA512

                                                                              a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

                                                                            • \Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                              MD5

                                                                              ecec67e025fcd37f5d6069b5ff5105ed

                                                                              SHA1

                                                                              9a5a0bed2212f47071ad27b28fe407746ecfad18

                                                                              SHA256

                                                                              51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

                                                                              SHA512

                                                                              a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

                                                                            • \Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                              MD5

                                                                              ecec67e025fcd37f5d6069b5ff5105ed

                                                                              SHA1

                                                                              9a5a0bed2212f47071ad27b28fe407746ecfad18

                                                                              SHA256

                                                                              51ac8ea2c6cab10489188133a109aa4507b76ea459996173d0679d542780387c

                                                                              SHA512

                                                                              a9d59f137e8688bcee3f1fdc327b41b7f8d836c8e4753e1e9887e03a7c97ecfb851e9d88460f1003970fbaf8638eaa7dd94eb5875a30f51b2c2e7a20a1b51e33

                                                                            • memory/260-228-0x0000000000000000-mapping.dmp
                                                                            • memory/628-308-0x0000000000000000-mapping.dmp
                                                                            • memory/760-80-0x0000000000000000-mapping.dmp
                                                                            • memory/872-313-0x0000000001370000-0x00000000013E0000-memory.dmp
                                                                              Filesize

                                                                              448KB

                                                                            • memory/872-186-0x0000000000A60000-0x0000000000AAB000-memory.dmp
                                                                              Filesize

                                                                              300KB

                                                                            • memory/872-312-0x0000000000920000-0x000000000096B000-memory.dmp
                                                                              Filesize

                                                                              300KB

                                                                            • memory/872-187-0x0000000002110000-0x0000000002180000-memory.dmp
                                                                              Filesize

                                                                              448KB

                                                                            • memory/1032-60-0x0000000075801000-0x0000000075803000-memory.dmp
                                                                              Filesize

                                                                              8KB

                                                                            • memory/1064-229-0x0000000002970000-0x0000000002A76000-memory.dmp
                                                                              Filesize

                                                                              1.0MB

                                                                            • memory/1064-203-0x00000000003C0000-0x0000000000431000-memory.dmp
                                                                              Filesize

                                                                              452KB

                                                                            • memory/1064-200-0x00000000FF8F246C-mapping.dmp
                                                                            • memory/1064-230-0x0000000000260000-0x000000000027A000-memory.dmp
                                                                              Filesize

                                                                              104KB

                                                                            • memory/1064-202-0x0000000000060000-0x00000000000AB000-memory.dmp
                                                                              Filesize

                                                                              300KB

                                                                            • memory/1120-130-0x0000000000270000-0x00000000002A9000-memory.dmp
                                                                              Filesize

                                                                              228KB

                                                                            • memory/1120-108-0x0000000000000000-mapping.dmp
                                                                            • memory/1120-142-0x00000000004B0000-0x00000000004B1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1120-174-0x00000000004E0000-0x00000000004E1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1120-114-0x0000000000220000-0x0000000000221000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1120-112-0x0000000000080000-0x0000000000081000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1196-79-0x0000000000210000-0x000000000022B000-memory.dmp
                                                                              Filesize

                                                                              108KB

                                                                            • memory/1196-78-0x000000001AB40000-0x000000001AB42000-memory.dmp
                                                                              Filesize

                                                                              8KB

                                                                            • memory/1196-278-0x0000000000000000-mapping.dmp
                                                                            • memory/1196-65-0x0000000000000000-mapping.dmp
                                                                            • memory/1196-70-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1204-201-0x0000000002AF0000-0x0000000002B06000-memory.dmp
                                                                              Filesize

                                                                              88KB

                                                                            • memory/1252-311-0x00000000005D0000-0x000000000062C000-memory.dmp
                                                                              Filesize

                                                                              368KB

                                                                            • memory/1252-307-0x0000000000000000-mapping.dmp
                                                                            • memory/1252-309-0x0000000010000000-0x0000000010002000-memory.dmp
                                                                              Filesize

                                                                              8KB

                                                                            • memory/1252-310-0x0000000000990000-0x0000000000A91000-memory.dmp
                                                                              Filesize

                                                                              1.0MB

                                                                            • memory/1288-293-0x0000000000000000-mapping.dmp
                                                                            • memory/1308-238-0x0000000000000000-mapping.dmp
                                                                            • memory/1560-208-0x0000000000000000-mapping.dmp
                                                                            • memory/1592-102-0x0000000000000000-mapping.dmp
                                                                            • memory/1592-109-0x0000000000400000-0x00000000005DF000-memory.dmp
                                                                              Filesize

                                                                              1.9MB

                                                                            • memory/1604-124-0x00000000004A0000-0x00000000004CC000-memory.dmp
                                                                              Filesize

                                                                              176KB

                                                                            • memory/1604-83-0x0000000000000000-mapping.dmp
                                                                            • memory/1604-119-0x00000000049C0000-0x00000000049C1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1604-106-0x00000000006F0000-0x00000000006F1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1604-90-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1604-129-0x00000000004F0000-0x00000000004F1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1648-306-0x00000000001D0000-0x00000000001D1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1648-302-0x0000000000000000-mapping.dmp
                                                                            • memory/1708-96-0x00000000010C0000-0x00000000010C1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1708-93-0x0000000000000000-mapping.dmp
                                                                            • memory/1708-137-0x0000000001070000-0x0000000001071000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/1768-233-0x0000000000000000-mapping.dmp
                                                                            • memory/1768-236-0x0000000000240000-0x0000000000250000-memory.dmp
                                                                              Filesize

                                                                              64KB

                                                                            • memory/1768-237-0x0000000000270000-0x0000000000282000-memory.dmp
                                                                              Filesize

                                                                              72KB

                                                                            • memory/1948-282-0x0000000000000000-mapping.dmp
                                                                            • memory/1980-118-0x0000000000000000-mapping.dmp
                                                                            • memory/1988-74-0x0000000000000000-mapping.dmp
                                                                            • memory/2036-218-0x00000000003A0000-0x00000000003A1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2036-89-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2036-86-0x0000000000000000-mapping.dmp
                                                                            • memory/2036-107-0x0000000000360000-0x0000000000361000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2036-216-0x0000000000390000-0x000000000039E000-memory.dmp
                                                                              Filesize

                                                                              56KB

                                                                            • memory/2052-235-0x0000000000000000-mapping.dmp
                                                                            • memory/2076-290-0x0000000000000000-mapping.dmp
                                                                            • memory/2088-178-0x0000000000440000-0x0000000000441000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2088-120-0x0000000000000000-mapping.dmp
                                                                            • memory/2096-243-0x0000000000000000-mapping.dmp
                                                                            • memory/2124-134-0x0000000000000000-mapping.dmp
                                                                            • memory/2180-198-0x0000000000000000-mapping.dmp
                                                                            • memory/2192-300-0x0000000000000000-mapping.dmp
                                                                            • memory/2192-305-0x00000000003D0000-0x00000000003D1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2256-144-0x0000000000000000-mapping.dmp
                                                                            • memory/2256-157-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                              Filesize

                                                                              436KB

                                                                            • memory/2272-214-0x0000000000000000-mapping.dmp
                                                                            • memory/2272-215-0x00000000000F0000-0x00000000000F2000-memory.dmp
                                                                              Filesize

                                                                              8KB

                                                                            • memory/2272-231-0x00000000000F6000-0x0000000000115000-memory.dmp
                                                                              Filesize

                                                                              124KB

                                                                            • memory/2272-217-0x000007FEF2140000-0x000007FEF31D6000-memory.dmp
                                                                              Filesize

                                                                              16.6MB

                                                                            • memory/2276-303-0x0000000000400000-0x000000000046A000-memory.dmp
                                                                              Filesize

                                                                              424KB

                                                                            • memory/2276-298-0x0000000000000000-mapping.dmp
                                                                            • memory/2340-156-0x0000000000000000-mapping.dmp
                                                                            • memory/2360-295-0x0000000000000000-mapping.dmp
                                                                            • memory/2376-249-0x0000000000000000-mapping.dmp
                                                                            • memory/2380-284-0x0000000000000000-mapping.dmp
                                                                            • memory/2384-165-0x0000000000000000-mapping.dmp
                                                                            • memory/2384-197-0x0000000000400000-0x000000000044D000-memory.dmp
                                                                              Filesize

                                                                              308KB

                                                                            • memory/2384-196-0x00000000001B0000-0x00000000001B9000-memory.dmp
                                                                              Filesize

                                                                              36KB

                                                                            • memory/2396-254-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                              Filesize

                                                                              80KB

                                                                            • memory/2396-252-0x0000000000000000-mapping.dmp
                                                                            • memory/2400-296-0x0000000000000000-mapping.dmp
                                                                            • memory/2400-315-0x0000000000400000-0x00000000004A3000-memory.dmp
                                                                              Filesize

                                                                              652KB

                                                                            • memory/2400-314-0x0000000001C90000-0x0000000001D27000-memory.dmp
                                                                              Filesize

                                                                              604KB

                                                                            • memory/2444-204-0x0000000000000000-mapping.dmp
                                                                            • memory/2444-210-0x0000000000770000-0x0000000000771000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2488-173-0x0000000000250000-0x0000000000251000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2488-170-0x0000000000000000-mapping.dmp
                                                                            • memory/2492-297-0x0000000000000000-mapping.dmp
                                                                            • memory/2512-251-0x0000000000000000-mapping.dmp
                                                                            • memory/2532-287-0x0000000000000000-mapping.dmp
                                                                            • memory/2544-232-0x0000000000000000-mapping.dmp
                                                                            • memory/2556-172-0x0000000000000000-mapping.dmp
                                                                            • memory/2568-219-0x0000000000000000-mapping.dmp
                                                                            • memory/2568-220-0x0000000000070000-0x0000000000071000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2568-225-0x00000000049A0000-0x00000000049A1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2584-289-0x0000000000290000-0x00000000002A2000-memory.dmp
                                                                              Filesize

                                                                              72KB

                                                                            • memory/2584-288-0x00000000001D0000-0x00000000001E0000-memory.dmp
                                                                              Filesize

                                                                              64KB

                                                                            • memory/2584-285-0x0000000000000000-mapping.dmp
                                                                            • memory/2620-205-0x0000000000000000-mapping.dmp
                                                                            • memory/2620-207-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                              Filesize

                                                                              440KB

                                                                            • memory/2648-279-0x0000000000000000-mapping.dmp
                                                                            • memory/2648-292-0x0000000000000000-mapping.dmp
                                                                            • memory/2652-213-0x0000000002030000-0x0000000002032000-memory.dmp
                                                                              Filesize

                                                                              8KB

                                                                            • memory/2652-212-0x0000000000000000-mapping.dmp
                                                                            • memory/2664-299-0x0000000000000000-mapping.dmp
                                                                            • memory/2664-304-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                              Filesize

                                                                              436KB

                                                                            • memory/2720-241-0x000000006DDE1000-0x000000006DDE3000-memory.dmp
                                                                              Filesize

                                                                              8KB

                                                                            • memory/2720-242-0x0000000000180000-0x0000000000181000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2720-239-0x0000000000000000-mapping.dmp
                                                                            • memory/2740-257-0x00000000008A0000-0x00000000008DC000-memory.dmp
                                                                              Filesize

                                                                              240KB

                                                                            • memory/2740-264-0x0000000001F70000-0x0000000001F71000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-273-0x00000000037F0000-0x0000000003847000-memory.dmp
                                                                              Filesize

                                                                              348KB

                                                                            • memory/2740-274-0x00000000037F0000-0x0000000003847000-memory.dmp
                                                                              Filesize

                                                                              348KB

                                                                            • memory/2740-275-0x0000000003850000-0x0000000003851000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-276-0x00000000039A0000-0x00000000039A1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-277-0x00000000039B0000-0x00000000039B1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-271-0x00000000037F0000-0x0000000003847000-memory.dmp
                                                                              Filesize

                                                                              348KB

                                                                            • memory/2740-270-0x00000000037F0000-0x0000000003847000-memory.dmp
                                                                              Filesize

                                                                              348KB

                                                                            • memory/2740-272-0x00000000037F0000-0x0000000003847000-memory.dmp
                                                                              Filesize

                                                                              348KB

                                                                            • memory/2740-269-0x00000000037F0000-0x0000000003847000-memory.dmp
                                                                              Filesize

                                                                              348KB

                                                                            • memory/2740-268-0x0000000001FC0000-0x0000000001FC1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-267-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-266-0x0000000001F90000-0x0000000001F91000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-265-0x0000000001F80000-0x0000000001F81000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-259-0x0000000000670000-0x0000000000671000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-260-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-263-0x0000000001F60000-0x0000000001F61000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-255-0x0000000000000000-mapping.dmp
                                                                            • memory/2740-261-0x0000000000680000-0x0000000000681000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2740-262-0x0000000001F10000-0x0000000001F11000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2748-176-0x0000000000000000-mapping.dmp
                                                                            • memory/2748-184-0x0000000001F30000-0x0000000002031000-memory.dmp
                                                                              Filesize

                                                                              1.0MB

                                                                            • memory/2748-185-0x00000000009E0000-0x0000000000A3C000-memory.dmp
                                                                              Filesize

                                                                              368KB

                                                                            • memory/2780-180-0x0000000000417D92-mapping.dmp
                                                                            • memory/2780-179-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                              Filesize

                                                                              120KB

                                                                            • memory/2780-183-0x0000000004340000-0x0000000004341000-memory.dmp
                                                                              Filesize

                                                                              4KB

                                                                            • memory/2780-181-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                              Filesize

                                                                              120KB

                                                                            • memory/2816-226-0x0000000000000000-mapping.dmp
                                                                            • memory/2816-227-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp
                                                                              Filesize

                                                                              8KB

                                                                            • memory/2920-188-0x00000000FF8F246C-mapping.dmp
                                                                            • memory/2920-191-0x00000000002A0000-0x0000000000310000-memory.dmp
                                                                              Filesize

                                                                              448KB

                                                                            • memory/2960-189-0x0000000000000000-mapping.dmp
                                                                            • memory/2964-301-0x0000000000000000-mapping.dmp
                                                                            • memory/2988-244-0x0000000000000000-mapping.dmp
                                                                            • memory/3004-246-0x0000000000000000-mapping.dmp
                                                                            • memory/3036-192-0x0000000000000000-mapping.dmp
                                                                            • memory/3048-193-0x0000000000000000-mapping.dmp
                                                                            • memory/3048-194-0x0000000001FA0000-0x0000000001FA2000-memory.dmp
                                                                              Filesize

                                                                              8KB

                                                                            • memory/3060-281-0x0000000000000000-mapping.dmp